fix(secrets): default to non-user secrets

README.md

@@ -1,5 +1,8 @@
 # ❄️ NixOS flake
 
+![nix](https://img.shields.io/badge/nix-blue?logo=nixos&logoColor=%234d6fb7&labelColor=%23fff&color=%234d6fb7&link=https%3A%2F%2Fnixos.org%2F)
+![neovim](https://img.shields.io/badge/neovim-flat?logo=neovim&logoColor=%23408040&labelColor=%23fff&color=%2380C040)
+
 ## hosts
 
 ### NixOS

deploy/colmena.nix

@@ -8,16 +8,24 @@ let
   utils = import ../utils { inherit lib; };
   hostnames = utils.dirNames ../hosts;
 
-  mkNode = hostname: meta: {
-    imports = [ ../hosts/${hostname} ];
-    host.name = hostname;
-    deployment = {
-      inherit (meta.deployment) targetHost targetUser tags;
-      buildOnTarget = builtins.any (t: t != "local" && t != "arm") meta.deployment.tags;
+  mkNode =
+    hostname:
+    let
+      meta = utils.hostMeta ../hosts/${hostname};
+      isLocal = builtins.elem "local" meta.tags;
+    in
+    {
+      imports = [ ../hosts/${hostname} ];
+      host.name = hostname;
+      deployment = {
+        inherit (meta) tags;
+        targetUser = meta.host.username;
+        targetHost = if isLocal then "" else hostname;
+        buildOnTarget = builtins.any (t: t != "local" && t != "arm") meta.tags;
+      };
     };
-  };
 
-  nodes = lib.genAttrs hostnames (hostname: mkNode hostname (utils.hostMeta ../hosts/${hostname}));
+  nodes = lib.genAttrs hostnames mkNode;
 in
 inputs.colmena.lib.makeHive (
   {

dots/.bashrc

@@ -60,7 +60,7 @@ export XDG_DATA_HOME=$HOME/.local/share
 if [ -f "/usr/bin/fzf" ]; then
   # Fuzzy finder setup
   export FZF_COMPLETION_TRIGGER='**'
-  export FZF_DEFAULT_COMMAND='ag -g ""'
+  export FZF_DEFAULT_COMMAND='rg --files ""'
   export FZF_DEFAULT_OPTS="
   --pointer='❭'
   --height 10%

dots/.config/nvim/after/plugin/nvim-cmp.lua

@@ -64,7 +64,7 @@ cmp.setup({
   sources = {
     { name = "copilot",  group_index = 2 },
     { name = "zk" },
-    { name = "nvim_lsp", keyword_length = 8 },
+    { name = "nvim_lsp" },
     { name = "luasnip",  max_item_count = 16 },
     { name = "path" },
     { name = "buffer",   max_item_count = 8 },

dots/.config/nvim/after/plugin/nvim-ts-context-commentstring.lua

@@ -0,0 +1,8 @@
+require("ts_context_commentstring").setup({ enable_autocmd = false })
+
+-- https://github.com/JoosepAlviste/nvim-ts-context-commentstring/issues/109
+local get_option = vim.filetype.get_option
+vim.filetype.get_option = function(filetype, option)
+  return option == "commentstring" and require("ts_context_commentstring.internal").calculate_commentstring()
+    or get_option(filetype, option)
+end

dots/.config/nvim/after/plugin/treesitter.lua

@@ -123,7 +123,7 @@ treesitter.setup({
 })
 
 opt.foldmethod = "expr"
-opt.foldexpr = "nvim_treesitter#foldexpr()"
+opt.foldexpr = "v:lua.vim.treesitter.foldexpr()"
 opt.foldenable = false
 
