fix: update secrets approach to match 'nix-secrets'

modules/ai-tools/default.nix

@@ -0,0 +1,24 @@
+{ config, myUtils, ... }:
+
+let
+  inherit (config.secrets) sopsDir username;
+  owner = config.users.users.${username}.name;
+in
+{
+  config.sops = {
+    secrets = myUtils.mkSopsSecrets sopsDir "opencode" [ "api-key" ] { inherit owner; };
+
+    templates."opencode/auth.json" = {
+      inherit owner;
+      path = "/home/${username}/.local/share/opencode/auth.json";
+      content = ''
+        {
+          "zai-coding-plan": {
+            "type": "api",
+            "key": "${config.sops.placeholder."opencode/api-key"}"
+          }
+        }
+      '';
+    };
+  };
+}

modules/anki/default.nix

@@ -0,0 +1,11 @@
+{ config, myUtils, ... }:
+
+let
+  inherit (config.secrets) sopsDir username;
+  owner = config.users.users.${username}.name;
+in
+{
+  config.sops = {
+    secrets = myUtils.mkSopsSecrets sopsDir "anki" [ "sync-user" "sync-key" ] { inherit owner; };
+  };
+}

modules/backups/default.nix

@@ -1,6 +1,7 @@
 {
   lib,
   config,
+  myUtils,
   ...
 }:
 
@@ -13,12 +14,12 @@ in
     restic-backup = {
       repository = lib.mkOption {
         type = lib.types.str;
-        default = "b2:${config.sops.placeholder.b2-bucket-name}:${config.networking.hostName}";
+        default = "b2:${config.sops.placeholder."backblaze-b2/bucket-name"}:${config.networking.hostName}";
       };
 
       passwordFile = lib.mkOption {
         type = lib.types.str;
-        default = config.sops.secrets.restic-password.path;
+        default = config.sops.secrets."restic/password".path;
       };
 
       paths = lib.mkOption {
@@ -30,28 +31,18 @@ in
 
   config = {
     sops = {
-      secrets = {
-        restic-password = {
-          sopsFile = "${sopsDir}/restic-password";
-        };
-        b2-bucket-name = {
-          sopsFile = "${sopsDir}/b2-bucket-name";
-        };
-        b2-account-id = {
-          sopsFile = "${sopsDir}/b2-account-id";
-        };
-        b2-account-key = {
-          sopsFile = "${sopsDir}/b2-account-key";
-        };
-      };
+      secrets = lib.mkMerge [
+        (myUtils.mkSopsSecrets sopsDir "restic" [ "password" ] { })
+        (myUtils.mkSopsSecrets sopsDir "backblaze-b2" [ "bucket-name" "account-id" "account-key" ] { })
+      ];
       templates = {
         "restic/repo-${config.networking.hostName}" = {
-          content = "b2:${config.sops.placeholder.b2-bucket-name}:${config.networking.hostName}";
+          content = "b2:${config.sops.placeholder."backblaze-b2/bucket-name"}:${config.networking.hostName}";
         };
         "restic/b2-env-${config.networking.hostName}" = {
           content = ''
-            B2_ACCOUNT_ID=${config.sops.placeholder.b2-account-id}
-            B2_ACCOUNT_KEY=${config.sops.placeholder.b2-account-key}
+            B2_ACCOUNT_ID=${config.sops.placeholder."backblaze-b2/account-id"}
+            B2_ACCOUNT_KEY=${config.sops.placeholder."backblaze-b2/account-key"}
           '';
         };
       };

modules/git/default.nix

@@ -0,0 +1,29 @@
+{
+  config,
+  ...
+}:
+
+let
+  inherit (config.secrets) username;
+  owner = config.users.users.${username}.name;
+in
+{
+  config.sops.templates = {
+    ".gitconfig.email" = {
+      inherit owner;
+      path = "/home/${username}/.gitconfig.email";
+      content = ''
+        [user]
+          email = ${config.sops.placeholder."email/personal"}
+      '';
+    };
+    ".gitconfig.work.email" = {
+      inherit owner;
+      path = "/home/${username}/.gitconfig.work.email";
+      content = ''
+        [user]
+          email = ${config.sops.placeholder."email/work"}
+      '';
+    };
+  };
+}

modules/hcloud/default.nix

@@ -1,6 +1,7 @@
 {
   lib,
   config,
+  myUtils,
   ...
 }:
 
@@ -18,8 +19,7 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    sops.secrets.hcloud-token = {
-      sopsFile = "${sopsDir}/hcloud-token";
+    sops.secrets = myUtils.mkSopsSecrets sopsDir "hcloud" [ "api-token" ] {
       owner = config.users.users.${cfg.username}.name;
     };
 
