refactor(secrets): simplify home manager secrets

home/hosts/packages.nix

@@ -15,7 +15,6 @@ with pkgs;
   parallel
   pass
   ripgrep
-  sops
   tldr
   tree
   wget

home/modules/ai-tools/opencode.nix

@@ -2,25 +2,18 @@
   config,
   lib,
   pkgs,
-  lib',
-  osConfig ? null,
-  inputs ? null,
   ...
 }:
 
 let
-  sops = lib'.sopsAvailability config osConfig;
+  authReady = config.secrets.templatePath ? "opencode/auth.json";
-  standalone = osConfig == null;
 in
 {
-  config = lib.mkIf config.ai-tools.opencode.enable (
+  config = lib.mkIf config.ai-tools.opencode.enable {
-    lib.optionalAttrs standalone {
+    secrets.files.opencode = [ "api-key" ];
-      sops = {
+
-        secrets = lib'.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" null {
+    secrets.templates."opencode/auth.json" = {
-          opencode = [ "api-key" ];
+      path = ".local/share/opencode/auth.json";
-        };
-        templates."opencode/auth.json" = {
-          path = "${config.home.homeDirectory}/.local/share/opencode/auth.json";
       content = builtins.toJSON {
         zai-coding-plan = {
           type = "api";
@@ -28,12 +21,10 @@ in
         };
       };
     };
-      };
+
-    }
-    // {
     warnings =
-        lib.optional (!sops.available)
+      lib.optional (!authReady)
-          "opencode is enabled, but sops templates are not available. the opencode API key will not be configured.";
+        "opencode is enabled but its auth template is unavailable. the opencode API key will not be configured.";
 
     home.packages = [ pkgs.opencode ];
     home.file.".config/opencode/opencode.json".text = builtins.toJSON {
@@ -57,6 +48,5 @@ in
       };
       plugin = [ "@mohak34/opencode-notifier@latest" ];
     };
-    }
+  };
-  );
 }

home/modules/anki/default.nix

@@ -2,33 +2,25 @@
   config,
   lib,
   pkgs,
-  lib',
-  osConfig ? null,
-  inputs ? null,
   ...
 }:
 
 let
   cfg = config.anki;
-  sops = lib'.sopsAvailability config osConfig;
+  syncReady = config.secrets.path ? "anki/sync-user" && config.secrets.path ? "anki/sync-key";
-  standalone = osConfig == null;
 in
 {
   options.anki.enable = lib.mkEnableOption "Anki";
 
-  config = lib.mkIf cfg.enable (
+  config = lib.mkIf cfg.enable {
-    lib.optionalAttrs standalone {
+    secrets.files.anki = [
-      sops.secrets = lib'.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" null {
-        anki = [
       "sync-user"
       "sync-key"
     ];
-      };
+
-    }
-    // {
     warnings = lib.optional (
-        !sops.available
+      !syncReady
-      ) "anki is enabled but sops secrets are not available. anki sync will not be configured.";
+    ) "anki is enabled but its secrets are unavailable. anki sync will not be configured.";
 
     programs.anki = {
       enable = true;
@@ -48,14 +40,13 @@ in
         puppy-reinforcement
         review-heatmap
       ];
-        profiles."User 1".sync = lib.mkIf sops.available {
+      profiles."User 1".sync = lib.mkIf syncReady {
-          usernameFile = "${sops.secrets."anki/sync-user".path}";
+        usernameFile = config.secrets.path."anki/sync-user";
-          keyFile = "${sops.secrets."anki/sync-key".path}";
+        keyFile = config.secrets.path."anki/sync-key";
       };
     };
 
     # allow Anki to write prefs
     home.file."${config.xdg.dataHome}/Anki2/prefs21.db".enable = lib.mkForce false;
-    }
+  };
-  );
 }

home/modules/git/default.nix

@@ -1,22 +1,24 @@
 {
   config,
-  inputs,
   lib,
-  lib',
-  osConfig ? null,
   ...
 }:
 
 let
   cfg = config.git;
-  sops = lib'.sopsAvailability config osConfig;
+  identities = [
-  standalone = osConfig == null;
+    "personal"
+    "work"
+  ];
 
-  personalEmail = sops.templates.".gitconfig.email".path;
+  emailTemplate = key: ".gitconfig.${key}.email";
-  workEmail = sops.templates.".gitconfig.work.email".path;
+  emailInclude =
+    key:
+    lib.optionalAttrs (config.secrets.templatePath ? ${emailTemplate key}) {
+      include.path = config.secrets.templatePath.${emailTemplate key};
+    };
 
-  workSettings = {
+  workSettings = emailInclude "work" // {
-    include.path = workEmail;
     core.longpaths = true;
     user = {
       name = "Hektor Misplon";
@@ -47,29 +49,19 @@ in
     ./gitlab.nix
   ];
 
-  config = lib.mkIf cfg.enable (
+  config = lib.mkIf cfg.enable {
-    lib.optionalAttrs standalone {
+    secrets.files.email = identities;
-      sops = {
-        secrets = lib'.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" null {
-          email = [
-            "personal"
-            "work"
-          ];
-        };
 
