fix(secrets): default to non-user secrets

deploy/colmena.nix

@@ -8,16 +8,24 @@ let
   utils = import ../utils { inherit lib; };
   hostnames = utils.dirNames ../hosts;
 
-  mkNode = hostname: meta: {
+  mkNode =
+    hostname:
+    let
+      meta = utils.hostMeta ../hosts/${hostname};
+      isLocal = builtins.elem "local" meta.tags;
+    in
+    {
       imports = [ ../hosts/${hostname} ];
       host.name = hostname;
       deployment = {
-      inherit (meta.deployment) targetHost targetUser tags;
-      buildOnTarget = builtins.any (t: t != "local" && t != "arm") meta.deployment.tags;
+        inherit (meta) tags;
+        targetUser = meta.host.username;
+        targetHost = if isLocal then "" else hostname;
+        buildOnTarget = builtins.any (t: t != "local" && t != "arm") meta.tags;
       };
     };
 
-  nodes = lib.genAttrs hostnames (hostname: mkNode hostname (utils.hostMeta ../hosts/${hostname}));
+  nodes = lib.genAttrs hostnames mkNode;
 in
 inputs.colmena.lib.makeHive (
   {

home/modules/anki/default.nix

@@ -18,7 +18,7 @@ in
 
   config = lib.mkIf cfg.enable (
     lib.optionalAttrs standalone {
-      sops.secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" null {
+      sops.secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" {
         anki = [
           "sync-user"
           "sync-key"

home/modules/ssh/default.nix

@@ -29,12 +29,13 @@ in
           hostname:
           let
             meta = myUtils.hostMeta (hostDir + "/${hostname}");
+            isLocal = builtins.elem "local" meta.tags;
           in
           {
-            User = meta.deployment.targetUser;
+            User = meta.host.username;
           }
-          // lib.optionalAttrs (meta.deployment.targetHost != "") {
-            HostName = meta.deployment.targetHost;
+          // lib.optionalAttrs (!isLocal) {
+            HostName = hostname;
           }
         )
         // {

home/modules/taskwarrior/default.nix

@@ -20,7 +20,7 @@ in
   config = lib.mkIf cfg.enable (
     lib.optionalAttrs standalone {
       sops = {
-        secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" null {
+        secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" {
           taskwarrior = [
             "sync-server-url"
             "sync-server-client-id"

hosts/andromache/default.nix

@@ -7,13 +7,12 @@
 }:
 
 let
+  meta = import ./meta.nix;
   wolInterfaces = import ./wol-interfaces.nix;
 in
 {
   imports = [
     inputs.disko.nixosModules.disko
-    ./hard.nix
-    ./host.nix
     inputs.nixos-hardware.nixosModules.common-cpu-intel
     inputs.nixos-hardware.nixosModules.common-pc
     inputs.nixos-hardware.nixosModules.common-pc-ssd
@@ -24,6 +23,9 @@ in
     })
   ];
 
+  inherit (meta) host;
+
+  hardware.facter.reportPath = ./facter.json;
   home-manager.users.${config.host.username} = import ../../home/hosts/${config.host.name};
 
   "ai-tools".enable = true;
@@ -52,7 +54,11 @@ in
   desktop.ly.enable = true;
   docker.enable = true;
   hcloud.enable = true;
-  networking.enable = true;
+  networking = {
+    enable = true;
+    hostId = "80eef97e";
+    useDHCP = lib.mkDefault true;
+  };
   nvidia.enable = true;
   restic-backup.enable = true;
   secrets = {
@@ -101,6 +107,4 @@ in
     enable = true;
     package = pkgs.plocate;
   };
-
-  networking.hostId = "80eef97e";
 }

hosts/andromache/hard.nix

@@ -1,42 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{
-  config,
-  lib,
-  modulesPath,
-  ...
-}:
-
-{
-  imports = [
-    (modulesPath + "/installer/scan/not-detected.nix")
-  ];
-
-  boot = {
-    initrd.availableKernelModules = [
-      "vmd"
-      "xhci_pci"
-      "ahci"
-      "nvme"
-      "usbhid"
-      "usb_storage"
-      "uas"
-      "sd_mod"
-    ];
-    initrd.kernelModules = [ ];
-    kernelModules = [ "kvm-intel" ];
-    extraModulePackages = [ ];
-  };
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
-  # networking.interfaces.wlp0s20f3.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}