 -- TreeSJ

dots/.config/nvim/flake.nix

@@ -174,6 +174,7 @@
               nvim-treesitter-textobjects
               # nvim-treesitter-context
               nvim-ts-context-commentstring
+              # theHamsta/crazy-node-movement
               treesj
               sniprun
               gitsigns-nvim

dots/.config/nvim/init.lua

@@ -8,11 +8,9 @@ require("cursor")
 require("fold")
 require("netrw")
 require("ftdetect")
-require("plug")
 require("pandoc")
 require("keymaps")
 require("highlight")
-require("paq-setup")
 require("statusline")
 require("diagnostic")
 require("utils")
@@ -20,4 +18,3 @@ require("zk")
 require("reload")
 
 vim.opt.background = "dark"
-vim.opt.laststatus = 3

dots/.config/nvim/lua/nixCatsUtils/catPacker.lua

@@ -1,53 +0,0 @@
--- Source: https://github.com/BirdeeHub/nixCats-nvim/blob/main/templates/example/lua/nixCatsUtils/catPacker.lua
---[[
-  This directory is the luaUtils template.
-  You can choose what things from it that you would like to use.
-  And then delete the rest.
-  Everything in this directory is optional.
---]]
-
-local M = {}
--- NOTE: This function is for defining a paq.nvim fallback method of downloading plugins
--- when nixCats was not used to install your config.
--- If you only ever load your config using nixCats, you don't need this file.
-
--- it literally just only runs it when not on nixCats
--- all neovim package managers that use the regular plugin loading scheme
--- can be used this way, just do whatever the plugin manager needs to put it in the
--- opt directory for lazy loading, and add the build steps so that when theres no nix the steps are ran
-function M.setup(v)
-  if not vim.g[ [[nixCats-special-rtp-entry-nixCats]] ] then
-    local function clone_paq()
-      local path = vim.fn.stdpath("data") .. "/site/pack/paqs/start/paq-nvim"
-      local is_installed = vim.fn.empty(vim.fn.glob(path)) == 0
-      if not is_installed then
-        vim.fn.system({ "git", "clone", "--depth=1", "https://github.com/savq/paq-nvim.git", path })
-        return true
-      end
-    end
-    local function bootstrap_paq(packages)
-      local first_install = clone_paq()
-      vim.cmd.packadd("paq-nvim")
-      local paq = require("paq")
-      if first_install then
-        vim.notify("Installing plugins... If prompted, hit Enter to continue.")
-      end
-      paq(packages)
-      paq.install()
-    end
-
-    vim.api.nvim_create_autocmd("VimEnter", {
-      once = true,
-      callback = function()
-        local pkgs_count = #require("paq").query("to_install")
-        if pkgs_count < 1 then
-          return
-        end
-        vim.notify(string.format("There are %d to install", pkgs_count))
-      end,
-    })
-
-    bootstrap_paq(vim.list_extend({ "savq/paq-nvim" }, v))
-  end
-end
-return M

dots/.config/nvim/lua/paq-setup.lua

@@ -1,47 +0,0 @@
-require("nixCatsUtils.catPacker").setup({
-  { "savq/paq-nvim" },
-  { "jinh0/eyeliner.nvim" },
-  { "ibhagwan/fzf-lua" },
-  { "barreiroleo/ltex_extra.nvim" },
-  { "neovim/nvim-lspconfig" },
-  { "https://git.sr.ht/~whynothugo/lsp_lines.nvim" },
-  { "linrongbin16/lsp-progress.nvim" },
-  { "folke/neodev.nvim" }, -- Nvim
-  { "b0o/schemastore.nvim" }, -- JSON Schemas
-  { "mfussenegger/nvim-lint" },
-  { "stevearc/conform.nvim" },
-  { "L3MON4D3/LuaSnip" },
-  { "saadparwaiz1/cmp_luasnip" },
-  { "hrsh7th/nvim-cmp" },
-  { "hrsh7th/cmp-nvim-lsp" },
-  { "hrsh7th/cmp-buffer" },
-  { "hrsh7th/cmp-path" },
-  { "nvim-lua/plenary.nvim" },
-  { "MunifTanjim/nui.nvim" },
-  { "folke/trouble.nvim" },
-  { "rktjmp/shipwright.nvim" }, -- For building themes based on lush (e.g. terminal)
-  { "rktjmp/lush.nvim" },
-  { "mcchrish/zenbones.nvim" }, -- Zenbones themes (contains zenwritten)
-  { "theHamsta/crazy-node-movement" },
-  { "nvim-treesitter/nvim-treesitter", build = ":TSUpdate" },
-  { "nvim-treesitter/nvim-treesitter-textobjects" },
-  -- { "nvim-treesitter/nvim-treesitter-context" },
-  { "JoosepAlviste/nvim-ts-context-commentstring" }, -- commentstring based on cursor position (e.g. for Svelte)
-  { "Wansmer/treesj" },
-  { "michaelb/sniprun", build = "sh install.sh" },
-  { "lewis6991/gitsigns.nvim" },
-  { "brenoprata10/nvim-highlight-colors" },
-  { "razak17/tailwind-fold.nvim" },
-  { "rmagatti/auto-session" },
-  { "kndndrj/nvim-dbee" },
-  { "3rd/image.nvim", build = false },
-  { "polarmutex/beancount.nvim" },
-  { "jamesblckwell/nvimkit.nvim" },
-  { 'olimorris/codecompanion.nvim' },
-  { "ravitemer/mcphub.nvim",                       build = "pnpm install -g mcp-hub@latest" },
-  { "zbirenbaum/copilot.lua" },
-  { "zbirenbaum/copilot-cmp" },
-  { "qvalentin/helm-ls.nvim", ft = "helm" },
-  { "mikesmithgh/kitty-scrollback.nvim" },
-  { "greggh/claude-code.nvim" },
-})

dots/.config/nvim/lua/plug.lua

@@ -1,35 +0,0 @@
-if not vim.g[ [[nixCats-special-rtp-entry-nixCats]] ] then
-  local vim = vim
-  local Plug = vim.fn["plug#"]
-
-  vim.call("plug#begin")
-
-  Plug("machakann/vim-sandwich")
-  Plug("Shougo/context_filetype.vim")
-  Plug("editorconfig/editorconfig-vim")
-  Plug("honza/vim-snippets")
-  Plug("chrisbra/unicode.vim")
-  Plug("ap/vim-css-color")
-  -- Jupyter
-  Plug("quarto-dev/quarto-vim")
-  -- LaTeX
-  Plug("lervag/vimtex")
-  -- Wiki
-  Plug("lervag/wiki.vim")
-  -- Markdown
-  Plug("vim-pandoc/vim-pandoc")
-  Plug("vim-pandoc/vim-pandoc-syntax")
-  Plug("ferrine/md-img-paste.vim")
-  -- TidalCycles
-  Plug("supercollider/scvim")
-  Plug("tidalcycles/vim-tidal")
-  -- GLSL
-  Plug("tikhomirov/vim-glsl")
-  Plug("timtro/glslView-nvim")
-  -- Jupyter notebooks
-  Plug("goerz/jupytext.vim")
-  -- OpenSCAD
-  Plug("sirtaj/vim-openscad")
-
-  vim.call("plug#end")
-end

dots/.config/nvim/lua/statusline.lua

@@ -1,5 +1,6 @@
+vim.opt.laststatus = 3
+
 vim.cmd([[
-se ls=2
 se stl=\ %0*%n
 se stl+=\ %m
 se stl+=\ %y%0*

dots/.config/task/taskrc

@@ -9,5 +9,5 @@ search.case.sensitive=no
 
 rc.json.array=on
 rc.verbose=nothing
-news.version=3.1.0
+news.version=3.4.2
 

home/hosts/packages.nix

@@ -15,7 +15,6 @@ with pkgs;
   parallel
   pass
   ripgrep
-  silver-searcher
   sops
   tldr
   tree

home/modules/anki/default.nix

@@ -18,7 +18,7 @@ in
 
   config = lib.mkIf cfg.enable (
     lib.optionalAttrs standalone {
-      sops.secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" null {
+      sops.secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" {
         anki = [
           "sync-user"
           "sync-key"
@@ -34,7 +34,17 @@ in
         enable = true;
         package = config.nixgl.wrap pkgs.anki;
         addons = with pkgs.ankiAddons; [
-          anki-connect
+          (anki-connect.withConfig {
+            # https://git.sr.ht/~foosoft/anki-connect/tree/master/item/plugin/config.json
+            config = {
+              apiKey = null;
+              apiLogPath = null;
+              webBindAddress = "127.0.0.1";
+              webBindPort = 8765;
+              webCorsOriginList = [ "http://localhost" ];
+              ignoreOriginList = [ ];
+            };
+          })
           puppy-reinforcement
           review-heatmap
         ];