-        templates = {
+    secrets.templates = lib.genAttrs' identities (
-          ".gitconfig.email".content = ''
+      key:
+      lib.nameValuePair (emailTemplate key) {
+        content = ''
           [user]
-              email = ${config.sops.placeholder."email/personal"}
+            email = ${config.sops.placeholder."email/${key}"}
         '';
-          ".gitconfig.work.email".content = ''
-            [user]
-              email = ${config.sops.placeholder."email/work"}
-          '';
-        };
-      };
       }
-    // {
+    );
+
     warnings = lib.optional (
       !config.nvim.enable
     ) "'git.enable' is enabled without 'nvim.enable' (not using 'nvimdiff')";
@@ -162,8 +154,11 @@ in
         })
       ];
 
-        includes = [
+      includes =
-          { path = personalEmail; }
+        lib.optional (config.secrets.templatePath ? ${emailTemplate "personal"}) {
+          path = config.secrets.templatePath.${emailTemplate "personal"};
+        }
+        ++ [
           {
             condition = "gitdir:~/work/";
             contents = workSettings;
@@ -176,6 +171,5 @@ in
           }
         ];
     };
-    }
+  };
-  );
 }

home/modules/secrets/default.nix

@@ -2,24 +2,94 @@
   config,
   lib,
   pkgs,
+  inputs,
+  lib',
+  osConfig ? null,
   ...
 }:
+
+let
+  cfg = config.secrets;
+  sops = lib'.sopsAvailability config osConfig;
+  standalone = !sops.osAvailable;
+
+  sopsDir = "${toString inputs.nix-secrets}/secrets";
+in
 {
-  options.secrets = {
-    enable = lib.mkEnableOption "secrets";
-
-    vault = {
-      enable = lib.mkEnableOption "vault CLI";
-    };
-  };
-
   imports = [ ./vault.nix ];
 
-  config = lib.mkIf config.secrets.enable {
+  options.secrets = {
-    home.packages = with pkgs; [
+    enable = lib.mkEnableOption "secrets";
-      age
+    vault.enable = lib.mkEnableOption "vault CLI";
-      age-plugin-yubikey
+
-      sops
+    files = lib.mkOption {
-    ];
+      type = lib.types.attrsOf (lib.types.listOf lib.types.str);
     };
+
+    templates = lib.mkOption {
+      type = lib.types.attrsOf (
+        lib.types.submodule {
+          options = {
+            path = lib.mkOption {
+              type = lib.types.nullOr lib.types.str;
+              default = null;
+            };
+            content = lib.mkOption {
+              type = lib.types.str;
+            };
+          };
+        }
+      );
+    };
+
+    path = lib.mkOption {
+      type = lib.types.attrsOf lib.types.str;
+      readOnly = true;
+    };
+
+    templatePath = lib.mkOption {
+      type = lib.types.attrsOf lib.types.str;
+      readOnly = true;
+    };
+  };
+
+  config = lib.mkMerge [
+    {
+      secrets.path = lib.optionalAttrs sops.available (
+        lib.mapAttrs (_: secret: secret.path) sops.secrets
+      );
+
+      secrets.templatePath = lib.optionalAttrs sops.available (
+        lib.mapAttrs (_: template: template.path) sops.templates
+      );
+    }
+    (lib.mkIf cfg.enable (
+      lib.optionalAttrs standalone {
+        sops = {
+          secrets = lib'.mkSopsSecrets sopsDir null cfg.files;
+
+          templates = lib.mapAttrs (
+            _: t:
+            {
+              inherit (t) content;
+            }
+            // lib.optionalAttrs (t.path != null) {
+              path = "${config.home.homeDirectory}/${t.path}";
+            }
+          ) cfg.templates;
+        };
+      }
+      // {
+        home.packages = [
+          pkgs.age
+          pkgs.age-plugin-yubikey
+          pkgs.sops
+        ];
+
+        warnings = lib.optional (
+          !sops.available && (cfg.files != { } || cfg.templates != { })
+        ) "secrets declared, but sops unavailable.";
+      }
+    ))
+  ];
 }

home/modules/taskwarrior/default.nix

@@ -2,15 +2,11 @@
   config,
   lib,
   pkgs,
-  lib',
-  osConfig ? null,
-  inputs ? null,
   ...
 }:
 
 let
-  sops = lib'.sopsAvailability config osConfig;
+  syncReady = config.secrets.templatePath ? "taskrc.d/sync";
-  standalone = osConfig == null;
 
   syncHook = pkgs.writers.writePython3 "on-exit.sync.py" { flakeIgnore = [ "E501" ]; } ''
     # Source: <https://gist.github.com/danmou/83079feac22307813178d7f8c456c544>
@@ -61,30 +57,22 @@ in
 {
   options.taskwarrior.enable = lib.mkEnableOption "taskwarrior";
 