hosts/andromache/host.nix

@@ -1,7 +0,0 @@
-{
-  host = {
-    username = "h";
-    highRam = true;
-    admin = true;
-  };
-}

hosts/andromache/meta.nix

@@ -1,9 +1,10 @@
 {
   system = "x86_64-linux";
-  deployment = {
-    tags = [ "local" ];
-    targetHost = "";
-    targetUser = "h";
-  };
   role = "desktop";
+  tags = [ "local" ];
+  host = {
+    username = "h";
+    highRam = true;
+    admin = true;
+  };
 }

hosts/astyanax/default.nix

@@ -6,11 +6,12 @@
   ...
 }:
 
+let
+  meta = import ./meta.nix;
+in
 {
   imports = [
     inputs.disko.nixosModules.disko
-    ./hard.nix
-    ./host.nix
     inputs.nixos-hardware.nixosModules.common-pc
     inputs.nixos-hardware.nixosModules.common-pc-ssd
     # inputs.nixos-hardware.nixosModules.lenovo-thinkpad-e14-intel-gen7 (not available yet?)
@@ -21,6 +22,9 @@
     })
   ];
 
+  inherit (meta) host;
+
+  hardware.facter.reportPath = ./facter.json;
   home-manager.users.${config.host.username} = import ../../home/hosts/${config.host.name};
 
   "ai-tools".enable = true;

hosts/astyanax/hard.nix

@@ -1,39 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{
-  config,
-  lib,
-  modulesPath,
-  ...
-}:
-
-{
-  imports = [
-    (modulesPath + "/installer/scan/not-detected.nix")
-  ];
-
-  boot = {
-    initrd.availableKernelModules = [
-      "xhci_pci"
-      "thunderbolt"
-      "nvme"
-      "uas"
-      "sd_mod"
-    ];
-    initrd.kernelModules = [ ];
-    kernelModules = [ "kvm-intel" ];
-    extraModulePackages = [ ];
-  };
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
-  # networking.interfaces.wlan0.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}

hosts/astyanax/host.nix

@@ -1,7 +0,0 @@
-{
-  host = {
-    username = "h";
-    highRam = true;
-    admin = true;
-  };
-}

hosts/astyanax/meta.nix

@@ -1,9 +1,10 @@
 {
   system = "x86_64-linux";
-  deployment = {
-    tags = [ "local" ];
-    targetHost = "";
-    targetUser = "h";
-  };
   role = "laptop";
+  tags = [ "local" ];
+  host = {
+    username = "h";
+    highRam = true;
+    admin = true;
+  };
 }

hosts/eetion-02/default.nix

@@ -3,13 +3,17 @@
 # Raspberry Pi 3
 # See <https://nixos.wiki/wiki/NixOS_on_ARM/Raspberry_Pi_3>
 
+let
+  meta = import ./meta.nix;
+in
 {
   imports = [
     ./hard.nix
-    ./host.nix
     ../../modules
   ];
 
+  inherit (meta) host;
+
   ssh.enable = true;
 
   boot = {

hosts/eetion-02/host.nix

@@ -1,5 +0,0 @@
-{
-  host = {
-    username = "h";
-  };
-}

hosts/eetion-02/meta.nix

@@ -1,9 +1,8 @@
 {
   system = "aarch64-linux";
-  deployment = {
-    tags = [ "arm" ];
-    targetHost = "eetion-02";
-    targetUser = "h";
-  };
   role = "embedded";
+  tags = [ "arm" ];
+  host = {
+    username = "h";
+  };
 }

hosts/eetion/default.nix

@@ -3,13 +3,17 @@
 # Orange Pi Zero2 H616
 # See <https://nixos.wiki/wiki/NixOS_on_ARM/Orange_Pi_Zero2_H616>
 
+let
+  meta = import ./meta.nix;
+in
 {
   imports = [
     ./hard.nix
-    ./host.nix
     ../../modules
   ];
 
+  inherit (meta) host;
+
   ssh.enable = true;
   tailscale.enable = true;
 

hosts/eetion/host.nix

@@ -1,5 +0,0 @@
-{
-  host = {
-    username = "h";
-  };
-}

hosts/eetion/meta.nix

@@ -1,9 +1,8 @@
 {
   system = "aarch64-linux";
-  deployment = {
-    tags = [ "arm" ];
-    targetHost = "eetion";
-    targetUser = "h";
-  };
   role = "embedded";
+  tags = [ "arm" ];
+  host = {
+    username = "h";
+  };
 }

hosts/hecuba/default.nix

@@ -7,15 +7,21 @@
 
 # also see <https://wiki.nixos.org/wiki/Install_NixOS_on_Hetzner_Cloud>
 
+let
+  meta = import ./meta.nix;
+in
 {
   imports = [
     inputs.disko.nixosModules.disko
-    ./hard.nix
+    "${inputs.nixpkgs}/nixos/modules/profiles/qemu-guest.nix"
     inputs.comin.nixosModules.comin
-    ./host.nix
     ../../modules
   ];
 
+  inherit (meta) host;
+
+  hardware.facter.reportPath = ./facter.json;
+
   docker.enable = true;
   ssh.enable = true;
   tailscale.enable = true;

hosts/hecuba/hard.nix

@@ -1,39 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{
-  lib,
-  modulesPath,
-  ...
-}:
-
-{
-  imports = [
-    (modulesPath + "/profiles/qemu-guest.nix")
-  ];
-
-  boot = {
-    initrd = {
-      availableKernelModules = [
-        "ahci"
-        "xhci_pci"
-        "virtio_pci"
-        "virtio_scsi"
-        "sd_mod"
-        "sr_mod"
-      ];
-      kernelModules = [ ];
-    };
-    kernelModules = [ ];
-    extraModulePackages = [ ];
-  };
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-}

hosts/hecuba/host.nix

@@ -1,5 +0,0 @@
-{
-  host = {
-    username = "username";
-  };
-}

hosts/hecuba/meta.nix

@@ -1,9 +1,8 @@
 {
   system = "x86_64-linux";
-  deployment = {
-    tags = [ "cloud" ];
-    targetHost = "hecuba";
-    targetUser = "username";
-  };
   role = "server";
+  tags = [ "cloud" ];
+  host = {
+    username = "username";
+  };
 }

hosts/vm/default.nix

@@ -3,15 +3,20 @@
   config,
   ...
 }:
+let
+  meta = import ./meta.nix;
+in
 {
   imports = [
     inputs.disko.nixosModules.disko
-    ./hard.nix
-    ./host.nix
+    "${inputs.nixpkgs}/nixos/modules/profiles/qemu-guest.nix"
     ./disk.nix
     ../../modules
   ];
 
+  inherit (meta) host;
+
+  hardware.facter.reportPath = ./facter.json;
   home-manager.users.${config.host.username} = import ../../home/hosts/vm;
 
   "ai-tools".enable = true;

hosts/vm/hard.nix

@@ -1,38 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{
-  lib,
-  modulesPath,
-  ...
-}:
-
-{
-  imports = [
-    (modulesPath + "/profiles/qemu-guest.nix")
-  ];
-
-  boot = {
-    initrd = {
-      availableKernelModules = [
-        "ahci"
-        "xhci_pci"
-        "virtio_pci"
-        "sr_mod"
-        "virtio_blk"
-      ];
-      kernelModules = [ ];
-    };
-    kernelModules = [ "kvm-intel" ];
-    extraModulePackages = [ ];
-  };
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-}

hosts/vm/host.nix

@@ -1,5 +0,0 @@
-{
-  host = {
-    username = "h";
-  };
-}

hosts/vm/meta.nix

@@ -1,9 +1,8 @@
 {
   system = "x86_64-linux";
-  deployment = {
-    tags = [ "local" ];
-    targetHost = "";
-    targetUser = "h";
-  };
   role = "vm";
+  tags = [ "local" ];
+  host = {
+    username = "h";
+  };
 }

modules/ai-tools/default.nix

@@ -10,7 +10,7 @@ in
 
   config = lib.mkIf cfg.enable {
     nixpkgs.allowedUnfree = [ "claude-code" ];
-    secrets.groups.opencode = [ "api-key" ];
+    secrets.opencode = [ "api-key" ];
 
     sops.templates."opencode/auth.json" = {
       inherit owner;

modules/anki/default.nix

@@ -7,7 +7,7 @@ in
   options.anki.enable = lib.mkEnableOption "anki";
 
   config = lib.mkIf cfg.enable {
-    secrets.groups.anki = [
+    secrets.user.anki = [
       "sync-user"
       "sync-key"
     ];

modules/backups/default.nix

@@ -24,7 +24,7 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    secrets.groups = {
+    secrets = {
       restic = [ "password" ];
       backblaze-b2 = [
         "bucket-name"

modules/common/host.nix

@@ -10,6 +10,11 @@
       type = lib.types.str;
     };
 
+    tags = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+    };
+
     timezone = lib.mkOption {
       type = lib.types.str;
       default = "Europe/Brussels";

modules/hcloud/default.nix

@@ -15,7 +15,7 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    secrets.groups.hcloud = [ "api-token" ];
+    secrets.hcloud = [ "api-token" ];
 
     sops.templates."hcloud/cli.toml" = {
       inherit owner;

modules/secrets/default.nix

@@ -12,12 +12,25 @@ let
   inherit (config.host) username;
   inherit (cfg) sopsDir;
   owner = config.users.users.${username}.name;
+
+  system = {
+    email = [
+      "personal"
+      "work"
+    ];
+    nix = lib.optional cfg.nixSigningKey.enable "signing-key";
+  }
+  // lib.filterAttrs (_: lib.isList) cfg;
 in
 {
   imports = [ inputs.sops-nix.nixosModules.sops ];
 
+  options.secrets = lib.mkOption {
+    default = { };
+    type = lib.types.submodule {
+      freeformType = lib.types.attrsOf (lib.types.listOf lib.types.str);
+
       options = {
-    secrets = {
         enable = lib.mkEnableOption "secrets management";
 
         sopsDir = lib.mkOption {
@@ -25,13 +38,14 @@ in
           default = "${toString inputs.nix-secrets}/secrets";
         };
 
-      groups = lib.mkOption {
+        user = lib.mkOption {
           type = lib.types.attrsOf (lib.types.listOf lib.types.str);
           default = { };
         };
 
         owner = lib.mkOption {
           type = lib.types.unspecified;
+          default = owner;
         };
 
         nixSigningKey = {
@@ -43,22 +57,11 @@ in
         };
       };
     };
+  };
 
   config = lib.mkIf cfg.enable {
-    secrets = {
-      inherit owner;
-      groups = {
-        email = [
-          "personal"
-          "work"
-        ];
-        nix = lib.optional cfg.nixSigningKey.enable "signing-key";
-      };
-    };
-
     sops = {
-      age.keyFile = "/home/${username}/.config/sops/age/keys.txt";
-      secrets = myUtils.mkSopsSecrets sopsDir owner cfg.groups;
+      secrets = myUtils.mkSopsSecrets sopsDir system // myUtils.mkSopsUserSecrets sopsDir owner cfg.user;
     };
 
     nix.settings.secret-key-files = lib.mkIf cfg.nixSigningKey.enable [

modules/taskwarrior/default.nix

@@ -8,7 +8,7 @@ in
   options.taskwarrior.enable = lib.mkEnableOption "taskwarrior";
 
   config = lib.mkIf cfg.enable {
-    secrets.groups.taskwarrior = [
+    secrets.taskwarrior = [
       "sync-server-url"
       "sync-server-client-id"
       "sync-encryption-secret"

utils/hosts.nix

@@ -9,11 +9,11 @@ in
     if builtins.pathExists (hostDir + "/meta.nix") then
       import (hostDir + "/meta.nix")
     else
-      throw "meta.nix required in ${hostDir}";
+      throw "meta.nix required in ${toString hostDir}";
 
   adminHosts =
     hostsPath:
-    builtins.filter (host: ((import (hostsPath + "/${host}/host.nix")).host.admin or false)) (
+    builtins.filter (host: ((import (hostsPath + "/${host}/meta.nix")).host.admin or false)) (
       fs.dirNames hostsPath
     );
 }

utils/secrets.nix

@@ -1,7 +1,7 @@
 { lib }:
 
-{
-  mkSopsSecrets =
+let
+  mkSecrets =
     sopsDir: owner: groups:
     let
       opts = lib.optionalAttrs (owner != null) { inherit owner; };
@@ -21,6 +21,11 @@
         );
     in
     lib.foldl' lib.mergeAttrs { } (lib.mapAttrsToList mkGroup groups);
+in
+{
+  mkSopsSecrets = sopsDir: mkSecrets sopsDir null;
+
+  mkSopsUserSecrets = mkSecrets;
 
   sopsAvailability =
     config: osConfig: