hektor/nix
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix: update secrets approach to match 'nix-secrets'

Browse Source
This commit is contained in:
Hektor Misplon
2026-04-11 20:48:47 +02:00
parent db116cc4de
commit faf3afad79
17 changed files with 268 additions and 180 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
deploy/colmena.nix
View File

@@ -30,7 +30,12 @@ inputs.colmena.lib.makeHive (
};
nodeNixpkgs = builtins.mapAttrs (_: v: v.pkgs) self.nixosConfigurations;
nodeSpecialArgs = builtins.mapAttrs (_: v: v._module.specialArgs or { }) self.nixosConfigurations;
specialArgs = {
inherit inputs;
outputs = self;
dotsPath = ../dots;
myUtils = utils;
};
};
}
// nodes

122
flake.lock generated
View File

@@ -121,11 +121,11 @@
},
"locked": {
"dir": "pkgs/firefox-addons",
"lastModified": 1774843378,
"narHash": "sha256-8QLbY8F7UdxeQaW0KUVgr1/YPIupe+1lGjS5joR+ZCw=",
"lastModified": 1775966594,
"narHash": "sha256-pnRtaqTr7ut8dz8b04OWAanUM4tGhDUJz8SWmeTRp7U=",
"owner": "rycee",
"repo": "nur-expressions",
"rev": "0a31b668e3ebb599f95dc518076d709e8dddb57c",
"rev": "000d1d2322d28fa0a51b8db9f85a227aa5413b52",
"type": "gitlab"
},
"original": {
@@ -138,11 +138,11 @@
"firefox-gnome-theme": {
"flake": false,
"locked": {
"lastModified": 1764873433,
"narHash": "sha256-1XPewtGMi+9wN9Ispoluxunw/RwozuTRVuuQOmxzt+A=",
"lastModified": 1775176642,
"narHash": "sha256-2veEED0Fg7Fsh81tvVDNYR6SzjqQxa7hbi18Jv4LWpM=",
"owner": "rafaelmardojai",
"repo": "firefox-gnome-theme",
"rev": "f7ffd917ac0d253dbd6a3bf3da06888f57c69f92",
"rev": "179704030c5286c729b5b0522037d1d51341022c",
"type": "github"
},
"original": {
@@ -213,11 +213,11 @@
]
},
"locked": {
"lastModified": 1767609335,
"narHash": "sha256-feveD98mQpptwrAEggBQKJTYbvwwglSbOv53uCfH9PY=",
"lastModified": 1775087534,
"narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
"owner": "hercules-ci",
"repo": "flake-parts",
"rev": "250481aafeb741edfe23d29195671c19b36b6dca",
"rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
"type": "github"
},
"original": {
@@ -284,11 +284,11 @@
]
},
"locked": {
"lastModified": 1775036584,
"narHash": "sha256-zW0lyy7ZNNT/x8JhzFHBsP2IPx7ATZIPai4FJj12BgU=",
"lastModified": 1775585728,
"narHash": "sha256-8Psjt+TWvE4thRKktJsXfR6PA/fWWsZ04DVaY6PUhr4=",
"owner": "cachix",
"repo": "git-hooks.nix",
"rev": "4e0eb042b67d863b1b34b3f64d52ceb9cd926735",
"rev": "580633fa3fe5fc0379905986543fd7495481913d",
"type": "github"
},
"original": {
@@ -321,20 +321,18 @@
"gnome-shell": {
"flake": false,
"locked": {
"host": "gitlab.gnome.org",
"lastModified": 1767737596,
"narHash": "sha256-eFujfIUQDgWnSJBablOuG+32hCai192yRdrNHTv0a+s=",
"owner": "GNOME",
"repo": "gnome-shell",
"rev": "ef02db02bf0ff342734d525b5767814770d85b49",
"type": "gitlab"
"type": "github"
},
"original": {
"host": "gitlab.gnome.org",
"owner": "GNOME",
"ref": "gnome-49",
"repo": "gnome-shell",
"type": "gitlab"
"rev": "ef02db02bf0ff342734d525b5767814770d85b49",
"type": "github"
}
},
"home-manager": {
@@ -344,11 +342,11 @@
]
},
"locked": {
"lastModified": 1775047159,
"narHash": "sha256-UWM4VZvfKaPwA9FMu7iZha5YAE8vsEtUazk+rFxmbTY=",
"lastModified": 1775983377,
"narHash": "sha256-ZeRjipGQnVtQ/6batI+yVOrL853FZsL0m9A63OaSfgM=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "1ce9e62690dfdd7e76bd266ccb9a887778410eb2",
"rev": "e0ca734ffc85d25297715e98010b93303fa165c4",
"type": "github"
},
"original": {
@@ -400,10 +398,10 @@
"nix-secrets": {
"flake": false,
"locked": {
"lastModified": 1773999602,
"narHash": "sha256-Th4RuCEPHC8y1w/wrW9OSv9nAJ3/NSZ3MJ4DHhCXCKE=",
"lastModified": 1775987539,
"narHash": "sha256-ilN7pQUw/k4oBPJ+VoR3N5wWo72ePZfT4uvapiaLRng=",
"ref": "main",
"rev": "6f4b099a0c5ad1cca97f4ba1a665faaaed367f13",
"rev": "13c6ddfbec41164dbdaa9d70c01cd784ea9e17e5",
"shallow": true,
"type": "git",
"url": "ssh://git@github.com/hektor/nix-secrets"
@@ -417,11 +415,11 @@
},
"nixCats": {
"locked": {
"lastModified": 1770584904,
"narHash": "sha256-9Zaz8lbKF2W9pwXZEnbiGsicHdBoU+dHt3Wv3mCJoZ8=",
"lastModified": 1774835836,
"narHash": "sha256-6ok7iv/9R82vl6MYe3Lwyyb6S5bmW2PxEZtmjzlqyPs=",
"owner": "BirdeeHub",
"repo": "nixCats-nvim",
"rev": "538fdde784d2909700d97a8ef307783b33a86fb1",
"rev": "ebb9f279a55ca60ff4e37e4accf6518dc627aa8d",
"type": "github"
},
"original": {
@@ -453,11 +451,11 @@
},
"nixos-hardware": {
"locked": {
"lastModified": 1774933469,
"narHash": "sha256-OrnCQeUO2bqaWUl0lkDWyGWjKsOhtCyd7JSfTedQNUE=",
"lastModified": 1775490113,
"narHash": "sha256-2ZBhDNZZwYkRmefK5XLOusCJHnoeKkoN95hoSGgMxWM=",
"owner": "NixOS",
"repo": "nixos-hardware",
"rev": "f4c4c2c0c923d7811ac2a63ccc154767e4195337",
"rev": "c775c2772ba56e906cbeb4e0b2db19079ef11ff7",
"type": "github"
},
"original": {
@@ -469,11 +467,11 @@
},
"nixpkgs": {
"locked": {
"lastModified": 1774709303,
"narHash": "sha256-D3Q07BbIA2KnTcSXIqqu9P586uWxN74zNoCH3h2ESHg=",
"lastModified": 1775710090,
"narHash": "sha256-ar3rofg+awPB8QXDaFJhJ2jJhu+KqN/PRCXeyuXR76E=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "8110df5ad7abf5d4c0f6fb0f8f978390e77f9685",
"rev": "4c1018dae018162ec878d42fec712642d214fdfa",
"type": "github"
},
"original": {
@@ -511,11 +509,11 @@
]
},
"locked": {
"lastModified": 1767810917,
"narHash": "sha256-ZKqhk772+v/bujjhla9VABwcvz+hB2IaRyeLT6CFnT0=",
"lastModified": 1775228139,
"narHash": "sha256-ebbeHmg+V7w8050bwQOuhmQHoLOEOfqKzM1KgCTexK4=",
"owner": "nix-community",
"repo": "NUR",
"rev": "dead29c804adc928d3a69dfe7f9f12d0eec1f1a4",
"rev": "601971b9c89e0304561977f2c28fa25e73aa7132",
"type": "github"
},
"original": {
@@ -567,11 +565,11 @@
"plugins-helm-ls-nvim": {
"flake": false,
"locked": {
"lastModified": 1768584652,
"narHash": "sha256-jnMc87OjURNcqsva0npYgVyUrWc5C6L7yHpNvt9eSmg=",
"lastModified": 1773934114,
"narHash": "sha256-8trqFsA7nTKSdtkiAL0Sa9bXjh5ONtAqN7XNE/B8ukM=",
"owner": "qvalentin",
"repo": "helm-ls.nvim",
"rev": "f0b9a1723890971a6d84890b50dbf5f40974ea1b",
"rev": "20df43509b02a3ce3c6b3eee254d6e2bffa9a370",
"type": "github"
},
"original": {
@@ -667,11 +665,11 @@
]
},
"locked": {
"lastModified": 1774910634,
"narHash": "sha256-B+rZDPyktGEjOMt8PcHKYmgmKoF+GaNAFJhguktXAo0=",
"lastModified": 1775971308,
"narHash": "sha256-VKp9bhVSm0bT6JWctFy06ocqxGGnWHi1NfoE90IgIcY=",
"owner": "Mic92",
"repo": "sops-nix",
"rev": "19bf3d8678fbbfbc173beaa0b5b37d37938db301",
"rev": "31ac5fe5d015f76b54058c69fcaebb66a55871a4",
"type": "github"
},
"original": {
@@ -710,18 +708,17 @@
],
"nur": "nur",
"systems": "systems_2",
"tinted-foot": "tinted-foot",
"tinted-kitty": "tinted-kitty",
"tinted-schemes": "tinted-schemes",
"tinted-tmux": "tinted-tmux",
"tinted-zed": "tinted-zed"
},
"locked": {
"lastModified": 1774897726,
"narHash": "sha256-k/H2/oyex6GEC6uYXYetrboFQeTmX1Ouwv/zaW7b/Z0=",
"lastModified": 1775936757,
"narHash": "sha256-KJO/7qoxJ+hlsb3WlFSl6IGrExBIf1GvKdrhOlnGdKY=",
"owner": "danth",
"repo": "stylix",
"rev": "9b4a5eb409ceac2dd6ad495c7988e189a418cd30",
"rev": "d3e447786b74d62c75f665e17cb3e681c66e90c7",
"type": "github"
},
"original": {
@@ -760,23 +757,6 @@
"type": "github"
}
},
"tinted-foot": {
"flake": false,
"locked": {
"lastModified": 1726913040,
"narHash": "sha256-+eDZPkw7efMNUf3/Pv0EmsidqdwNJ1TaOum6k7lngDQ=",
"owner": "tinted-theming",
"repo": "tinted-foot",
"rev": "fd1b924b6c45c3e4465e8a849e67ea82933fcbe4",
"type": "github"
},
"original": {
"owner": "tinted-theming",
"repo": "tinted-foot",
"rev": "fd1b924b6c45c3e4465e8a849e67ea82933fcbe4",
"type": "github"
}
},
"tinted-kitty": {
"flake": false,
"locked": {
@@ -796,11 +776,11 @@
"tinted-schemes": {
"flake": false,
"locked": {
"lastModified": 1767710407,
"narHash": "sha256-+W1EB79Jl0/gm4JqmO0Nuc5C7hRdp4vfsV/VdzI+des=",
"lastModified": 1772661346,
"narHash": "sha256-4eu3LqB9tPqe0Vaqxd4wkZiBbthLbpb7llcoE/p5HT0=",
"owner": "tinted-theming",
"repo": "schemes",
"rev": "2800e2b8ac90f678d7e4acebe4fa253f602e05b2",
"rev": "13b5b0c299982bb361039601e2d72587d6846294",
"type": "github"
},
"original": {
@@ -812,11 +792,11 @@
"tinted-tmux": {
"flake": false,
"locked": {
"lastModified": 1767489635,
"narHash": "sha256-e6nnFnWXKBCJjCv4QG4bbcouJ6y3yeT70V9MofL32lU=",
"lastModified": 1772934010,
"narHash": "sha256-x+6+4UvaG+RBRQ6UaX+o6DjEg28u4eqhVRM9kpgJGjQ=",
"owner": "tinted-theming",
"repo": "tinted-tmux",
"rev": "3c32729ccae99be44fe8a125d20be06f8d7d8184",
"rev": "c3529673a5ab6e1b6830f618c45d9ce1bcdd829d",
"type": "github"
},
"original": {
@@ -828,11 +808,11 @@
"tinted-zed": {
"flake": false,
"locked": {
"lastModified": 1767488740,
"narHash": "sha256-wVOj0qyil8m+ouSsVZcNjl5ZR+1GdOOAooAatQXHbuU=",
"lastModified": 1772909925,
"narHash": "sha256-jx/5+pgYR0noHa3hk2esin18VMbnPSvWPL5bBjfTIAU=",
"owner": "tinted-theming",
"repo": "base16-zed",
"rev": "11abb0b282ad3786a2aae088d3a01c60916f2e40",
"rev": "b4d3a1b3bcbd090937ef609a0a3b37237af974df",
"type": "github"
},
"original": {

1
home/hosts/astyanax/default.nix
View File

@@ -23,6 +23,7 @@
../../modules/nfc
../../modules/nvim
../../modules/pandoc
../../modules/secrets
../../modules/shell
../../modules/ssh
../../modules/taskwarrior

14
home/modules/anki/default.nix
View File

@@ -4,13 +4,21 @@
pkgs,
myUtils,
osConfig ? null,
inputs ? null,
...
}:
let
sops = myUtils.sopsAvailability config osConfig;
standalone = osConfig == null;
in
{
lib.optionalAttrs standalone {
sops.secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" "anki" [
"sync-user"
"sync-key"
] { };
}
// {
warnings = lib.optional (
!sops.available && config.programs.anki.enable
) "anki is enabled but sops secrets are not available. anki sync will not be configured.";
@@ -24,8 +32,8 @@ in
review-heatmap
];
profiles."User 1".sync = lib.mkIf sops.available {
usernameFile = "${sops.secrets."anki-sync-user".path}";
keyFile = "${sops.secrets."anki-sync-key".path}";
usernameFile = "${sops.secrets."anki/sync-user".path}";
keyFile = "${sops.secrets."anki/sync-key".path}";
};
};
}

3
home/modules/secrets/default.nix
View File

@@ -6,7 +6,8 @@
imports = [ ./vault.nix ];
home.packages = with pkgs; [
sops
age
age-plugin-yubikey # TODO: only needed when using Yubikey
sops
];
}

22
home/modules/taskwarrior/default.nix
View File

@@ -5,13 +5,33 @@
dotsPath,
myUtils,
osConfig ? null,
inputs ? null,
...
}:
let
sops = myUtils.sopsAvailability config osConfig;
standalone = osConfig == null;
in
{
lib.optionalAttrs standalone {
sops = {
secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" "taskwarrior" [
"sync-server-url"
"sync-server-client-id"
"sync-encryption-secret"
] { };
templates."taskrc.d/sync" = {
content = ''
sync.server.url=${config.sops.placeholder."taskwarrior/sync-server-url"}
sync.server.client_id=${config.sops.placeholder."taskwarrior/sync-server-client-id"}
sync.encryption_secret=${config.sops.placeholder."taskwarrior/sync-encryption-secret"}
'';
};
};
}
// {
warnings =
lib.optional (!sops.available && config.programs.taskwarrior.enable)
"taskwarrior is enabled, but sops templates are not available. taskwarrior sync will not be configured.";

6
hosts/andromache/default.nix
View File

@@ -23,6 +23,8 @@ in
inherit lib config;
device = "/dev/nvme1n1";
})
../../modules/ai-tools
../../modules/anki
../../modules/audio
../../modules/backups
../../modules/bluetooth
@@ -31,17 +33,19 @@ in
../../modules/firewall
../../modules/fonts
../../modules/gaming
../../modules/git
../../modules/hcloud
../../modules/keyboard
../../modules/localization
../../modules/networking
../../modules/nvidia
(import ../../modules/secrets { inherit lib inputs config; })
../../modules/secrets
../../modules/ssh
../../modules/storage
../../modules/stylix
../../modules/syncthing
../../modules/tailscale
../../modules/taskwarrior
../../modules/users
../../modules/wol
../../modules/yubikey

22
hosts/astyanax/default.nix
View File

@@ -16,30 +16,34 @@ in
inputs.nixos-hardware.nixosModules.common-pc
inputs.nixos-hardware.nixosModules.common-pc-ssd
# inputs.nixos-hardware.nixosModules.lenovo-thinkpad-e14-intel-gen7 (not available yet?)
inputs.sops-nix.nixosModules.sops
../../modules/common
../../modules/boot/bootloader.nix
(import ../../modules/disko/zfs-encrypted-root.nix {
inherit lib config;
device = "/dev/nvme0n1";
})
../../modules/desktops/niri
../../modules/ai-tools
../../modules/anki
../../modules/audio
../../modules/backups
../../modules/bluetooth
../../modules/keyboard
../../modules/networking
../../modules/users
../../modules/localization
../../modules/desktops/niri
../../modules/docker
../../modules/firewall
../../modules/fonts
../../modules/git
../../modules/keyboard
../../modules/localization
../../modules/networking
../../modules/nfc
../../modules/secrets
../../modules/ssh
../../modules/storage
../../modules/stylix
(import ../../modules/secrets { inherit lib inputs config; })
../../modules/docker
../../modules/nfc
../../modules/firewall
../../modules/tailscale
../../modules/taskwarrior
../../modules/users
../../modules/yubikey
];

21
hosts/vm/default.nix
View File

@@ -1,5 +1,4 @@
{
lib,
inputs,
config,
pkgs,
@@ -12,20 +11,22 @@
./host.nix
./disk.nix
../../modules/common
../../modules/boot/bootloader.nix
../../modules/keyboard
../../modules/networking
../../modules/users
../../modules/anki
../../modules/audio
../../modules/localization
../../modules/x
../../modules/boot/bootloader.nix
../../modules/fonts
../../modules/git
../../modules/keyboard
../../modules/localization
../../modules/networking
../../modules/ai-tools
../../modules/ssh
../../modules/storage
../../modules/stylix
(import ../../modules/secrets {
inherit lib inputs config;
})
../../modules/secrets
../../modules/taskwarrior
../../modules/users
../../modules/x
];
home-manager.users.${config.host.username} = import ../../home/hosts/vm {

24
modules/ai-tools/default.nix Normal file
View File

@@ -0,0 +1,24 @@
{ config, myUtils, ... }:
let
inherit (config.secrets) sopsDir username;
owner = config.users.users.${username}.name;
in
{
config.sops = {
secrets = myUtils.mkSopsSecrets sopsDir "opencode" [ "api-key" ] { inherit owner; };
templates."opencode/auth.json" = {
inherit owner;
path = "/home/${username}/.local/share/opencode/auth.json";
content = ''
{
"zai-coding-plan": {
"type": "api",
"key": "${config.sops.placeholder."opencode/api-key"}"
}
}
'';
};
};
}

11
modules/anki/default.nix Normal file
View File

@@ -0,0 +1,11 @@
{ config, myUtils, ... }:
let
inherit (config.secrets) sopsDir username;
owner = config.users.users.${username}.name;
in
{
config.sops = {
secrets = myUtils.mkSopsSecrets sopsDir "anki" [ "sync-user" "sync-key" ] { inherit owner; };
};
}

29
modules/backups/default.nix
View File

@@ -1,6 +1,7 @@
{
lib,
config,
myUtils,
...
}:
@@ -13,12 +14,12 @@ in
restic-backup = {
repository = lib.mkOption {
type = lib.types.str;
default = "b2:${config.sops.placeholder.b2-bucket-name}:${config.networking.hostName}";
default = "b2:${config.sops.placeholder."backblaze-b2/bucket-name"}:${config.networking.hostName}";
};
passwordFile = lib.mkOption {
type = lib.types.str;
default = config.sops.secrets.restic-password.path;
default = config.sops.secrets."restic/password".path;
};
paths = lib.mkOption {
@@ -30,28 +31,18 @@ in
config = {
sops = {
secrets = {
restic-password = {
sopsFile = "${sopsDir}/restic-password";
};
b2-bucket-name = {
sopsFile = "${sopsDir}/b2-bucket-name";
};
b2-account-id = {
sopsFile = "${sopsDir}/b2-account-id";
};
b2-account-key = {
sopsFile = "${sopsDir}/b2-account-key";
};
};
secrets = lib.mkMerge [
(myUtils.mkSopsSecrets sopsDir "restic" [ "password" ] { })
(myUtils.mkSopsSecrets sopsDir "backblaze-b2" [ "bucket-name" "account-id" "account-key" ] { })
];
templates = {
"restic/repo-${config.networking.hostName}" = {
content = "b2:${config.sops.placeholder.b2-bucket-name}:${config.networking.hostName}";
content = "b2:${config.sops.placeholder."backblaze-b2/bucket-name"}:${config.networking.hostName}";
};
"restic/b2-env-${config.networking.hostName}" = {
content = ''
B2_ACCOUNT_ID=${config.sops.placeholder.b2-account-id}
B2_ACCOUNT_KEY=${config.sops.placeholder.b2-account-key}
B2_ACCOUNT_ID=${config.sops.placeholder."backblaze-b2/account-id"}
B2_ACCOUNT_KEY=${config.sops.placeholder."backblaze-b2/account-key"}
'';
};
};

29
modules/git/default.nix Normal file
View File

@@ -0,0 +1,29 @@
{
config,
...
}:
let
inherit (config.secrets) username;
owner = config.users.users.${username}.name;
in
{
config.sops.templates = {
".gitconfig.email" = {
inherit owner;
path = "/home/${username}/.gitconfig.email";
content = ''
[user]
email = ${config.sops.placeholder."email/personal"}
'';
};
".gitconfig.work.email" = {
inherit owner;
path = "/home/${username}/.gitconfig.work.email";
content = ''
[user]
email = ${config.sops.placeholder."email/work"}
'';
};
};
}

6
modules/hcloud/default.nix
View File

@@ -1,6 +1,7 @@
{
lib,
config,
myUtils,
...
}:
@@ -18,8 +19,7 @@ in
};
config = lib.mkIf cfg.enable {
sops.secrets.hcloud-token = {
sopsFile = "${sopsDir}/hcloud-token";
sops.secrets = myUtils.mkSopsSecrets sopsDir "hcloud" [ "api-token" ] {
owner = config.users.users.${cfg.username}.name;
};
@@ -31,7 +31,7 @@ in
[[contexts]]
name = "server"
token = "${config.sops.placeholder.hcloud-token}"
token = "${config.sops.placeholder."hcloud/api-token"}"
'';
};
};

83
modules/secrets/default.nix
View File

@@ -1,7 +1,9 @@
{
lib,
inputs,
pkgs,
config,
myUtils,
...
}:
@@ -9,13 +11,7 @@ let
cfg = config.secrets;
inherit (cfg) sopsDir;
owner = config.users.users.${cfg.username}.name;
mkSecret = name: {
${name} = {
sopsFile = "${sopsDir}/${name}";
inherit owner;
};
};
mkSopsSecrets = myUtils.mkSopsSecrets sopsDir;
in
{
imports = [ inputs.sops-nix.nixosModules.sops ];
@@ -38,69 +34,42 @@ in
default = "${config.host.name}-nix-signing-key";
};
};
yubikey = {
enable = lib.mkEnableOption "set up Yubikey";
};
};
};
config = {
sops = {
# for yubikey, generate as follows:
# ```
# age-plugin-yubikey --identity > <keyfile-path>
# ```
age.keyFile = "/home/${cfg.username}/.config/sops/age/keys.txt";
secrets = lib.mkMerge [
(mkSecret "taskwarrior-sync-server-url")
(mkSecret "taskwarrior-sync-server-client-id")
(mkSecret "taskwarrior-sync-encryption-secret")
(mkSecret "anki-sync-user")
(mkSecret "anki-sync-key")
(mkSecret "email-personal")
(mkSecret "email-work")
(mkSecret "opencode-api-key")
(lib.mkIf cfg.nixSigningKey.enable (mkSecret cfg.nixSigningKey.name))
(mkSopsSecrets "email" [ "personal" "work" ] { inherit owner; })
(lib.mkIf cfg.nixSigningKey.enable {
${cfg.nixSigningKey.name} = {
sopsFile = "${sopsDir}/${cfg.nixSigningKey.name}.yaml";
inherit owner;
};
})
];
templates = {
"taskrc.d/sync" = {
inherit owner;
content = ''
sync.server.url=${config.sops.placeholder.taskwarrior-sync-server-url}
sync.server.client_id=${config.sops.placeholder.taskwarrior-sync-server-client-id}
sync.encryption_secret=${config.sops.placeholder.taskwarrior-sync-encryption-secret}
'';
};
".gitconfig.email" = {
inherit owner;
path = "/home/${cfg.username}/.gitconfig.email";
content = ''
[user]
email = ${config.sops.placeholder.email-personal}
'';
};
".gitconfig.work.email" = {
inherit owner;
path = "/home/${cfg.username}/.gitconfig.work.email";
content = ''
[user]
email = ${config.sops.placeholder.email-work}
'';
};
"opencode/auth.json" = {
inherit owner;
path = "/home/${cfg.username}/.local/share/opencode/auth.json";
content = ''
{
"zai-coding-plan": {
"type": "api",
"key": "${config.sops.placeholder.opencode-api-key}"
}
}
'';
};
};
};
nix.settings.secret-key-files = lib.mkIf cfg.nixSigningKey.enable [
config.sops.secrets.${cfg.nixSigningKey.name}.path
];
services = {
pcscd.enable = true; # needed for age-plugin-yubikey?
udev.packages = lib.mkIf cfg.yubikey.enable [
pkgs.yubikey-personalization
pkgs.libfido2
];
};
};
}

24
modules/taskwarrior/default.nix Normal file
View File

@@ -0,0 +1,24 @@
{ config, myUtils, ... }:
let
inherit (config.secrets) sopsDir username;
owner = config.users.users.${username}.name;
in
{
config.sops = {
secrets = myUtils.mkSopsSecrets sopsDir "taskwarrior" [
"sync-server-url"
"sync-server-client-id"
"sync-encryption-secret"
] { inherit owner; };
templates."taskrc.d/sync" = {
inherit owner;
content = ''
sync.server.url=${config.sops.placeholder."taskwarrior/sync-server-url"}
sync.server.client_id=${config.sops.placeholder."taskwarrior/sync-server-client-id"}
sync.encryption_secret=${config.sops.placeholder."taskwarrior/sync-encryption-secret"}
'';
};
};
}

24
utils/default.nix
View File

@@ -11,15 +11,31 @@
else
throw "meta.nix required in ${hostDir}";
mkSopsSecrets =
sopsDir: group: names: extraOpts:
let
file = "${group}.yaml";
in
lib.foldl' lib.mergeAttrs { } (
map (name: {
"${group}/${name}" = {
sopsFile = "${sopsDir}/${file}";
key = name;
}
// extraOpts;
}) names
);
sopsAvailability =
config: osConfig:
let
hmSopsAvailable = config ? sops && config.sops ? secrets;
osSopsAvailable = osConfig != null && osConfig ? sops && osConfig.sops ? secrets;
hmSopsAvailable = config ? sops && config.sops ? secrets;
preferOs = osSopsAvailable;
in
{
available = hmSopsAvailable || osSopsAvailable;
secrets = if hmSopsAvailable then config.sops.secrets else osConfig.sops.secrets;
templates = if hmSopsAvailable then config.sops.templates else osConfig.sops.templates;
available = osSopsAvailable || hmSopsAvailable;
secrets = if preferOs then osConfig.sops.secrets else config.sops.secrets;
templates = if preferOs then osConfig.sops.templates else config.sops.templates;
};
}