wip: secrets

2026-04-11 20:48:47 +02:00
8 changed files with 93 additions and 123 deletions
--- a/flake.lock
+++ b/flake.lock
@@ -121,11 +121,11 @@
      },
      "locked": {
        "dir": "pkgs/firefox-addons",
-        "lastModified": 1775966594,
-        "narHash": "sha256-pnRtaqTr7ut8dz8b04OWAanUM4tGhDUJz8SWmeTRp7U=",
+        "lastModified": 1774843378,
+        "narHash": "sha256-8QLbY8F7UdxeQaW0KUVgr1/YPIupe+1lGjS5joR+ZCw=",
        "owner": "rycee",
        "repo": "nur-expressions",
-        "rev": "000d1d2322d28fa0a51b8db9f85a227aa5413b52",
+        "rev": "0a31b668e3ebb599f95dc518076d709e8dddb57c",
        "type": "gitlab"
      },
      "original": {
@@ -138,11 +138,11 @@
    "firefox-gnome-theme": {
      "flake": false,
      "locked": {
-        "lastModified": 1775176642,
-        "narHash": "sha256-2veEED0Fg7Fsh81tvVDNYR6SzjqQxa7hbi18Jv4LWpM=",
+        "lastModified": 1764873433,
+        "narHash": "sha256-1XPewtGMi+9wN9Ispoluxunw/RwozuTRVuuQOmxzt+A=",
        "owner": "rafaelmardojai",
        "repo": "firefox-gnome-theme",
-        "rev": "179704030c5286c729b5b0522037d1d51341022c",
+        "rev": "f7ffd917ac0d253dbd6a3bf3da06888f57c69f92",
        "type": "github"
      },
      "original": {
@@ -213,11 +213,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1775087534,
-        "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
+        "lastModified": 1767609335,
+        "narHash": "sha256-feveD98mQpptwrAEggBQKJTYbvwwglSbOv53uCfH9PY=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
+        "rev": "250481aafeb741edfe23d29195671c19b36b6dca",
        "type": "github"
      },
      "original": {
@@ -284,11 +284,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1775585728,
-        "narHash": "sha256-8Psjt+TWvE4thRKktJsXfR6PA/fWWsZ04DVaY6PUhr4=",
+        "lastModified": 1775036584,
+        "narHash": "sha256-zW0lyy7ZNNT/x8JhzFHBsP2IPx7ATZIPai4FJj12BgU=",
        "owner": "cachix",
        "repo": "git-hooks.nix",
-        "rev": "580633fa3fe5fc0379905986543fd7495481913d",
+        "rev": "4e0eb042b67d863b1b34b3f64d52ceb9cd926735",
        "type": "github"
      },
      "original": {
@@ -321,18 +321,20 @@
    "gnome-shell": {
      "flake": false,
      "locked": {
+        "host": "gitlab.gnome.org",
        "lastModified": 1767737596,
        "narHash": "sha256-eFujfIUQDgWnSJBablOuG+32hCai192yRdrNHTv0a+s=",
        "owner": "GNOME",
        "repo": "gnome-shell",
        "rev": "ef02db02bf0ff342734d525b5767814770d85b49",
-        "type": "github"
+        "type": "gitlab"
      },
      "original": {
+        "host": "gitlab.gnome.org",
        "owner": "GNOME",
+        "ref": "gnome-49",
        "repo": "gnome-shell",
-        "rev": "ef02db02bf0ff342734d525b5767814770d85b49",
-        "type": "github"
+        "type": "gitlab"
      }
    },
    "home-manager": {
@@ -342,11 +344,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1775983377,
-        "narHash": "sha256-ZeRjipGQnVtQ/6batI+yVOrL853FZsL0m9A63OaSfgM=",
+        "lastModified": 1775047159,
+        "narHash": "sha256-UWM4VZvfKaPwA9FMu7iZha5YAE8vsEtUazk+rFxmbTY=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "e0ca734ffc85d25297715e98010b93303fa165c4",
+        "rev": "1ce9e62690dfdd7e76bd266ccb9a887778410eb2",
        "type": "github"
      },
      "original": {
@@ -398,10 +400,10 @@
    "nix-secrets": {
      "flake": false,
      "locked": {
-        "lastModified": 1775987539,
-        "narHash": "sha256-ilN7pQUw/k4oBPJ+VoR3N5wWo72ePZfT4uvapiaLRng=",
+        "lastModified": 1773999602,
+        "narHash": "sha256-Th4RuCEPHC8y1w/wrW9OSv9nAJ3/NSZ3MJ4DHhCXCKE=",
        "ref": "main",
