From c002826bdc0ec553e4c98f5f71b2921d0f283560 Mon Sep 17 00:00:00 2001
From: Hektor Misplon <hektor.misplon@pm.me>
Date: Fri, 6 Nov 2026 13:24:11 +0100
Subject: [PATCH] refactor(secrets): replace nixSigningKey with list

---
 hosts/andromache/default.nix |  2 +-
 hosts/astyanax/default.nix   |  2 +-
 modules/secrets/default.nix  | 20 ++++----------------
 3 files changed, 6 insertions(+), 18 deletions(-)

diff --git a/hosts/andromache/default.nix b/hosts/andromache/default.nix
index 6ac1a5f..3de4e53 100644
--- a/hosts/andromache/default.nix
+++ b/hosts/andromache/default.nix
@@ -72,7 +72,7 @@ in
   sandboxing.enable = true;
   secrets = {
     enable = true;
-    nixSigningKey.enable = true;
+    nix = [ "signing-key" ];
   };
   ssh.enable = true;
   storage.enable = true;
diff --git a/hosts/astyanax/default.nix b/hosts/astyanax/default.nix
index 3525da2..ab08221 100644
--- a/hosts/astyanax/default.nix
+++ b/hosts/astyanax/default.nix
@@ -74,7 +74,7 @@ in
   wol.wakes = [ "andromache" ];
   zfs.enable = true;
 
-  secrets.nixSigningKey.enable = true;
+  secrets.nix = [ "signing-key" ];
   restic-backup.enable = true;
   tailscale.enable = true;
   desktop.ly.enable = true;
diff --git a/modules/secrets/default.nix b/modules/secrets/default.nix
index d6723a8..a5a7c51 100644
--- a/modules/secrets/default.nix
+++ b/modules/secrets/default.nix
@@ -10,15 +10,14 @@
 let
   cfg = config.secrets;
   inherit (config.host) username;
-  inherit (cfg) sopsDir;
-  owner = config.users.users.${username}.name;
+  sopsDir = "${toString inputs.nix-secrets}/secrets";
+  owner = username;
 
   system = {
     email = [
       "personal"
       "work"
     ];
-    nix = lib.optional cfg.nixSigningKey.enable "signing-key";
   }
   // lib.filterAttrs (_: lib.isList) cfg;
 in
@@ -33,11 +32,6 @@ in
       options = {
         enable = lib.mkEnableOption "secrets management";
 
-        sopsDir = lib.mkOption {
-          type = lib.types.str;
-          default = "${toString inputs.nix-secrets}/secrets";
-        };
-
         user = lib.mkOption {
           type = lib.types.attrsOf (lib.types.listOf lib.types.str);
           default = { };
@@ -48,10 +42,6 @@ in
           default = owner;
         };
 
-        nixSigningKey = {
-          enable = lib.mkEnableOption "nix signing key configuration";
-        };
-
         yubikey = {
           enable = lib.mkEnableOption "set up Yubikey";
         };
@@ -60,11 +50,9 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    sops = {
-      secrets = lib'.mkSopsSecrets sopsDir null system // lib'.mkSopsSecrets sopsDir owner cfg.user;
-    };
+    sops.secrets = lib'.mkSopsSecrets sopsDir null system // lib'.mkSopsSecrets sopsDir owner cfg.user;
 
-    nix.settings.secret-key-files = lib.mkIf cfg.nixSigningKey.enable [
+    nix.settings.secret-key-files = lib.mkIf (system ? nix) [
       config.sops.secrets."nix/signing-key".path
     ];