@@ -31,7 +31,7 @@ in
 
         [[contexts]]
           name = "server"
-          token = "${config.sops.placeholder.hcloud-token}"
+          token = "${config.sops.placeholder."hcloud/api-token"}"
       '';
     };
   };

modules/secrets/default.nix

@@ -1,7 +1,9 @@
 {
   lib,
   inputs,
+  pkgs,
   config,
+  myUtils,
   ...
 }:
 
@@ -9,13 +11,7 @@ let
   cfg = config.secrets;
   inherit (cfg) sopsDir;
   owner = config.users.users.${cfg.username}.name;
-
-  mkSecret = name: {
-    ${name} = {
-      sopsFile = "${sopsDir}/${name}";
-      inherit owner;
-    };
-  };
+  mkSopsSecrets = myUtils.mkSopsSecrets sopsDir;
 in
 {
   imports = [ inputs.sops-nix.nixosModules.sops ];
@@ -38,69 +34,42 @@ in
           default = "${config.host.name}-nix-signing-key";
         };
       };
+
+      yubikey = {
+        enable = lib.mkEnableOption "set up Yubikey";
+      };
     };
   };
 
   config = {
     sops = {
+      # for yubikey, generate as follows:
+      # ```
+      # age-plugin-yubikey --identity > <keyfile-path>
+      # ```
       age.keyFile = "/home/${cfg.username}/.config/sops/age/keys.txt";
 
       secrets = lib.mkMerge [
-        (mkSecret "taskwarrior-sync-server-url")
-        (mkSecret "taskwarrior-sync-server-client-id")
-        (mkSecret "taskwarrior-sync-encryption-secret")
-        (mkSecret "anki-sync-user")
-        (mkSecret "anki-sync-key")
-        (mkSecret "email-personal")
-        (mkSecret "email-work")
-        (mkSecret "opencode-api-key")
-        (lib.mkIf cfg.nixSigningKey.enable (mkSecret cfg.nixSigningKey.name))
+        (mkSopsSecrets "email" [ "personal" "work" ] { inherit owner; })
+        (lib.mkIf cfg.nixSigningKey.enable {
+          ${cfg.nixSigningKey.name} = {
+            sopsFile = "${sopsDir}/${cfg.nixSigningKey.name}.yaml";
+            inherit owner;
+          };
+        })
       ];
-
-      templates = {
-        "taskrc.d/sync" = {
-          inherit owner;
-          content = ''
-            sync.server.url=${config.sops.placeholder.taskwarrior-sync-server-url}
-            sync.server.client_id=${config.sops.placeholder.taskwarrior-sync-server-client-id}
-            sync.encryption_secret=${config.sops.placeholder.taskwarrior-sync-encryption-secret}
-          '';
-        };
-
-        ".gitconfig.email" = {
-          inherit owner;
-          path = "/home/${cfg.username}/.gitconfig.email";
-          content = ''
-            [user]
-              email = ${config.sops.placeholder.email-personal}
-          '';
-        };
-        ".gitconfig.work.email" = {
-          inherit owner;
-          path = "/home/${cfg.username}/.gitconfig.work.email";
-          content = ''
-            [user]
-              email = ${config.sops.placeholder.email-work}
-          '';
-        };
-
-        "opencode/auth.json" = {
-          inherit owner;
-          path = "/home/${cfg.username}/.local/share/opencode/auth.json";
-          content = ''
-            {
-              "zai-coding-plan": {
-                "type": "api",
-                "key": "${config.sops.placeholder.opencode-api-key}"
-              }
-            }
-          '';
-        };
-      };
     };
 
     nix.settings.secret-key-files = lib.mkIf cfg.nixSigningKey.enable [
       config.sops.secrets.${cfg.nixSigningKey.name}.path
     ];
+
+    services = {
+      pcscd.enable = true; # needed for age-plugin-yubikey?
+      udev.packages = lib.mkIf cfg.yubikey.enable [
+        pkgs.yubikey-personalization
+        pkgs.libfido2
+      ];
+    };
   };
 }

modules/taskwarrior/default.nix

@@ -0,0 +1,24 @@
+{ config, myUtils, ... }:
+
+let
+  inherit (config.secrets) sopsDir username;
+  owner = config.users.users.${username}.name;
+in
+{
+  config.sops = {
+    secrets = myUtils.mkSopsSecrets sopsDir "taskwarrior" [
+      "sync-server-url"
+      "sync-server-client-id"
+      "sync-encryption-secret"
+    ] { inherit owner; };
+
+    templates."taskrc.d/sync" = {
+      inherit owner;
+      content = ''
+        sync.server.url=${config.sops.placeholder."taskwarrior/sync-server-url"}
+        sync.server.client_id=${config.sops.placeholder."taskwarrior/sync-server-client-id"}
+        sync.encryption_secret=${config.sops.placeholder."taskwarrior/sync-encryption-secret"}
+      '';
+    };
+  };
+}