home/modules/ssh/default.nix

@@ -29,12 +29,13 @@ in
           hostname:
           let
             meta = myUtils.hostMeta (hostDir + "/${hostname}");
+            isLocal = builtins.elem "local" meta.tags;
           in
           {
-            User = meta.deployment.targetUser;
+            User = meta.host.username;
           }
-          // lib.optionalAttrs (meta.deployment.targetHost != "") {
-            HostName = meta.deployment.targetHost;
+          // lib.optionalAttrs (!isLocal) {
+            HostName = hostname;
           }
         )
         // {

home/modules/taskwarrior/default.nix

@@ -20,7 +20,7 @@ in
   config = lib.mkIf cfg.enable (
     lib.optionalAttrs standalone {
       sops = {
-        secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" null {
+        secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" {
           taskwarrior = [
             "sync-server-url"
             "sync-server-client-id"

hosts/andromache/default.nix

@@ -7,13 +7,12 @@
 }:
 
 let
+  meta = import ./meta.nix;
   wolInterfaces = import ./wol-interfaces.nix;
 in
 {
   imports = [
     inputs.disko.nixosModules.disko
-    ./hard.nix
-    ./host.nix
     inputs.nixos-hardware.nixosModules.common-cpu-intel
     inputs.nixos-hardware.nixosModules.common-pc
     inputs.nixos-hardware.nixosModules.common-pc-ssd
@@ -24,6 +23,9 @@ in
     })
   ];
 
+  inherit (meta) host;
+
+  hardware.facter.reportPath = ./facter.json;
   home-manager.users.${config.host.username} = import ../../home/hosts/${config.host.name};
 
   "ai-tools".enable = true;
@@ -52,7 +54,11 @@ in
   desktop.ly.enable = true;
   docker.enable = true;
   hcloud.enable = true;
-  networking.enable = true;
+  networking = {
+    enable = true;
+    hostId = "80eef97e";
+    useDHCP = lib.mkDefault true;
+  };
   nvidia.enable = true;
   restic-backup.enable = true;
   secrets = {
@@ -101,6 +107,4 @@ in
     enable = true;
     package = pkgs.plocate;
   };
-
-  networking.hostId = "80eef97e";
 }

hosts/andromache/hard.nix

@@ -1,42 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{
-  config,
-  lib,
-  modulesPath,
-  ...
-}:
-
-{
-  imports = [
-    (modulesPath + "/installer/scan/not-detected.nix")
-  ];
-
-  boot = {
-    initrd.availableKernelModules = [
-      "vmd"
-      "xhci_pci"
-      "ahci"
-      "nvme"
-      "usbhid"
-      "usb_storage"
-      "uas"
-      "sd_mod"
-    ];
-    initrd.kernelModules = [ ];
-    kernelModules = [ "kvm-intel" ];
-    extraModulePackages = [ ];
-  };
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
-  # networking.interfaces.wlp0s20f3.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}

hosts/andromache/host.nix

@@ -1,7 +0,0 @@
-{
-  host = {
-    username = "h";
-    highRam = true;
-    admin = true;
-  };
-}

hosts/andromache/meta.nix

@@ -1,9 +1,10 @@
 {
   system = "x86_64-linux";
-  deployment = {
-    tags = [ "local" ];
-    targetHost = "";
-    targetUser = "h";
-  };
   role = "desktop";
+  tags = [ "local" ];
+  host = {
+    username = "h";
+    highRam = true;
+    admin = true;
+  };
 }

hosts/astyanax/default.nix

@@ -6,11 +6,12 @@
   ...
 }:
 
+let
+  meta = import ./meta.nix;
+in
 {
   imports = [
     inputs.disko.nixosModules.disko
-    ./hard.nix
-    ./host.nix
     inputs.nixos-hardware.nixosModules.common-pc
     inputs.nixos-hardware.nixosModules.common-pc-ssd
     # inputs.nixos-hardware.nixosModules.lenovo-thinkpad-e14-intel-gen7 (not available yet?)
@@ -21,6 +22,9 @@
     })
   ];
 
+  inherit (meta) host;
+
+  hardware.facter.reportPath = ./facter.json;
   home-manager.users.${config.host.username} = import ../../home/hosts/${config.host.name};
 
   "ai-tools".enable = true;
@@ -102,7 +106,6 @@
   boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
 
   services = {
-    resolved.enable = true;
     fwupd.enable = true;
     locate = {
       enable = true;

hosts/astyanax/hard.nix

@@ -1,39 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{
-  config,
-  lib,
-  modulesPath,
-  ...
-}:
-
-{
-  imports = [
-    (modulesPath + "/installer/scan/not-detected.nix")
-  ];
-
-  boot = {
-    initrd.availableKernelModules = [
-      "xhci_pci"
-      "thunderbolt"
-      "nvme"
-      "uas"
-      "sd_mod"
-    ];
-    initrd.kernelModules = [ ];
-    kernelModules = [ "kvm-intel" ];
-    extraModulePackages = [ ];
-  };
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
-  # networking.interfaces.wlan0.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}

hosts/astyanax/host.nix

@@ -1,7 +0,0 @@
-{
-  host = {
-    username = "h";
-    highRam = true;
-    admin = true;
-  };
-}

hosts/astyanax/meta.nix

@@ -1,9 +1,10 @@
 {
   system = "x86_64-linux";
-  deployment = {
-    tags = [ "local" ];
-    targetHost = "";
-    targetUser = "h";
-  };
   role = "laptop";
+  tags = [ "local" ];
+  host = {
+    username = "h";
+    highRam = true;
+    admin = true;
+  };
 }

hosts/eetion-02/default.nix

@@ -3,13 +3,17 @@
 # Raspberry Pi 3
 # See <https://nixos.wiki/wiki/NixOS_on_ARM/Raspberry_Pi_3>
 
+let
+  meta = import ./meta.nix;
+in
 {
   imports = [
     ./hard.nix
-    ./host.nix
     ../../modules
   ];
 
+  inherit (meta) host;
+
   ssh.enable = true;
 
   boot = {

hosts/eetion-02/host.nix

@@ -1,5 +0,0 @@
-{
-  host = {
-    username = "h";
-  };
-}

hosts/eetion-02/meta.nix

@@ -1,9 +1,8 @@
 {
   system = "aarch64-linux";
-  deployment = {
-    tags = [ "arm" ];
-    targetHost = "eetion-02";
-    targetUser = "h";
-  };
   role = "embedded";
+  tags = [ "arm" ];
+  host = {
+    username = "h";
+  };
 }

hosts/eetion/default.nix

@@ -3,13 +3,17 @@
 # Orange Pi Zero2 H616
 # See <https://nixos.wiki/wiki/NixOS_on_ARM/Orange_Pi_Zero2_H616>
 
+let
+  meta = import ./meta.nix;
+in
 {
   imports = [
     ./hard.nix
-    ./host.nix
     ../../modules
   ];
 
+  inherit (meta) host;
+
   ssh.enable = true;
   tailscale.enable = true;
 

hosts/eetion/host.nix

@@ -1,5 +0,0 @@
-{
-  host = {
-    username = "h";
-  };
-}

hosts/eetion/meta.nix

@@ -1,9 +1,8 @@
 {
   system = "aarch64-linux";
-  deployment = {
-    tags = [ "arm" ];
-    targetHost = "eetion";
-    targetUser = "h";
-  };
   role = "embedded";
+  tags = [ "arm" ];
+  host = {
+    username = "h";
+  };
 }

hosts/hecuba/default.nix

@@ -7,15 +7,21 @@
 
 # also see <https://wiki.nixos.org/wiki/Install_NixOS_on_Hetzner_Cloud>
 
+let
+  meta = import ./meta.nix;
+in
 {
   imports = [
     inputs.disko.nixosModules.disko
-    ./hard.nix
+    "${inputs.nixpkgs}/nixos/modules/profiles/qemu-guest.nix"
     inputs.comin.nixosModules.comin
-    ./host.nix
     ../../modules
   ];
 