-  config = lib.mkIf config.taskwarrior.enable (
+  config = lib.mkIf config.taskwarrior.enable {
-    lib.optionalAttrs standalone {
+    secrets.files.taskwarrior = [
-      sops = {
-        secrets = lib'.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" null {
-          taskwarrior = [
       "sync-server-url"
       "sync-server-client-id"
       "sync-encryption-secret"
     ];
-        };
 
-        templates."taskrc.d/sync" = {
+    secrets.templates."taskrc.d/sync".content = ''
-          content = ''
       sync.server.url=${config.sops.placeholder."taskwarrior/sync-server-url"}
       sync.server.client_id=${config.sops.placeholder."taskwarrior/sync-server-client-id"}
       sync.encryption_secret=${config.sops.placeholder."taskwarrior/sync-encryption-secret"}
     '';
-        };
+
-      };
-    }
-    // {
     warnings =
-        lib.optional (!sops.available)
+      lib.optional (!syncReady)
-          "taskwarrior is enabled, but sops templates are not available. taskwarrior sync will not be configured.";
+        "taskwarrior is enabled but its sync template is unavailable. taskwarrior sync will not be configured.";
 
     home.file = {
       ".local/share/task/hooks/on-exit.sync.py".source = syncHook;
@@ -162,10 +150,9 @@ in
         "recurrence" = "off";
         "reserved.lines" = "3";
       };
-        extraConfig = lib.optionalString sops.available ''
+      extraConfig = lib.optionalString syncReady ''
-          include ${sops.templates."taskrc.d/sync".path}
+        include ${config.secrets.templatePath."taskrc.d/sync"}
       '';
     };
-    }
+  };
-  );
 }

hosts/andromache/default.nix

@@ -72,7 +72,7 @@ in
   sandboxing.enable = true;
   secrets = {
     enable = true;
-    nixSigningKey.enable = true;
+    nix = [ "signing-key" ];
   };
   ssh.enable = true;
   storage.enable = true;

hosts/astyanax/default.nix

@@ -74,7 +74,7 @@ in
   wol.wakes = [ "andromache" ];
   zfs.enable = true;
 
-  secrets.nixSigningKey.enable = true;
+  secrets.nix = [ "signing-key" ];
   restic-backup.enable = true;
   tailscale.enable = true;
   desktop.ly.enable = true;

lib/secrets.nix

@@ -28,6 +28,7 @@
     in
     {
       available = osSopsAvailable || hmSopsAvailable;
+      osAvailable = osSopsAvailable;
       secrets = if osSopsAvailable then osConfig.sops.secrets else config.sops.secrets;
       templates = if osSopsAvailable then osConfig.sops.templates else config.sops.templates;
     };

modules/git/default.nix

@@ -9,21 +9,15 @@ in
   options.git.enable = lib.mkEnableOption "git";
 
   config = lib.mkIf cfg.enable {
-    sops.templates = {
+    sops.templates = lib.genAttrs' [ "personal" "work" ] (
-      ".gitconfig.email" = {
+      key:
+      lib.nameValuePair ".gitconfig.${key}.email" {
         inherit owner;
         content = ''
           [user]
-            email = ${config.sops.placeholder."email/personal"}
+            email = ${config.sops.placeholder."email/${key}"}
         '';
-      };
+      }
-      ".gitconfig.work.email" = {
+    );
-        inherit owner;
-        content = ''
-          [user]
-            email = ${config.sops.placeholder."email/work"}
-        '';
-      };
-    };
   };
 }

modules/secrets/default.nix

@@ -10,15 +10,14 @@
 let
   cfg = config.secrets;
   inherit (config.host) username;
-  inherit (cfg) sopsDir;
+  sopsDir = "${toString inputs.nix-secrets}/secrets";
-  owner = config.users.users.${username}.name;
+  owner = username;
 
   system = {
     email = [
       "personal"
       "work"
     ];
-    nix = lib.optional cfg.nixSigningKey.enable "signing-key";
   }
   // lib.filterAttrs (_: lib.isList) cfg;
 in
@@ -33,11 +32,6 @@ in
       options = {
         enable = lib.mkEnableOption "secrets management";
 
-        sopsDir = lib.mkOption {
-          type = lib.types.str;
-          default = "${toString inputs.nix-secrets}/secrets";
-        };
-
         user = lib.mkOption {
           type = lib.types.attrsOf (lib.types.listOf lib.types.str);
           default = { };
@@ -48,10 +42,6 @@ in
           default = owner;
         };
 
-        nixSigningKey = {
-          enable = lib.mkEnableOption "nix signing key configuration";
-        };
-
         yubikey = {
           enable = lib.mkEnableOption "set up Yubikey";
         };
@@ -60,11 +50,9 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    sops = {
+    sops.secrets = lib'.mkSopsSecrets sopsDir null system // lib'.mkSopsSecrets sopsDir owner cfg.user;
-      secrets = lib'.mkSopsSecrets sopsDir null system // lib'.mkSopsSecrets sopsDir owner cfg.user;
-    };
 
-    nix.settings.secret-key-files = lib.mkIf cfg.nixSigningKey.enable [
+    nix.settings.secret-key-files = lib.mkIf (system ? nix) [
       config.sops.secrets."nix/signing-key".path
     ];