-        "rev": "13c6ddfbec41164dbdaa9d70c01cd784ea9e17e5",
+        "rev": "6f4b099a0c5ad1cca97f4ba1a665faaaed367f13",
        "shallow": true,
        "type": "git",
        "url": "ssh://git@github.com/hektor/nix-secrets"
@@ -415,11 +417,11 @@
    },
    "nixCats": {
      "locked": {
-        "lastModified": 1774835836,
-        "narHash": "sha256-6ok7iv/9R82vl6MYe3Lwyyb6S5bmW2PxEZtmjzlqyPs=",
+        "lastModified": 1770584904,
+        "narHash": "sha256-9Zaz8lbKF2W9pwXZEnbiGsicHdBoU+dHt3Wv3mCJoZ8=",
        "owner": "BirdeeHub",
        "repo": "nixCats-nvim",
-        "rev": "ebb9f279a55ca60ff4e37e4accf6518dc627aa8d",
+        "rev": "538fdde784d2909700d97a8ef307783b33a86fb1",
        "type": "github"
      },
      "original": {
@@ -451,11 +453,11 @@
    },
    "nixos-hardware": {
      "locked": {
-        "lastModified": 1775490113,
-        "narHash": "sha256-2ZBhDNZZwYkRmefK5XLOusCJHnoeKkoN95hoSGgMxWM=",
+        "lastModified": 1774933469,
+        "narHash": "sha256-OrnCQeUO2bqaWUl0lkDWyGWjKsOhtCyd7JSfTedQNUE=",
        "owner": "NixOS",
        "repo": "nixos-hardware",
-        "rev": "c775c2772ba56e906cbeb4e0b2db19079ef11ff7",
+        "rev": "f4c4c2c0c923d7811ac2a63ccc154767e4195337",
        "type": "github"
      },
      "original": {
@@ -467,11 +469,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1775710090,
-        "narHash": "sha256-ar3rofg+awPB8QXDaFJhJ2jJhu+KqN/PRCXeyuXR76E=",
+        "lastModified": 1774709303,
+        "narHash": "sha256-D3Q07BbIA2KnTcSXIqqu9P586uWxN74zNoCH3h2ESHg=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "4c1018dae018162ec878d42fec712642d214fdfa",
+        "rev": "8110df5ad7abf5d4c0f6fb0f8f978390e77f9685",
        "type": "github"
      },
      "original": {
@@ -509,11 +511,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1775228139,
-        "narHash": "sha256-ebbeHmg+V7w8050bwQOuhmQHoLOEOfqKzM1KgCTexK4=",
+        "lastModified": 1767810917,
+        "narHash": "sha256-ZKqhk772+v/bujjhla9VABwcvz+hB2IaRyeLT6CFnT0=",
        "owner": "nix-community",
        "repo": "NUR",
-        "rev": "601971b9c89e0304561977f2c28fa25e73aa7132",
+        "rev": "dead29c804adc928d3a69dfe7f9f12d0eec1f1a4",
        "type": "github"
      },
      "original": {
@@ -565,11 +567,11 @@
    "plugins-helm-ls-nvim": {
      "flake": false,
      "locked": {
-        "lastModified": 1773934114,
-        "narHash": "sha256-8trqFsA7nTKSdtkiAL0Sa9bXjh5ONtAqN7XNE/B8ukM=",
+        "lastModified": 1768584652,
+        "narHash": "sha256-jnMc87OjURNcqsva0npYgVyUrWc5C6L7yHpNvt9eSmg=",
        "owner": "qvalentin",
        "repo": "helm-ls.nvim",
-        "rev": "20df43509b02a3ce3c6b3eee254d6e2bffa9a370",
+        "rev": "f0b9a1723890971a6d84890b50dbf5f40974ea1b",
        "type": "github"
      },
      "original": {
@@ -665,11 +667,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1775971308,
-        "narHash": "sha256-VKp9bhVSm0bT6JWctFy06ocqxGGnWHi1NfoE90IgIcY=",
+        "lastModified": 1774910634,
+        "narHash": "sha256-B+rZDPyktGEjOMt8PcHKYmgmKoF+GaNAFJhguktXAo0=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "31ac5fe5d015f76b54058c69fcaebb66a55871a4",
+        "rev": "19bf3d8678fbbfbc173beaa0b5b37d37938db301",
        "type": "github"
      },
      "original": {
@@ -708,17 +710,18 @@
        ],
        "nur": "nur",
        "systems": "systems_2",
+        "tinted-foot": "tinted-foot",
        "tinted-kitty": "tinted-kitty",
        "tinted-schemes": "tinted-schemes",
        "tinted-tmux": "tinted-tmux",
        "tinted-zed": "tinted-zed"
      },
      "locked": {
-        "lastModified": 1775936757,
-        "narHash": "sha256-KJO/7qoxJ+hlsb3WlFSl6IGrExBIf1GvKdrhOlnGdKY=",
+        "lastModified": 1774897726,
+        "narHash": "sha256-k/H2/oyex6GEC6uYXYetrboFQeTmX1Ouwv/zaW7b/Z0=",
        "owner": "danth",
        "repo": "stylix",
-        "rev": "d3e447786b74d62c75f665e17cb3e681c66e90c7",
+        "rev": "9b4a5eb409ceac2dd6ad495c7988e189a418cd30",
        "type": "github"
      },
      "original": {
@@ -757,6 +760,23 @@
        "type": "github"
      }
    },
+    "tinted-foot": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1726913040,
+        "narHash": "sha256-+eDZPkw7efMNUf3/Pv0EmsidqdwNJ1TaOum6k7lngDQ=",
+        "owner": "tinted-theming",
+        "repo": "tinted-foot",
+        "rev": "fd1b924b6c45c3e4465e8a849e67ea82933fcbe4",
+        "type": "github"
+      },
+      "original": {
+        "owner": "tinted-theming",
+        "repo": "tinted-foot",
+        "rev": "fd1b924b6c45c3e4465e8a849e67ea82933fcbe4",
+        "type": "github"
+      }
+    },
    "tinted-kitty": {
      "flake": false,
      "locked": {
@@ -776,11 +796,11 @@
    "tinted-schemes": {
      "flake": false,
      "locked": {
-        "lastModified": 1772661346,
-        "narHash": "sha256-4eu3LqB9tPqe0Vaqxd4wkZiBbthLbpb7llcoE/p5HT0=",
+        "lastModified": 1767710407,
+        "narHash": "sha256-+W1EB79Jl0/gm4JqmO0Nuc5C7hRdp4vfsV/VdzI+des=",
        "owner": "tinted-theming",
        "repo": "schemes",
-        "rev": "13b5b0c299982bb361039601e2d72587d6846294",
+        "rev": "2800e2b8ac90f678d7e4acebe4fa253f602e05b2",
        "type": "github"
      },
      "original": {
@@ -792,11 +812,11 @@
    "tinted-tmux": {
      "flake": false,
      "locked": {
-        "lastModified": 1772934010,
-        "narHash": "sha256-x+6+4UvaG+RBRQ6UaX+o6DjEg28u4eqhVRM9kpgJGjQ=",
+        "lastModified": 1767489635,
+        "narHash": "sha256-e6nnFnWXKBCJjCv4QG4bbcouJ6y3yeT70V9MofL32lU=",
        "owner": "tinted-theming",
        "repo": "tinted-tmux",
-        "rev": "c3529673a5ab6e1b6830f618c45d9ce1bcdd829d",
+        "rev": "3c32729ccae99be44fe8a125d20be06f8d7d8184",
        "type": "github"
      },
      "original": {
@@ -808,11 +828,11 @@
    "tinted-zed": {
      "flake": false,
      "locked": {
-        "lastModified": 1772909925,
-        "narHash": "sha256-jx/5+pgYR0noHa3hk2esin18VMbnPSvWPL5bBjfTIAU=",
+        "lastModified": 1767488740,
+        "narHash": "sha256-wVOj0qyil8m+ouSsVZcNjl5ZR+1GdOOAooAatQXHbuU=",
        "owner": "tinted-theming",
        "repo": "base16-zed",
-        "rev": "b4d3a1b3bcbd090937ef609a0a3b37237af974df",
+        "rev": "11abb0b282ad3786a2aae088d3a01c60916f2e40",
        "type": "github"
      },
      "original": {
--- a/home/hosts/astyanax/default.nix
+++ b/home/hosts/astyanax/default.nix
@@ -23,7 +23,6 @@
    ../../modules/nfc
    ../../modules/nvim
    ../../modules/pandoc
-    ../../modules/secrets
    ../../modules/shell
    ../../modules/ssh
    ../../modules/taskwarrior
--- a/home/modules/anki/default.nix
+++ b/home/modules/anki/default.nix
@@ -12,13 +12,11 @@ let
  sops = myUtils.sopsAvailability config osConfig;
  standalone = osConfig == null;
 in
-lib.optionalAttrs standalone {
-  sops.secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" "anki" [
-    "sync-user"
-    "sync-key"
-  ] { };
-}
-// {
+{
+  sops.secrets = lib.mkIf standalone (
+    myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" "anki" [ "sync-user" "sync-key" ] { }
+  );
+
  warnings = lib.optional (
    !sops.available && config.programs.anki.enable
  ) "anki is enabled but sops secrets are not available. anki sync will not be configured.";
--- a/home/modules/secrets/default.nix
+++ b/home/modules/secrets/default.nix
@@ -6,8 +6,7 @@
  imports = [ ./vault.nix ];

  home.packages = with pkgs; [
-    age
-    age-plugin-yubikey # TODO: only needed when using Yubikey
    sops
+    age
  ];
 }
--- a/home/modules/taskwarrior/default.nix
+++ b/home/modules/taskwarrior/default.nix
@@ -13,8 +13,8 @@ let
  sops = myUtils.sopsAvailability config osConfig;
  standalone = osConfig == null;
 in
-lib.optionalAttrs standalone {
-  sops = {
+{
+  sops = lib.mkIf standalone {
    secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" "taskwarrior" [
      "sync-server-url"
      "sync-server-client-id"
@@ -29,8 +29,6 @@ lib.optionalAttrs standalone {
      '';
    };
  };
-}
-// {

  warnings =
    lib.optional (!sops.available && config.programs.taskwarrior.enable)
--- a/hosts/astyanax/default.nix
+++ b/hosts/astyanax/default.nix
@@ -16,35 +16,32 @@ in
    inputs.nixos-hardware.nixosModules.common-pc
    inputs.nixos-hardware.nixosModules.common-pc-ssd
    # inputs.nixos-hardware.nixosModules.lenovo-thinkpad-e14-intel-gen7 (not available yet?)
-    inputs.sops-nix.nixosModules.sops
    ../../modules/common
    ../../modules/boot/bootloader.nix
    (import ../../modules/disko/zfs-encrypted-root.nix {
      inherit lib config;
      device = "/dev/nvme0n1";
    })
-    ../../modules/ai-tools
+    ../../modules/desktops/niri
    ../../modules/anki
    ../../modules/audio
    ../../modules/backups
    ../../modules/bluetooth
-    ../../modules/desktops/niri
-    ../../modules/docker
-    ../../modules/firewall
-    ../../modules/fonts
    ../../modules/git
    ../../modules/keyboard
-    ../../modules/localization
    ../../modules/networking
-    ../../modules/nfc
-    ../../modules/secrets
+    ../../modules/ai-tools
+    ../../modules/users
+    ../../modules/localization
+    ../../modules/fonts
    ../../modules/ssh
    ../../modules/storage
    ../../modules/stylix
-    ../../modules/tailscale
+    (import ../../modules/secrets { inherit lib inputs config; })
+    ../../modules/docker
+    ../../modules/nfc
+    ../../modules/firewall
    ../../modules/taskwarrior
-    ../../modules/users
-    ../../modules/yubikey
  ];

  home-manager.users.${config.host.username} = import ../../home/hosts/astyanax {
@@ -63,8 +60,6 @@ in
    inherit (config.host) username;
    nixSigningKey.enable = true;
  };
-
-  tailscale.enable = true;
  docker.user = config.host.username;
  nfc.user = config.host.username;
  desktop.ly.enable = true;
@@ -109,25 +104,6 @@ in

  boot.binfmt.emulatedSystems = [ "aarch64-linux" ];

-  my.yubikey = {
-    enable = true;
-    # inherit (config.host) username;
-    # keys = [
-    #   {
-    #     handle = "<KeyHandle1>";
-    #     userKey = "<UserKey1>";
-    #     coseType = "<CoseType1>";
-    #     options = "<Options1>";
-    #   }
-    #   {
-    #     handle = "<KeyHandle2>";
-    #     userKey = "<UserKey2>";
-    #     coseType = "<CoseType2>";
-    #     options = "<Options2>";
-    #   }
-    # ];
-  };
-
  services = {
    fwupd.enable = true;
    locate = {
--- a/modules/secrets/default.nix
+++ b/modules/secrets/default.nix
@@ -1,7 +1,6 @@
 {
  lib,
  inputs,
-  pkgs,
  config,
  myUtils,
  ...
@@ -34,42 +33,23 @@ in
          default = "${config.host.name}-nix-signing-key";
        };
      };
-
-      yubikey = {
-        enable = lib.mkEnableOption "set up Yubikey";
-      };
    };
  };

  config = {
    sops = {
-      # for yubikey, generate as follows:
-      # ```
-      # age-plugin-yubikey --identity > <keyfile-path>
-      # ```
      age.keyFile = "/home/${cfg.username}/.config/sops/age/keys.txt";

      secrets = lib.mkMerge [
        (mkSopsSecrets "email" [ "personal" "work" ] { inherit owner; })
-        (lib.mkIf cfg.nixSigningKey.enable {
-          ${cfg.nixSigningKey.name} = {
-            sopsFile = "${sopsDir}/${cfg.nixSigningKey.name}.yaml";
-            inherit owner;
-          };
-        })
+        (lib.mkIf cfg.nixSigningKey.enable (
+          mkSopsSecrets cfg.nixSigningKey.name [ cfg.nixSigningKey.name ] { inherit owner; }
+        ))
      ];
    };

    nix.settings.secret-key-files = lib.mkIf cfg.nixSigningKey.enable [
-      config.sops.secrets.${cfg.nixSigningKey.name}.path
+      config.sops.secrets."${cfg.nixSigningKey.name}/${cfg.nixSigningKey.name}".path
    ];
-
-    services = {
-      pcscd.enable = true; # needed for age-plugin-yubikey?
-      udev.packages = lib.mkIf cfg.yubikey.enable [
-        pkgs.yubikey-personalization
-        pkgs.libfido2
-      ];
-    };
  };
 }
--- a/modules/yubikey/default.nix
+++ b/modules/yubikey/default.nix
@@ -70,6 +70,6 @@ in
      };
    };

-    services.udev.packages = with pkgs; [ yubikey-personalization ];
+    services.udev.packages = [ pkgs.yubikey-personalization ];
  };
 }