+  inherit (meta) host;
+
+  hardware.facter.reportPath = ./facter.json;
+
   docker.enable = true;
   ssh.enable = true;
   tailscale.enable = true;

hosts/hecuba/hard.nix

@@ -1,39 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{
-  lib,
-  modulesPath,
-  ...
-}:
-
-{
-  imports = [
-    (modulesPath + "/profiles/qemu-guest.nix")
-  ];
-
-  boot = {
-    initrd = {
-      availableKernelModules = [
-        "ahci"
-        "xhci_pci"
-        "virtio_pci"
-        "virtio_scsi"
-        "sd_mod"
-        "sr_mod"
-      ];
-      kernelModules = [ ];
-    };
-    kernelModules = [ ];
-    extraModulePackages = [ ];
-  };
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-}

hosts/hecuba/host.nix

@@ -1,5 +0,0 @@
-{
-  host = {
-    username = "username";
-  };
-}

hosts/hecuba/meta.nix

@@ -1,9 +1,8 @@
 {
   system = "x86_64-linux";
-  deployment = {
-    tags = [ "cloud" ];
-    targetHost = "hecuba";
-    targetUser = "username";
-  };
   role = "server";
+  tags = [ "cloud" ];
+  host = {
+    username = "username";
+  };
 }

hosts/vm/default.nix

@@ -3,15 +3,20 @@
   config,
   ...
 }:
+let
+  meta = import ./meta.nix;
+in
 {
   imports = [
     inputs.disko.nixosModules.disko
-    ./hard.nix
-    ./host.nix
+    "${inputs.nixpkgs}/nixos/modules/profiles/qemu-guest.nix"
     ./disk.nix
     ../../modules
   ];
 
+  inherit (meta) host;
+
+  hardware.facter.reportPath = ./facter.json;
   home-manager.users.${config.host.username} = import ../../home/hosts/vm;
 
   "ai-tools".enable = true;

hosts/vm/hard.nix

@@ -1,38 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{
-  lib,
-  modulesPath,
-  ...
-}:
-
-{
-  imports = [
-    (modulesPath + "/profiles/qemu-guest.nix")
-  ];
-
-  boot = {
-    initrd = {
-      availableKernelModules = [
-        "ahci"
-        "xhci_pci"
-        "virtio_pci"
-        "sr_mod"
-        "virtio_blk"
-      ];
-      kernelModules = [ ];
-    };
-    kernelModules = [ "kvm-intel" ];
-    extraModulePackages = [ ];
-  };
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-}

hosts/vm/host.nix

@@ -1,5 +0,0 @@
-{
-  host = {
-    username = "h";
-  };
-}

hosts/vm/meta.nix

@@ -1,9 +1,8 @@
 {
   system = "x86_64-linux";
-  deployment = {
-    tags = [ "local" ];
-    targetHost = "";
-    targetUser = "h";
-  };
   role = "vm";
+  tags = [ "local" ];
+  host = {
+    username = "h";
+  };
 }

modules/ai-tools/default.nix

@@ -10,7 +10,7 @@ in
 
   config = lib.mkIf cfg.enable {
     nixpkgs.allowedUnfree = [ "claude-code" ];
-    secrets.groups.opencode = [ "api-key" ];
+    secrets.opencode = [ "api-key" ];
 
     sops.templates."opencode/auth.json" = {
       inherit owner;

modules/anki/default.nix

@@ -7,7 +7,7 @@ in
   options.anki.enable = lib.mkEnableOption "anki";
 
   config = lib.mkIf cfg.enable {
-    secrets.groups.anki = [
+    secrets.user.anki = [
       "sync-user"
       "sync-key"
     ];

modules/backups/default.nix

@@ -24,7 +24,7 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    secrets.groups = {
+    secrets = {
       restic = [ "password" ];
       backblaze-b2 = [
         "bucket-name"

modules/common/host.nix

@@ -10,6 +10,11 @@
       type = lib.types.str;
     };
 
+    tags = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+    };
+
     timezone = lib.mkOption {
       type = lib.types.str;
       default = "Europe/Brussels";

modules/hcloud/default.nix

@@ -15,7 +15,7 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    secrets.groups.hcloud = [ "api-token" ];
+    secrets.hcloud = [ "api-token" ];
 
     sops.templates."hcloud/cli.toml" = {
       inherit owner;

modules/networking/default.nix

@@ -11,5 +11,7 @@
       nftables.enable = true;
       firewall.enable = true;
     };
+
+    services.resolved.enable = true;
   };
 }

modules/secrets/default.nix

@@ -12,53 +12,56 @@ let
   inherit (config.host) username;
   inherit (cfg) sopsDir;
   owner = config.users.users.${username}.name;
+
+  system = {
+    email = [
+      "personal"
+      "work"
+    ];
+    nix = lib.optional cfg.nixSigningKey.enable "signing-key";
+  }
+  // lib.filterAttrs (_: lib.isList) cfg;
 in
 {
   imports = [ inputs.sops-nix.nixosModules.sops ];
 
