refactor(secrets): simplify secrets

.envrc

@@ -0,0 +1 @@
+use flake

.gitignore

@@ -9,4 +9,5 @@ result-*
 
 nixos-efi-vars.fd
 
-/.pre-commit-config.yaml
+.direnv/
+.pre-commit-config.yaml

deploy/colmena.nix

@@ -21,15 +21,12 @@ let
   nodes = lib.genAttrs hostDirNames (
     hostname: mkNode hostname (utils.hostMeta ../hosts/${hostname}).deployment.tags
   );
+
 in
 inputs.colmena.lib.makeHive (
   {
     meta = {
-      nixpkgs = import inputs.nixpkgs {
-        localSystem = "x86_64-linux";
-      };
-
-      nodeNixpkgs = builtins.mapAttrs (_: v: v.pkgs) self.nixosConfigurations;
+      nixpkgs = import inputs.nixpkgs { localSystem = "x86_64-linux"; };
       specialArgs = {
         inherit inputs;
         outputs = self;

home/hosts/andromache/default.nix

@@ -25,6 +25,7 @@
     ../../modules/nvim
     ../../modules/pandoc
     ../../modules/photography
+    ../../modules/secrets
     ../../modules/shell
     ../../modules/ssh
     ../../modules/taskwarrior

home/modules/anki/default.nix

@@ -13,10 +13,12 @@ let
   standalone = osConfig == null;
 in
 lib.optionalAttrs standalone {
-  sops.secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" "anki" [
+  sops.secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" null {
+    anki = [
       "sync-user"
       "sync-key"
-  ] { };
+    ];
+  };
 }
 // {
   warnings = lib.optional (

home/modules/taskwarrior/default.nix

@@ -15,11 +15,13 @@ let
 in
 lib.optionalAttrs standalone {
   sops = {
-    secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" "taskwarrior" [
+    secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" null {
+      taskwarrior = [
         "sync-server-url"
         "sync-server-client-id"
         "sync-encryption-secret"
-    ] { };
+      ];
+    };
 
     templates."taskrc.d/sync" = {
       content = ''

hosts/andromache/default.nix

@@ -68,6 +68,7 @@ in
     nixSigningKey.enable = true;
   };
 
+  restic-backup.enable = true;
   tailscale.enable = true;
 
   docker.user = config.host.username;

hosts/astyanax/default.nix

@@ -64,6 +64,7 @@ in
     nixSigningKey.enable = true;
   };
 
+  restic-backup.enable = true;
   tailscale.enable = true;
   docker.user = config.host.username;
   nfc.user = config.host.username;

hosts/eetion/default.nix

@@ -9,9 +9,12 @@
     ./host.nix
     ../../modules/common
     ../../modules/ssh
+    ../../modules/tailscale
     # ../../modules/uptime-kuma
   ];
 
+  tailscale.enable = true;
+
   ssh = {
     inherit (config.host) username;
     publicHostname = config.host.name;

modules/ai-tools/default.nix

@@ -1,14 +1,13 @@
-{ config, myUtils, ... }:
+{ config, ... }:
 
 let
-  inherit (config.secrets) sopsDir username;
-  owner = config.users.users.${username}.name;
+  inherit (config.secrets) username owner;
 in
 {
-  config.sops = {
-    secrets = myUtils.mkSopsSecrets sopsDir "opencode" [ "api-key" ] { inherit owner; };
+  config = {
+    secrets.groups.opencode = [ "api-key" ];
 
-    templates."opencode/auth.json" = {
+    sops.templates."opencode/auth.json" = {
       inherit owner;
       path = "/home/${username}/.local/share/opencode/auth.json";
       content = ''

modules/anki/default.nix

@@ -1,11 +1,6 @@
-{ config, myUtils, ... }:
-
-let
-  inherit (config.secrets) sopsDir username;
-  owner = config.users.users.${username}.name;
-in
 {
-  config.sops = {
-    secrets = myUtils.mkSopsSecrets sopsDir "anki" [ "sync-user" "sync-key" ] { inherit owner; };
-  };
+  config.secrets.groups.anki = [
+    "sync-user"
+    "sync-key"
+  ];
 }

modules/backups/default.nix

@@ -1,21 +1,16 @@
 {
   lib,
   config,
-  myUtils,
   ...
 }:
 
 let
   cfg = config.restic-backup;
-  inherit (config.secrets) sopsDir;
+  host = config.networking.hostName;
 in
 {
-  options = {
-    restic-backup = {
-      repository = lib.mkOption {
-        type = lib.types.str;
-        default = "b2:${config.sops.placeholder."backblaze-b2/bucket-name"}:${config.networking.hostName}";
-      };
+  options.restic-backup = {
+    enable = lib.mkEnableOption "restic backups";
 
     passwordFile = lib.mkOption {
       type = lib.types.str;
@@ -27,31 +22,32 @@ in
       default = [ "/home" ];
     };
   };
+
+  config = lib.mkIf cfg.enable {
+    secrets.groups = {
+      restic = [ "password" ];
+      backblaze-b2 = [
+        "bucket-name"
+        "account-id"
+        "account-key"
+      ];
     };
 
-  config = {
-    sops = {
-      secrets = lib.mkMerge [
-        (myUtils.mkSopsSecrets sopsDir "restic" [ "password" ] { })
-        (myUtils.mkSopsSecrets sopsDir "backblaze-b2" [ "bucket-name" "account-id" "account-key" ] { })
-      ];
-      templates = {
-        "restic/repo-${config.networking.hostName}" = {
-          content = "b2:${config.sops.placeholder."backblaze-b2/bucket-name"}:${config.networking.hostName}";
+    sops.templates = {
+      "restic/repo-${host}" = {
+        content = "b2:${config.sops.placeholder."backblaze-b2/bucket-name"}:${host}";
       };
-        "restic/b2-env-${config.networking.hostName}" = {
+      "restic/b2-env-${host}" = {
         content = ''
           B2_ACCOUNT_ID=${config.sops.placeholder."backblaze-b2/account-id"}
           B2_ACCOUNT_KEY=${config.sops.placeholder."backblaze-b2/account-key"}
         '';
       };
     };
-    };
 
     services.restic.backups.home = {
-      repositoryFile = config.sops.templates."restic/repo-${config.networking.hostName}".path;
-      inherit (cfg) passwordFile;
-      inherit (cfg) paths;
+      repositoryFile = config.sops.templates."restic/repo-${host}".path;
+      inherit (cfg) passwordFile paths;
       timerConfig = {
         OnCalendar = "daily";
         Persistent = true;
@@ -64,7 +60,7 @@ in
         "--keep-monthly 6"
         "--keep-yearly 1"
       ];
-      environmentFile = config.sops.templates."restic/b2-env-${config.networking.hostName}".path;
+      environmentFile = config.sops.templates."restic/b2-env-${host}".path;
     };
   };
 }

modules/hcloud/default.nix

@@ -1,30 +1,27 @@
 {
   lib,
   config,
-  myUtils,
   ...
 }:
 
 let
   cfg = config.hcloud;
-  inherit (config.secrets) sopsDir;
+  inherit (config.secrets) owner;
 in
 {
   options.hcloud = {
     enable = lib.mkEnableOption "hcloud CLI configuration";
     username = lib.mkOption {
       type = lib.types.str;
-      description = "Username for hcloud CLI configuration";
+      description = "username for hcloud CLI configuration";
     };
   };
 
   config = lib.mkIf cfg.enable {
-    sops.secrets = myUtils.mkSopsSecrets sopsDir "hcloud" [ "api-token" ] {
-      owner = config.users.users.${cfg.username}.name;
-    };
+    secrets.groups.hcloud = [ "api-token" ];
 
     sops.templates."hcloud/cli.toml" = {
-      owner = config.users.users.${cfg.username}.name;
+      inherit owner;
       path = "/home/${cfg.username}/.config/hcloud/cli.toml";
       content = ''
         active_context = "server"

modules/secrets/default.nix

@@ -11,13 +11,11 @@ let
   cfg = config.secrets;
   inherit (cfg) sopsDir;
   owner = config.users.users.${cfg.username}.name;
-  mkSopsSecrets = myUtils.mkSopsSecrets sopsDir;
 in
 {
   imports = [ inputs.sops-nix.nixosModules.sops ];
 
-  options = {
-    secrets = {
+  options.secrets = {
     username = lib.mkOption {
       type = lib.types.str;
     };
@@ -27,6 +25,16 @@ in
       default = "${toString inputs.nix-secrets}/secrets";
     };
 
+    groups = lib.mkOption {
+      type = lib.types.attrsOf (lib.types.listOf lib.types.str);
+      default = { };
+      description = "Declarative secret groups: { group = [ key names ]; }";
+    };
+
+    owner = lib.mkOption {
+      type = lib.types.unspecified;
+    };
+
     nixSigningKey = {
       enable = lib.mkEnableOption "nix signing key configuration";
     };
@@ -35,26 +43,26 @@ in
       enable = lib.mkEnableOption "set up Yubikey";
     };
   };
-  };
 
   config = {
+    secrets = {
+      inherit owner;
+      groups = {
+        email = [
+          "personal"
+          "work"
+        ];
+        nix = lib.optional cfg.nixSigningKey.enable "signing-key";
+      };
+    };
+
     sops = {
       # for yubikey, generate as follows:
       # ```
       # age-plugin-yubikey --identity > <keyfile-path>
       # ```
       age.keyFile = "/home/${cfg.username}/.config/sops/age/keys.txt";
-
-      secrets = lib.mkMerge [
-        (mkSopsSecrets "email" [ "personal" "work" ] { inherit owner; })
-        (lib.mkIf cfg.nixSigningKey.enable {
-          nix-signing-key = {
-            sopsFile = "${sopsDir}/nix.yaml";
-            key = "signing-key";
-            inherit owner;
-          };
-        })
-      ];
+      secrets = myUtils.mkSopsSecrets sopsDir owner cfg.groups;
     };
 
     nix.settings.secret-key-files = lib.mkIf cfg.nixSigningKey.enable [

modules/taskwarrior/default.nix

@@ -1,18 +1,17 @@
-{ config, myUtils, ... }:
+{ config, ... }:
 
 let
-  inherit (config.secrets) sopsDir username;
-  owner = config.users.users.${username}.name;
+  inherit (config.secrets) owner;
 in
 {
-  config.sops = {
-    secrets = myUtils.mkSopsSecrets sopsDir "taskwarrior" [
+  config = {
+    secrets.groups.taskwarrior = [
       "sync-server-url"
       "sync-server-client-id"
       "sync-encryption-secret"
-    ] { inherit owner; };
+    ];
 
-    templates."taskrc.d/sync" = {
+    sops.templates."taskrc.d/sync" = {
       inherit owner;
       content = ''
         sync.server.url=${config.sops.placeholder."taskwarrior/sync-server-url"}

utils/default.nix

@@ -1,41 +1,12 @@
 { lib }:
 
+let
+  hosts = import ./hosts.nix;
+  secrets = import ./secrets.nix { inherit lib; };
+in
 {
   dirNames =
     path: builtins.attrNames (lib.filterAttrs (_: type: type == "directory") (builtins.readDir path));
-
-  hostMeta =
-    hostDir:
-    if builtins.pathExists (hostDir + "/meta.nix") then
-      import (hostDir + "/meta.nix")
-    else
-      throw "meta.nix required in ${hostDir}";
-
-  mkSopsSecrets =
-    sopsDir: group: names: extraOpts:
-    let
-      file = "${group}.yaml";
-    in
-    lib.foldl' lib.mergeAttrs { } (
-      map (name: {
-        "${group}/${name}" = {
-          sopsFile = "${sopsDir}/${file}";
-          key = name;
-        }
-        // extraOpts;
-      }) names
-    );
-
-  sopsAvailability =
-    config: osConfig:
-    let
-      osSopsAvailable = osConfig != null && osConfig ? sops && osConfig.sops ? secrets;
-      hmSopsAvailable = config ? sops && config.sops ? secrets;
-      preferOs = osSopsAvailable;
-    in
-    {
-      available = osSopsAvailable || hmSopsAvailable;
-      secrets = if preferOs then osConfig.sops.secrets else config.sops.secrets;
-      templates = if preferOs then osConfig.sops.templates else config.sops.templates;
-    };
 }
+// hosts
+// secrets

utils/hosts.nix

@@ -0,0 +1,8 @@
+{
+  hostMeta =
+    hostDir:
+    if builtins.pathExists (hostDir + "/meta.nix") then
+      import (hostDir + "/meta.nix")
+    else
+      throw "meta.nix required in ${hostDir}";
+}

utils/secrets.nix

@@ -0,0 +1,37 @@
+{ lib }:
+
+{
+  mkSopsSecrets =
+    sopsDir: owner: groups:
+    let
+      opts = lib.optionalAttrs (owner != null) { inherit owner; };
+      mkGroup =
+        group: names:
+        let
+          file = "${group}.yaml";
+        in
+        lib.foldl' lib.mergeAttrs { } (
+          map (name: {
+            "${group}/${name}" = {
+              sopsFile = "${sopsDir}/${file}";
+              key = name;
+            }
+            // opts;
+          }) names
+        );
+    in
+    lib.foldl' lib.mergeAttrs { } (lib.mapAttrsToList mkGroup groups);
+
+  sopsAvailability =
+    config: osConfig:
+    let
+      osSopsAvailable = osConfig != null && osConfig ? sops && osConfig.sops ? secrets;
+      hmSopsAvailable = config ? sops && config.sops ? secrets;
+      preferOs = osSopsAvailable;
+    in
+    {
+      available = osSopsAvailable || hmSopsAvailable;
+      secrets = if preferOs then osConfig.sops.secrets else config.sops.secrets;
+      templates = if preferOs then osConfig.sops.templates else config.sops.templates;
+    };
+}