-  options = {
-    secrets = {
-      enable = lib.mkEnableOption "secrets management";
+  options.secrets = lib.mkOption {
+    default = { };
+    type = lib.types.submodule {
+      freeformType = lib.types.attrsOf (lib.types.listOf lib.types.str);
 
-      sopsDir = lib.mkOption {
-        type = lib.types.str;
-        default = "${toString inputs.nix-secrets}/secrets";
-      };
+      options = {
+        enable = lib.mkEnableOption "secrets management";
 
-      groups = lib.mkOption {
-        type = lib.types.attrsOf (lib.types.listOf lib.types.str);
-        default = { };
-      };
+        sopsDir = lib.mkOption {
+          type = lib.types.str;
+          default = "${toString inputs.nix-secrets}/secrets";
+        };
 
-      owner = lib.mkOption {
-        type = lib.types.unspecified;
-      };
+        user = lib.mkOption {
+          type = lib.types.attrsOf (lib.types.listOf lib.types.str);
+          default = { };
+        };
 
-      nixSigningKey = {
-        enable = lib.mkEnableOption "nix signing key configuration";
-      };
+        owner = lib.mkOption {
+          type = lib.types.unspecified;
+          default = owner;
+        };
 
-      yubikey = {
-        enable = lib.mkEnableOption "set up Yubikey";
+        nixSigningKey = {
+          enable = lib.mkEnableOption "nix signing key configuration";
+        };
+
+        yubikey = {
+          enable = lib.mkEnableOption "set up Yubikey";
+        };
       };
     };
   };
 
   config = lib.mkIf cfg.enable {
-    secrets = {
-      inherit owner;
-      groups = {
-        email = [
-          "personal"
-          "work"
-        ];
-        nix = lib.optional cfg.nixSigningKey.enable "signing-key";
-      };
-    };
-
     sops = {
-      age.keyFile = "/home/${username}/.config/sops/age/keys.txt";
-      secrets = myUtils.mkSopsSecrets sopsDir owner cfg.groups;
+      secrets = myUtils.mkSopsSecrets sopsDir system // myUtils.mkSopsUserSecrets sopsDir owner cfg.user;
     };
 
     nix.settings.secret-key-files = lib.mkIf cfg.nixSigningKey.enable [

modules/taskwarrior/default.nix

@@ -8,7 +8,7 @@ in
   options.taskwarrior.enable = lib.mkEnableOption "taskwarrior";
 
   config = lib.mkIf cfg.enable {
-    secrets.groups.taskwarrior = [
+    secrets.taskwarrior = [
       "sync-server-url"
       "sync-server-client-id"
       "sync-encryption-secret"

utils/hosts.nix

@@ -9,11 +9,11 @@ in
     if builtins.pathExists (hostDir + "/meta.nix") then
       import (hostDir + "/meta.nix")
     else
-      throw "meta.nix required in ${hostDir}";
+      throw "meta.nix required in ${toString hostDir}";
 
   adminHosts =
     hostsPath:
-    builtins.filter (host: ((import (hostsPath + "/${host}/host.nix")).host.admin or false)) (
+    builtins.filter (host: ((import (hostsPath + "/${host}/meta.nix")).host.admin or false)) (
       fs.dirNames hostsPath
     );
 }

utils/secrets.nix

@@ -1,7 +1,7 @@
 { lib }:
 
-{
-  mkSopsSecrets =
+let
+  mkSecrets =
     sopsDir: owner: groups:
     let
       opts = lib.optionalAttrs (owner != null) { inherit owner; };
@@ -21,6 +21,11 @@
         );
     in
     lib.foldl' lib.mergeAttrs { } (lib.mapAttrsToList mkGroup groups);
+in
+{
+  mkSopsSecrets = sopsDir: mkSecrets sopsDir null;
+
+  mkSopsUserSecrets = mkSecrets;
 
   sopsAvailability =
     config: osConfig: