fix: update secrets approach to match 'nix-secrets'

fix: add 'yubikey' module to astyanax host
fix: enable tailscale module on 'astyanax' host
2026-04-12 12:03:57 +02:00 · 2026-04-12 12:02:46 +02:00 · 2026-04-12 12:02:03 +02:00 · 2026-04-11 11:40:15 +02:00 · 2026-04-11 10:43:26 +02:00 · 2026-04-09 16:43:12 +02:00
26 changed files with 339 additions and 426 deletions
--- a/deploy/colmena.nix
+++ b/deploy/colmena.nix
@@ -13,7 +13,7 @@ let
    deployment = {
      targetHost = self.nixosConfigurations.${hostname}.config.ssh.publicHostname;
      targetUser = self.nixosConfigurations.${hostname}.config.ssh.username;
-      buildOnTarget = builtins.any (t: t != "local") tags;
+      buildOnTarget = builtins.any (t: t != "local" && t != "arm") tags;
      inherit tags;
    };
  };
@@ -22,7 +22,8 @@ let
    hostname: mkNode hostname (utils.hostMeta ../hosts/${hostname}).deployment.tags
  );
 in
-inputs.colmena.lib.makeHive {
+inputs.colmena.lib.makeHive (
+  {
    meta = {
      nixpkgs = import inputs.nixpkgs {
        localSystem = "x86_64-linux";
@@ -31,6 +32,6 @@ inputs.colmena.lib.makeHive {
      nodeNixpkgs = builtins.mapAttrs (_: v: v.pkgs) self.nixosConfigurations;
      nodeSpecialArgs = builtins.mapAttrs (_: v: v._module.specialArgs or { }) self.nixosConfigurations;
    };
-
-  inherit nodes;
-}
+  }
+  // nodes
+)
--- a/dots/.bin/git-cb
+++ b/dots/.bin/git-cb
@@ -1,221 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-readonly ALLOWED_MAIN_BRANCHES=("main" "master" "develop")
-readonly BRANCH_TYPES=(
-  "feat      For new features"
-  "hotfix    For urgent fixes"
-  "fix       For fixes"
-  "release   For preparing releases"
-  "chore     For non-code tasks"
-)
-
-error() {
-  echo "Error: $1" >&2
-  exit 1
-}
-
-warn() {
-  echo "Warning: $1" >&2
-}
-
-check_dependencies() {
-  local missing=()
-  for cmd in git fzf; do
-    if ! command -v "$cmd" &> /dev/null; then
-      missing+=("$cmd")
-    fi
-  done
-
-  if [[ ${#missing[@]} -gt 0 ]]; then
-    error "Missing required commands: ${missing[*]}"
-  fi
-}
-
-check_git_repo() {
-  if ! git rev-parse --git-dir &> /dev/null; then
-    error "Not in a git repository"
-  fi
-}
-
-check_current_branch() {
-  local current_branch
-  current_branch=$(git branch --show-current)
-
-  local is_main_branch=false
-  for branch in "${ALLOWED_MAIN_BRANCHES[@]}"; do
-    if [[ "$current_branch" == "$branch" ]]; then
-      is_main_branch=true
-      break
-    fi
-  done
-
-  if [[ "$is_main_branch" == false ]]; then
-    warn "Not branching from a main branch (current: $current_branch)"
-    read -rp "Continue anyway? [y/N] " response
-    if [[ ! "$response" =~ ^[Yy]$ ]]; then
-      exit 0
-    fi
-  fi
-}
-
-get_user_email() {
-  local email
-  email=$(git config --get user.email 2>/dev/null)
-
-  if [[ -z "$email" ]]; then
-    error "Git user email not configured. Run: git config user.email 'your@email.com'"
-  fi
-
-  echo "$email"
-}
-
-select_branch_type() {
-  local selected
-  selected=$(printf '%s\n' "${BRANCH_TYPES[@]}" | \
-    fzf --prompt="Select branch type: " \
-        --height=40% \
-        --border \
-        --info=inline) || error "Branch type selection cancelled"
-
-  echo "${selected%% *}"
-}
-
-select_jira_ticket() {
-  local email=$1
-
-  if ! command -v jira &> /dev/null; then
-    warn "Jira CLI not found. Proceeding without ticket ID."
-    return 0
-  fi
-
-  echo "Fetching Jira tickets for $email..." >&2
-  local jira_data
-  jira_data=$(jira issue list --assignee="$email" --order-by=priority --plain --no-headers 2>/dev/null) || {
-    warn "Could not fetch Jira tickets. Proceeding without ticket ID."
-    return 0
-  }
-
-  if [[ -z "$jira_data" ]]; then
-    warn "No Jira tickets found. Proceeding without ticket ID."
-    return 0
-  fi
-
-  echo "$jira_data" >&2
-  echo "" >&2
-
-  local formatted_tickets
-  formatted_tickets=$(echo "$jira_data" | awk '{
-    ticket_id = $2
-    $1 = $2 = ""
-    description = $0
-    gsub(/^[ \t]+/, "", description)
-    if (length(description) > 60) {
-      description = substr(description, 1, 57) "..."
-    }
-    print ticket_id " - " description
-  }')
-
-  if [[ -z "$formatted_tickets" ]]; then
-    warn "No tickets to display. Proceeding without ticket ID."
-    return 0
-  fi
-
-  local selected_ticket
-  selected_ticket=$(echo -e "SKIP - Create branch without ticket ID\n$formatted_tickets" | \
-    fzf --prompt="Select Jira ticket (or skip): " \
-        --height=40% \
-        --border \
-        --info=inline) || error "Ticket selection cancelled"
-
-  if [[ "$selected_ticket" != "SKIP"* ]]; then
-    echo "${selected_ticket%% -*}"
-  fi
-}
-
-get_branch_description() {
-  local ticket_id=$1
-  local editor="${EDITOR:-vi}"
-  local tmpfile
-  tmpfile=$(mktemp)
-
-  trap "rm -f '$tmpfile'" EXIT
-
-  if [[ -n "$ticket_id" ]]; then
-    cat > "$tmpfile" << EOF
-# Selected ticket: $ticket_id
-# Enter your branch description below in kebab-case (e.g., my-description):
-# The ticket ID will be automatically included in the branch name.
-# Lines starting with # will be ignored.
-
-EOF
-  else
-    cat > "$tmpfile" << 'EOF'
-# Enter your branch description below in kebab-case (e.g., my-description):
-# Lines starting with # will be ignored.
-
-EOF
-  fi
-  
-  "$editor" "$tmpfile" < /dev/tty > /dev/tty
-
-  local desc
-  desc=$(grep -v '^#' "$tmpfile" | tr -d '\n' | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')
-
-  echo "$desc"
-}
-
-validate_description() {
-  local desc=$1
-
-  if [[ -z "$desc" ]]; then
-    error "No description provided"
-  fi
-
-  if [[ ! "$desc" =~ ^[a-z0-9]+(-[a-z0-9]+)*$ ]]; then
-    error "Invalid branch description format.\nUse lowercase letters, numbers, and hyphens only.\nNo trailing or consecutive hyphens allowed.\nExample: my-feature-description"
-  fi
-}
-
-create_branch() {
-  local type=$1
-  local ticket_id=$2
-  local desc=$3
-
-  local branch
-  if [[ -n "$ticket_id" ]]; then
-    branch="$type/$ticket_id-$desc"
-  else
-    branch="$type/$desc"
-  fi
-
-  if git show-ref --verify --quiet "refs/heads/$branch"; then
-    error "Branch '$branch' already exists"
-  fi
-
-  echo ""
-  echo "Creating branch: $branch"
-  git checkout -b "$branch"
-}
-
-main() {
-  check_dependencies
-  check_git_repo
-  check_current_branch
-
-  local email
-  email=$(get_user_email)
-
-  local type
-  type=$(select_branch_type)
-
-  echo "About to call select_jira_ticket" >&2
-  local ticket_id=""
-  ticket_id=$(select_jira_ticket "$email")
-  local desc
-  desc=$(get_branch_description "$ticket_id")
-  validate_description "$desc"
-  create_branch "$type" "$ticket_id" "$desc"
-}
-
-main "$@"
--- a/dots/.config/nvim/flake.lock
+++ b/dots/.config/nvim/flake.lock
@@ -42,11 +42,11 @@
    },
    "nixCats": {
      "locked": {
-        "lastModified": 1770584904,
-        "narHash": "sha256-9Zaz8lbKF2W9pwXZEnbiGsicHdBoU+dHt3Wv3mCJoZ8=",
+        "lastModified": 1774835836,
+        "narHash": "sha256-6ok7iv/9R82vl6MYe3Lwyyb6S5bmW2PxEZtmjzlqyPs=",
        "owner": "BirdeeHub",
        "repo": "nixCats-nvim",
-        "rev": "538fdde784d2909700d97a8ef307783b33a86fb1",
+        "rev": "ebb9f279a55ca60ff4e37e4accf6518dc627aa8d",
        "type": "github"
      },
      "original": {
@@ -73,11 +73,11 @@
    },
    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1770843696,
-        "narHash": "sha256-LovWTGDwXhkfCOmbgLVA10bvsi/P8eDDpRudgk68HA8=",
+        "lastModified": 1775608838,
+        "narHash": "sha256-2ySoGH+SAi34U0PeuQgABC0WiH9LQ3tkyHTiE93KUeg=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "2343bbb58f99267223bc2aac4fc9ea301a155a16",
+        "rev": "9a01fad67a57e44e1b3e1d905c6881bcfb209e8a",
        "type": "github"
      },
      "original": {
@@ -106,11 +106,11 @@
    "plugins-helm-ls-nvim": {
      "flake": false,
      "locked": {
-        "lastModified": 1768584652,
-        "narHash": "sha256-jnMc87OjURNcqsva0npYgVyUrWc5C6L7yHpNvt9eSmg=",
+        "lastModified": 1773934114,
+        "narHash": "sha256-8trqFsA7nTKSdtkiAL0Sa9bXjh5ONtAqN7XNE/B8ukM=",
        "owner": "qvalentin",
        "repo": "helm-ls.nvim",
-        "rev": "f0b9a1723890971a6d84890b50dbf5f40974ea1b",
+        "rev": "20df43509b02a3ce3c6b3eee254d6e2bffa9a370",
        "type": "github"
      },
      "original": {
--- a/dots/.config/nvim/flake.nix
+++ b/dots/.config/nvim/flake.nix
@@ -78,8 +78,6 @@
              mcp-hub
              nixd
              nixfmt
-              nodePackages.prettier
-              nodePackages.typescript-language-server
              ormolu
              prettierd
              rust-analyzer
@@ -88,6 +86,7 @@
              stylelint
              stylua
              tree-sitter
+              typescript-language-server
              vscode-langservers-extracted
              vtsls
              yaml-language-server
--- a/flake.lock
+++ b/flake.lock
@@ -121,11 +121,11 @@
      },
      "locked": {
        "dir": "pkgs/firefox-addons",
-        "lastModified": 1774843378,
-        "narHash": "sha256-8QLbY8F7UdxeQaW0KUVgr1/YPIupe+1lGjS5joR+ZCw=",
+        "lastModified": 1775966594,
+        "narHash": "sha256-pnRtaqTr7ut8dz8b04OWAanUM4tGhDUJz8SWmeTRp7U=",
        "owner": "rycee",
        "repo": "nur-expressions",
-        "rev": "0a31b668e3ebb599f95dc518076d709e8dddb57c",
+        "rev": "000d1d2322d28fa0a51b8db9f85a227aa5413b52",
        "type": "gitlab"
      },
      "original": {
@@ -138,11 +138,11 @@
    "firefox-gnome-theme": {
      "flake": false,
      "locked": {
-        "lastModified": 1764873433,
-        "narHash": "sha256-1XPewtGMi+9wN9Ispoluxunw/RwozuTRVuuQOmxzt+A=",
+        "lastModified": 1775176642,
+        "narHash": "sha256-2veEED0Fg7Fsh81tvVDNYR6SzjqQxa7hbi18Jv4LWpM=",
        "owner": "rafaelmardojai",
        "repo": "firefox-gnome-theme",
-        "rev": "f7ffd917ac0d253dbd6a3bf3da06888f57c69f92",
+        "rev": "179704030c5286c729b5b0522037d1d51341022c",
        "type": "github"
      },
      "original": {
@@ -213,11 +213,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1767609335,
-        "narHash": "sha256-feveD98mQpptwrAEggBQKJTYbvwwglSbOv53uCfH9PY=",
+        "lastModified": 1775087534,
+        "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "250481aafeb741edfe23d29195671c19b36b6dca",
+        "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
        "type": "github"
      },
      "original": {
@@ -284,11 +284,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1775036584,
-        "narHash": "sha256-zW0lyy7ZNNT/x8JhzFHBsP2IPx7ATZIPai4FJj12BgU=",
+        "lastModified": 1775585728,
+        "narHash": "sha256-8Psjt+TWvE4thRKktJsXfR6PA/fWWsZ04DVaY6PUhr4=",
        "owner": "cachix",
        "repo": "git-hooks.nix",
-        "rev": "4e0eb042b67d863b1b34b3f64d52ceb9cd926735",
+        "rev": "580633fa3fe5fc0379905986543fd7495481913d",
        "type": "github"
      },
      "original": {
@@ -321,20 +321,18 @@
    "gnome-shell": {
      "flake": false,
      "locked": {
-        "host": "gitlab.gnome.org",
        "lastModified": 1767737596,
        "narHash": "sha256-eFujfIUQDgWnSJBablOuG+32hCai192yRdrNHTv0a+s=",
        "owner": "GNOME",
        "repo": "gnome-shell",
        "rev": "ef02db02bf0ff342734d525b5767814770d85b49",
-        "type": "gitlab"
+        "type": "github"
      },
      "original": {
-        "host": "gitlab.gnome.org",
        "owner": "GNOME",
-        "ref": "gnome-49",
        "repo": "gnome-shell",
-        "type": "gitlab"
+        "rev": "ef02db02bf0ff342734d525b5767814770d85b49",
+        "type": "github"
      }
    },
    "home-manager": {
@@ -344,11 +342,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1775047159,
-        "narHash": "sha256-UWM4VZvfKaPwA9FMu7iZha5YAE8vsEtUazk+rFxmbTY=",
+        "lastModified": 1775983377,
+        "narHash": "sha256-ZeRjipGQnVtQ/6batI+yVOrL853FZsL0m9A63OaSfgM=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "1ce9e62690dfdd7e76bd266ccb9a887778410eb2",
+        "rev": "e0ca734ffc85d25297715e98010b93303fa165c4",
        "type": "github"
      },
      "original": {
@@ -400,10 +398,10 @@
    "nix-secrets": {
      "flake": false,
      "locked": {
-        "lastModified": 1773999602,
-        "narHash": "sha256-Th4RuCEPHC8y1w/wrW9OSv9nAJ3/NSZ3MJ4DHhCXCKE=",
+        "lastModified": 1775987539,
+        "narHash": "sha256-ilN7pQUw/k4oBPJ+VoR3N5wWo72ePZfT4uvapiaLRng=",
        "ref": "main",
-        "rev": "6f4b099a0c5ad1cca97f4ba1a665faaaed367f13",
+        "rev": "13c6ddfbec41164dbdaa9d70c01cd784ea9e17e5",
        "shallow": true,
        "type": "git",
        "url": "ssh://git@github.com/hektor/nix-secrets"
@@ -417,11 +415,11 @@
    },
    "nixCats": {
      "locked": {
-        "lastModified": 1770584904,
-        "narHash": "sha256-9Zaz8lbKF2W9pwXZEnbiGsicHdBoU+dHt3Wv3mCJoZ8=",
+        "lastModified": 1774835836,
+        "narHash": "sha256-6ok7iv/9R82vl6MYe3Lwyyb6S5bmW2PxEZtmjzlqyPs=",
        "owner": "BirdeeHub",
        "repo": "nixCats-nvim",
-        "rev": "538fdde784d2909700d97a8ef307783b33a86fb1",
+        "rev": "ebb9f279a55ca60ff4e37e4accf6518dc627aa8d",
        "type": "github"
      },
      "original": {
@@ -453,11 +451,11 @@
    },
    "nixos-hardware": {
      "locked": {
-        "lastModified": 1774933469,
-        "narHash": "sha256-OrnCQeUO2bqaWUl0lkDWyGWjKsOhtCyd7JSfTedQNUE=",
+        "lastModified": 1775490113,
+        "narHash": "sha256-2ZBhDNZZwYkRmefK5XLOusCJHnoeKkoN95hoSGgMxWM=",
        "owner": "NixOS",
        "repo": "nixos-hardware",
-        "rev": "f4c4c2c0c923d7811ac2a63ccc154767e4195337",
+        "rev": "c775c2772ba56e906cbeb4e0b2db19079ef11ff7",
        "type": "github"
      },
      "original": {
@@ -469,11 +467,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1774709303,
-        "narHash": "sha256-D3Q07BbIA2KnTcSXIqqu9P586uWxN74zNoCH3h2ESHg=",
+        "lastModified": 1775710090,
+        "narHash": "sha256-ar3rofg+awPB8QXDaFJhJ2jJhu+KqN/PRCXeyuXR76E=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "8110df5ad7abf5d4c0f6fb0f8f978390e77f9685",
+        "rev": "4c1018dae018162ec878d42fec712642d214fdfa",
        "type": "github"
      },
      "original": {
@@ -511,11 +509,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1767810917,
-        "narHash": "sha256-ZKqhk772+v/bujjhla9VABwcvz+hB2IaRyeLT6CFnT0=",
+        "lastModified": 1775228139,
+        "narHash": "sha256-ebbeHmg+V7w8050bwQOuhmQHoLOEOfqKzM1KgCTexK4=",
        "owner": "nix-community",
        "repo": "NUR",
-        "rev": "dead29c804adc928d3a69dfe7f9f12d0eec1f1a4",
+        "rev": "601971b9c89e0304561977f2c28fa25e73aa7132",
        "type": "github"
      },
      "original": {
@@ -567,11 +565,11 @@
    "plugins-helm-ls-nvim": {
      "flake": false,
      "locked": {
-        "lastModified": 1768584652,
-        "narHash": "sha256-jnMc87OjURNcqsva0npYgVyUrWc5C6L7yHpNvt9eSmg=",
+        "lastModified": 1773934114,
+        "narHash": "sha256-8trqFsA7nTKSdtkiAL0Sa9bXjh5ONtAqN7XNE/B8ukM=",
        "owner": "qvalentin",
        "repo": "helm-ls.nvim",
-        "rev": "f0b9a1723890971a6d84890b50dbf5f40974ea1b",
+        "rev": "20df43509b02a3ce3c6b3eee254d6e2bffa9a370",
        "type": "github"
      },
      "original": {
@@ -667,11 +665,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1774910634,
-        "narHash": "sha256-B+rZDPyktGEjOMt8PcHKYmgmKoF+GaNAFJhguktXAo0=",
+        "lastModified": 1775971308,
+        "narHash": "sha256-VKp9bhVSm0bT6JWctFy06ocqxGGnWHi1NfoE90IgIcY=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "19bf3d8678fbbfbc173beaa0b5b37d37938db301",
+        "rev": "31ac5fe5d015f76b54058c69fcaebb66a55871a4",
        "type": "github"
      },
      "original": {
@@ -710,18 +708,17 @@
        ],
        "nur": "nur",
        "systems": "systems_2",
-        "tinted-foot": "tinted-foot",
        "tinted-kitty": "tinted-kitty",
        "tinted-schemes": "tinted-schemes",
        "tinted-tmux": "tinted-tmux",
        "tinted-zed": "tinted-zed"
      },
      "locked": {
-        "lastModified": 1774897726,
-        "narHash": "sha256-k/H2/oyex6GEC6uYXYetrboFQeTmX1Ouwv/zaW7b/Z0=",
+        "lastModified": 1775936757,
+        "narHash": "sha256-KJO/7qoxJ+hlsb3WlFSl6IGrExBIf1GvKdrhOlnGdKY=",
        "owner": "danth",
        "repo": "stylix",
-        "rev": "9b4a5eb409ceac2dd6ad495c7988e189a418cd30",
+        "rev": "d3e447786b74d62c75f665e17cb3e681c66e90c7",
        "type": "github"
      },
      "original": {
@@ -760,23 +757,6 @@
        "type": "github"
      }
    },
-    "tinted-foot": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1726913040,
-        "narHash": "sha256-+eDZPkw7efMNUf3/Pv0EmsidqdwNJ1TaOum6k7lngDQ=",
-        "owner": "tinted-theming",
-        "repo": "tinted-foot",
-        "rev": "fd1b924b6c45c3e4465e8a849e67ea82933fcbe4",
-        "type": "github"
-      },
-      "original": {
-        "owner": "tinted-theming",
-        "repo": "tinted-foot",
-        "rev": "fd1b924b6c45c3e4465e8a849e67ea82933fcbe4",
-        "type": "github"
-      }
-    },
    "tinted-kitty": {
      "flake": false,
      "locked": {
@@ -796,11 +776,11 @@
    "tinted-schemes": {
      "flake": false,
      "locked": {
-        "lastModified": 1767710407,
-        "narHash": "sha256-+W1EB79Jl0/gm4JqmO0Nuc5C7hRdp4vfsV/VdzI+des=",
+        "lastModified": 1772661346,
+        "narHash": "sha256-4eu3LqB9tPqe0Vaqxd4wkZiBbthLbpb7llcoE/p5HT0=",
        "owner": "tinted-theming",
        "repo": "schemes",
-        "rev": "2800e2b8ac90f678d7e4acebe4fa253f602e05b2",
+        "rev": "13b5b0c299982bb361039601e2d72587d6846294",
        "type": "github"
      },
      "original": {
@@ -812,11 +792,11 @@
    "tinted-tmux": {
      "flake": false,
      "locked": {
-        "lastModified": 1767489635,
-        "narHash": "sha256-e6nnFnWXKBCJjCv4QG4bbcouJ6y3yeT70V9MofL32lU=",
+        "lastModified": 1772934010,
+        "narHash": "sha256-x+6+4UvaG+RBRQ6UaX+o6DjEg28u4eqhVRM9kpgJGjQ=",
        "owner": "tinted-theming",
        "repo": "tinted-tmux",
-        "rev": "3c32729ccae99be44fe8a125d20be06f8d7d8184",
+        "rev": "c3529673a5ab6e1b6830f618c45d9ce1bcdd829d",
        "type": "github"
      },
      "original": {
@@ -828,11 +808,11 @@
    "tinted-zed": {
      "flake": false,
      "locked": {
-        "lastModified": 1767488740,
-        "narHash": "sha256-wVOj0qyil8m+ouSsVZcNjl5ZR+1GdOOAooAatQXHbuU=",
+        "lastModified": 1772909925,
+        "narHash": "sha256-jx/5+pgYR0noHa3hk2esin18VMbnPSvWPL5bBjfTIAU=",
        "owner": "tinted-theming",
        "repo": "base16-zed",
-        "rev": "11abb0b282ad3786a2aae088d3a01c60916f2e40",
+        "rev": "b4d3a1b3bcbd090937ef609a0a3b37237af974df",
        "type": "github"
      },
      "original": {
--- a/flake.nix
+++ b/flake.nix
@@ -70,9 +70,6 @@
      };
    in
    {
-      nix.nixPath = [
-        "nixpkgs=${inputs.nixpkgs}"
-      ]; # <https://github.com/nix-community/nixd/blob/main/nixd/docs/configuration.md>
      nixosConfigurations =
        (lib.genAttrs hostDirNames (
          host:
--- a/home/hosts/astyanax/default.nix
+++ b/home/hosts/astyanax/default.nix
@@ -23,6 +23,7 @@
    ../../modules/nfc
    ../../modules/nvim
    ../../modules/pandoc
+    ../../modules/secrets
    ../../modules/shell
    ../../modules/ssh
    ../../modules/taskwarrior
--- a/home/modules/anki/default.nix
+++ b/home/modules/anki/default.nix
@@ -4,13 +4,21 @@
  pkgs,
  myUtils,
  osConfig ? null,
+  inputs ? null,
  ...
 }:

 let
  sops = myUtils.sopsAvailability config osConfig;
+  standalone = osConfig == null;
 in
-{
+lib.optionalAttrs standalone {
+  sops.secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" "anki" [
+    "sync-user"
+    "sync-key"
+  ] { };
+}
+// {
  warnings = lib.optional (
    !sops.available && config.programs.anki.enable
  ) "anki is enabled but sops secrets are not available. anki sync will not be configured.";
@@ -24,8 +32,8 @@ in
      review-heatmap
    ];
    profiles."User 1".sync = lib.mkIf sops.available {
-      usernameFile = "${sops.secrets."anki-sync-user".path}";
-      keyFile = "${sops.secrets."anki-sync-key".path}";
+      usernameFile = "${sops.secrets."anki/sync-user".path}";
+      keyFile = "${sops.secrets."anki/sync-key".path}";
    };
  };
 }
--- a/home/modules/secrets/default.nix
+++ b/home/modules/secrets/default.nix
@@ -6,7 +6,8 @@
  imports = [ ./vault.nix ];

  home.packages = with pkgs; [
-    sops
    age
+    age-plugin-yubikey # TODO: only needed when using Yubikey
+    sops
  ];
 }
--- a/home/modules/taskwarrior/default.nix
+++ b/home/modules/taskwarrior/default.nix
@@ -5,13 +5,33 @@
  dotsPath,
  myUtils,
  osConfig ? null,
+  inputs ? null,
  ...
 }:

 let
  sops = myUtils.sopsAvailability config osConfig;
+  standalone = osConfig == null;
 in
-{
+lib.optionalAttrs standalone {
+  sops = {
+    secrets = myUtils.mkSopsSecrets "${toString inputs.nix-secrets}/secrets" "taskwarrior" [
+      "sync-server-url"
+      "sync-server-client-id"
+      "sync-encryption-secret"
+    ] { };
+
+    templates."taskrc.d/sync" = {
+      content = ''
+        sync.server.url=${config.sops.placeholder."taskwarrior/sync-server-url"}
+        sync.server.client_id=${config.sops.placeholder."taskwarrior/sync-server-client-id"}
+        sync.encryption_secret=${config.sops.placeholder."taskwarrior/sync-encryption-secret"}
+      '';
+    };
+  };
+}
+// {
+
  warnings =
    lib.optional (!sops.available && config.programs.taskwarrior.enable)
      "taskwarrior is enabled, but sops templates are not available. taskwarrior sync will not be configured.";
--- a/hosts/andromache/default.nix
+++ b/hosts/andromache/default.nix
@@ -23,6 +23,7 @@ in
      inherit lib config;
      device = "/dev/nvme1n1";
    })
+    ../../modules/anki
    ../../modules/audio
    ../../modules/backups
    ../../modules/bluetooth
@@ -31,19 +32,23 @@ in
    ../../modules/firewall
    ../../modules/fonts
    ../../modules/gaming
-    ../../modules/networking
+    ../../modules/git
+    ../../modules/hcloud
    ../../modules/keyboard
    ../../modules/localization
+    ../../modules/networking
    ../../modules/nvidia
+    ../../modules/ai-tools
    (import ../../modules/secrets { inherit lib inputs config; })
    ../../modules/ssh
    ../../modules/storage
    ../../modules/stylix
    ../../modules/syncthing
+    ../../modules/tailscale
+    ../../modules/taskwarrior
    ../../modules/users
    ../../modules/wol
    ../../modules/yubikey
-    ../../modules/hcloud
  ];

  home-manager.users.${config.host.username} = import ../../home/hosts/andromache {
@@ -62,7 +67,11 @@ in
    inherit (config.host) username;
    nixSigningKey.enable = true;
  };
+
+  tailscale.enable = true;
+
  docker.user = config.host.username;
+
  hcloud = {
    enable = true;
    inherit (config.host) username;
--- a/hosts/astyanax/default.nix
+++ b/hosts/astyanax/default.nix
@@ -16,28 +16,35 @@ in
    inputs.nixos-hardware.nixosModules.common-pc
    inputs.nixos-hardware.nixosModules.common-pc-ssd
    # inputs.nixos-hardware.nixosModules.lenovo-thinkpad-e14-intel-gen7 (not available yet?)
+    inputs.sops-nix.nixosModules.sops
    ../../modules/common
    ../../modules/boot/bootloader.nix
    (import ../../modules/disko/zfs-encrypted-root.nix {
      inherit lib config;
      device = "/dev/nvme0n1";
    })
-    ../../modules/desktops/niri
+    ../../modules/ai-tools
+    ../../modules/anki
    ../../modules/audio
    ../../modules/backups
    ../../modules/bluetooth
-    ../../modules/keyboard
-    ../../modules/networking
-    ../../modules/users
-    ../../modules/localization
+    ../../modules/desktops/niri
+    ../../modules/docker
+    ../../modules/firewall
    ../../modules/fonts
+    ../../modules/git
+    ../../modules/keyboard
+    ../../modules/localization
+    ../../modules/networking
+    ../../modules/nfc
+    ../../modules/secrets
    ../../modules/ssh
    ../../modules/storage
    ../../modules/stylix
-    (import ../../modules/secrets { inherit lib inputs config; })
-    ../../modules/docker
-    ../../modules/nfc
-    ../../modules/firewall
+    ../../modules/tailscale
+    ../../modules/taskwarrior
+    ../../modules/users
+    ../../modules/yubikey
  ];

  home-manager.users.${config.host.username} = import ../../home/hosts/astyanax {
@@ -56,6 +63,8 @@ in
    inherit (config.host) username;
    nixSigningKey.enable = true;
  };
+
+  tailscale.enable = true;
  docker.user = config.host.username;
  nfc.user = config.host.username;
  desktop.ly.enable = true;
@@ -100,6 +109,25 @@ in

  boot.binfmt.emulatedSystems = [ "aarch64-linux" ];

+  my.yubikey = {
+    enable = true;
+    # inherit (config.host) username;
+    # keys = [
+    #   {
+    #     handle = "<KeyHandle1>";
+    #     userKey = "<UserKey1>";
+    #     coseType = "<CoseType1>";
+    #     options = "<Options1>";
+    #   }
+    #   {
+    #     handle = "<KeyHandle2>";
+    #     userKey = "<UserKey2>";
+    #     coseType = "<CoseType2>";
+    #     options = "<Options2>";
+    #   }
+    # ];
+  };
+
  services = {
    fwupd.enable = true;
    locate = {
--- a/hosts/astyanax/ssh_user.pub
+++ b/hosts/astyanax/ssh_user.pub
@@ -1 +1 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIzP1PjIDb1tN9nhPOK88HYDtTNk9SN9ZpEem2id49Fa h@astyanax
+sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIJApgl/+QaAtrg0OK5ihXasdcnDwzFo6qtHbgnqGFl25AAAABHNzaDo= h@astyanax
--- a/hosts/vm/default.nix
+++ b/hosts/vm/default.nix
@@ -12,20 +12,24 @@
    ./host.nix
    ./disk.nix
    ../../modules/common
-    ../../modules/boot/bootloader.nix
-    ../../modules/keyboard
-    ../../modules/networking
-    ../../modules/users
+    ../../modules/anki
    ../../modules/audio
-    ../../modules/localization
-    ../../modules/x
+    ../../modules/boot/bootloader.nix
    ../../modules/fonts
+    ../../modules/git
+    ../../modules/keyboard
+    ../../modules/localization
+    ../../modules/networking
+    ../../modules/ai-tools
    ../../modules/ssh
    ../../modules/storage
    ../../modules/stylix
    (import ../../modules/secrets {
      inherit lib inputs config;
    })
+    ../../modules/taskwarrior
+    ../../modules/users
+    ../../modules/x
  ];

  home-manager.users.${config.host.username} = import ../../home/hosts/vm {
--- a/modules/ai-tools/default.nix
+++ b/modules/ai-tools/default.nix
@@ -0,0 +1,24 @@
+{ config, myUtils, ... }:
+
+let
+  inherit (config.secrets) sopsDir username;
+  owner = config.users.users.${username}.name;
+in
+{
+  config.sops = {
+    secrets = myUtils.mkSopsSecrets sopsDir "opencode" [ "api-key" ] { inherit owner; };
+
+    templates."opencode/auth.json" = {
+      inherit owner;
+      path = "/home/${username}/.local/share/opencode/auth.json";
+      content = ''
+        {
+          "zai-coding-plan": {
+            "type": "api",
+            "key": "${config.sops.placeholder."opencode/api-key"}"
+          }
+        }
+      '';
+    };
+  };
+}
--- a/modules/anki/default.nix
+++ b/modules/anki/default.nix
@@ -0,0 +1,11 @@
+{ config, myUtils, ... }:
+
+let
+  inherit (config.secrets) sopsDir username;
+  owner = config.users.users.${username}.name;
+in
+{
+  config.sops = {
+    secrets = myUtils.mkSopsSecrets sopsDir "anki" [ "sync-user" "sync-key" ] { inherit owner; };
+  };
+}
--- a/modules/backups/default.nix
+++ b/modules/backups/default.nix
@@ -1,6 +1,7 @@
 {
  lib,
  config,
+  myUtils,
  ...
 }:

@@ -13,12 +14,12 @@ in
    restic-backup = {
      repository = lib.mkOption {
        type = lib.types.str;
-        default = "b2:${config.sops.placeholder.b2-bucket-name}:${config.networking.hostName}";
+        default = "b2:${config.sops.placeholder."backblaze-b2/bucket-name"}:${config.networking.hostName}";
      };

      passwordFile = lib.mkOption {
        type = lib.types.str;
-        default = config.sops.secrets.restic-password.path;
+        default = config.sops.secrets."restic/password".path;
      };

      paths = lib.mkOption {
@@ -30,28 +31,18 @@ in

  config = {
    sops = {
-      secrets = {
-        restic-password = {
-          sopsFile = "${sopsDir}/restic-password";
-        };
-        b2-bucket-name = {
-          sopsFile = "${sopsDir}/b2-bucket-name";
-        };
-        b2-account-id = {
-          sopsFile = "${sopsDir}/b2-account-id";
-        };
-        b2-account-key = {
-          sopsFile = "${sopsDir}/b2-account-key";
-        };
-      };
+      secrets = lib.mkMerge [
+        (myUtils.mkSopsSecrets sopsDir "restic" [ "password" ] { })
+        (myUtils.mkSopsSecrets sopsDir "backblaze-b2" [ "bucket-name" "account-id" "account-key" ] { })
+      ];
      templates = {
        "restic/repo-${config.networking.hostName}" = {
-          content = "b2:${config.sops.placeholder.b2-bucket-name}:${config.networking.hostName}";
+          content = "b2:${config.sops.placeholder."backblaze-b2/bucket-name"}:${config.networking.hostName}";
        };
        "restic/b2-env-${config.networking.hostName}" = {
          content = ''
-            B2_ACCOUNT_ID=${config.sops.placeholder.b2-account-id}
-            B2_ACCOUNT_KEY=${config.sops.placeholder.b2-account-key}
+            B2_ACCOUNT_ID=${config.sops.placeholder."backblaze-b2/account-id"}
+            B2_ACCOUNT_KEY=${config.sops.placeholder."backblaze-b2/account-key"}
          '';
        };
      };
--- a/modules/common/default.nix
+++ b/modules/common/default.nix
@@ -25,6 +25,7 @@ in
    system.stateVersion = lib.mkDefault "25.05";

    nix = {
+      nixPath = [ "nixpkgs=${inputs.nixpkgs}" ]; # https://github.com/nix-community/nixd/blob/main/nixd/docs/configuration.md
      optimise = {
        automatic = true;
        dates = [ "05:00" ];
--- a/modules/desktops/niri/default.nix
+++ b/modules/desktops/niri/default.nix
@@ -19,7 +19,10 @@ in
  };

  config = {
-    programs.niri.enable = true;
+    programs.niri = {
+      enable = true;
+      useNautilus = false;
+    };

    xdg.portal = {
      enable = true;
@@ -33,6 +36,7 @@ in
    };

    services = {
+      gnome.gnome-keyring.enable = false;
      dbus.enable = true;
      logind.settings.Login = {
        HandleLidSwitch = "suspend";
--- a/modules/git/default.nix
+++ b/modules/git/default.nix
@@ -0,0 +1,29 @@
+{
+  config,
+  ...
+}:
+
+let
+  inherit (config.secrets) username;
+  owner = config.users.users.${username}.name;
+in
+{
+  config.sops.templates = {
+    ".gitconfig.email" = {
+      inherit owner;
+      path = "/home/${username}/.gitconfig.email";
+      content = ''
+        [user]
+          email = ${config.sops.placeholder."email/personal"}
+      '';
+    };
+    ".gitconfig.work.email" = {
+      inherit owner;
+      path = "/home/${username}/.gitconfig.work.email";
+      content = ''
+        [user]
+          email = ${config.sops.placeholder."email/work"}
+      '';
+    };
+  };
+}
--- a/modules/hcloud/default.nix
+++ b/modules/hcloud/default.nix
@@ -1,6 +1,7 @@
 {
  lib,
  config,
+  myUtils,
  ...
 }:

@@ -18,8 +19,7 @@ in
  };

  config = lib.mkIf cfg.enable {
-    sops.secrets.hcloud-token = {
-      sopsFile = "${sopsDir}/hcloud-token";
+    sops.secrets = myUtils.mkSopsSecrets sopsDir "hcloud" [ "api-token" ] {
      owner = config.users.users.${cfg.username}.name;
    };

@@ -31,7 +31,7 @@ in

        [[contexts]]
          name = "server"
-          token = "${config.sops.placeholder.hcloud-token}"
+          token = "${config.sops.placeholder."hcloud/api-token"}"
      '';
    };
  };
--- a/modules/secrets/default.nix
+++ b/modules/secrets/default.nix
@@ -1,7 +1,9 @@
 {
  lib,
  inputs,
+  pkgs,
  config,
+  myUtils,
  ...
 }:

@@ -9,13 +11,7 @@ let
  cfg = config.secrets;
  inherit (cfg) sopsDir;
  owner = config.users.users.${cfg.username}.name;
-
-  mkSecret = name: {
-    ${name} = {
-      sopsFile = "${sopsDir}/${name}";
-      inherit owner;
-    };
-  };
+  mkSopsSecrets = myUtils.mkSopsSecrets sopsDir;
 in
 {
  imports = [ inputs.sops-nix.nixosModules.sops ];
@@ -38,69 +34,42 @@ in
          default = "${config.host.name}-nix-signing-key";
        };
      };
+
+      yubikey = {
+        enable = lib.mkEnableOption "set up Yubikey";
+      };
    };
  };

  config = {
    sops = {
+      # for yubikey, generate as follows:
+      # ```
+      # age-plugin-yubikey --identity > <keyfile-path>
+      # ```
      age.keyFile = "/home/${cfg.username}/.config/sops/age/keys.txt";

      secrets = lib.mkMerge [
-        (mkSecret "taskwarrior-sync-server-url")
-        (mkSecret "taskwarrior-sync-server-client-id")
-        (mkSecret "taskwarrior-sync-encryption-secret")
-        (mkSecret "anki-sync-user")
-        (mkSecret "anki-sync-key")
-        (mkSecret "email-personal")
-        (mkSecret "email-work")
-        (mkSecret "opencode-api-key")
-        (lib.mkIf cfg.nixSigningKey.enable (mkSecret cfg.nixSigningKey.name))
+        (mkSopsSecrets "email" [ "personal" "work" ] { inherit owner; })
+        (lib.mkIf cfg.nixSigningKey.enable {
+          ${cfg.nixSigningKey.name} = {
+            sopsFile = "${sopsDir}/${cfg.nixSigningKey.name}.yaml";
+            inherit owner;
+          };
+        })
      ];
-
-      templates = {
-        "taskrc.d/sync" = {
-          inherit owner;
-          content = ''
-            sync.server.url=${config.sops.placeholder.taskwarrior-sync-server-url}
-            sync.server.client_id=${config.sops.placeholder.taskwarrior-sync-server-client-id}
-            sync.encryption_secret=${config.sops.placeholder.taskwarrior-sync-encryption-secret}
-          '';
-        };
-
-        ".gitconfig.email" = {
-          inherit owner;
-          path = "/home/${cfg.username}/.gitconfig.email";
-          content = ''
-            [user]
-              email = ${config.sops.placeholder.email-personal}
-          '';
-        };
-        ".gitconfig.work.email" = {
-          inherit owner;
-          path = "/home/${cfg.username}/.gitconfig.work.email";
-          content = ''
-            [user]
-              email = ${config.sops.placeholder.email-work}
-          '';
-        };
-
-        "opencode/auth.json" = {
-          inherit owner;
-          path = "/home/${cfg.username}/.local/share/opencode/auth.json";
-          content = ''
-            {
-              "zai-coding-plan": {
-                "type": "api",
-                "key": "${config.sops.placeholder.opencode-api-key}"
-              }
-            }
-          '';
-        };
-      };
    };

    nix.settings.secret-key-files = lib.mkIf cfg.nixSigningKey.enable [
      config.sops.secrets.${cfg.nixSigningKey.name}.path
    ];
+
+    services = {
+      pcscd.enable = true; # needed for age-plugin-yubikey?
+      udev.packages = lib.mkIf cfg.yubikey.enable [
+        pkgs.yubikey-personalization
+        pkgs.libfido2
+      ];
+    };
  };
 }
--- a/modules/tailscale/default.nix
+++ b/modules/tailscale/default.nix
@@ -0,0 +1,17 @@
+{
+  lib,
+  config,
+  ...
+}:
+{
+  options.tailscale = {
+    enable = lib.mkEnableOption "tailscale";
+  };
+
+  config = lib.mkIf config.tailscale.enable {
+    services.tailscale = {
+      enable = true;
+      openFirewall = true;
+    };
+  };
+}
--- a/modules/taskwarrior/default.nix
+++ b/modules/taskwarrior/default.nix
@@ -0,0 +1,24 @@
+{ config, myUtils, ... }:
+
+let
+  inherit (config.secrets) sopsDir username;
+  owner = config.users.users.${username}.name;
+in
+{
+  config.sops = {
+    secrets = myUtils.mkSopsSecrets sopsDir "taskwarrior" [
+      "sync-server-url"
+      "sync-server-client-id"
+      "sync-encryption-secret"
+    ] { inherit owner; };
+
+    templates."taskrc.d/sync" = {
+      inherit owner;
+      content = ''
+        sync.server.url=${config.sops.placeholder."taskwarrior/sync-server-url"}
+        sync.server.client_id=${config.sops.placeholder."taskwarrior/sync-server-client-id"}
+        sync.encryption_secret=${config.sops.placeholder."taskwarrior/sync-encryption-secret"}
+      '';
+    };
+  };
+}
--- a/modules/yubikey/default.nix
+++ b/modules/yubikey/default.nix
@@ -70,6 +70,6 @@ in
      };
    };

-    services.udev.packages = [ pkgs.yubikey-personalization ];
+    services.udev.packages = with pkgs; [ yubikey-personalization ];
  };
 }
--- a/utils/default.nix
+++ b/utils/default.nix
@@ -11,15 +11,31 @@
    else
      throw "meta.nix required in ${hostDir}";

+  mkSopsSecrets =
+    sopsDir: group: names: extraOpts:
+    let
+      file = "${group}.yaml";
+    in
+    lib.foldl' lib.mergeAttrs { } (
+      map (name: {
+        "${group}/${name}" = {
+          sopsFile = "${sopsDir}/${file}";
+          key = name;
+        }
+        // extraOpts;
+      }) names
+    );
+
  sopsAvailability =
    config: osConfig:
    let
-      hmSopsAvailable = config ? sops && config.sops ? secrets;
      osSopsAvailable = osConfig != null && osConfig ? sops && osConfig.sops ? secrets;
+      hmSopsAvailable = config ? sops && config.sops ? secrets;
+      preferOs = osSopsAvailable;
    in
    {
-      available = hmSopsAvailable || osSopsAvailable;
-      secrets = if hmSopsAvailable then config.sops.secrets else osConfig.sops.secrets;
-      templates = if hmSopsAvailable then config.sops.templates else osConfig.sops.templates;
+      available = osSopsAvailable || hmSopsAvailable;
+      secrets = if preferOs then osConfig.sops.secrets else config.sops.secrets;
+      templates = if preferOs then osConfig.sops.templates else config.sops.templates;
    };
 }
Author	SHA1	Message	Date
hektor	595250f89c	fix: update secrets approach to match 'nix-secrets'	2026-04-12 12:03:57 +02:00
hektor	5ecd5d772f	fix: add 'yubikey' module to astyanax host	2026-04-12 12:02:46 +02:00
hektor	eacb1748ee	fix: enable tailscale module on 'astyanax' host	2026-04-12 12:02:03 +02:00
hektor	e2a26198f0	fix(niri): do not enable gnome keyring or Nautilus when niri is enabled	2026-04-11 11:40:15 +02:00
hektor	9fa2c1a8c1	chore(ssh): rotate 'astyanax' to hardware-backed ssh key	2026-04-11 10:43:26 +02:00
hektor	fbed5be585	chore(nvim): update 'nvim' packages	2026-04-09 16:43:12 +02:00
Hektor Misplon	0b25070c39	refactor: move nixPath into 'common' module	2026-04-09 16:25:35 +02:00
hektor	fdbfe58116	feat: add tailscale module	2026-04-09 16:17:19 +02:00
hektor	7cd3b85d81	fix(deploy): never build ARM on target	2026-04-06 16:37:33 +02:00
hektor	c373ef8455	fix(deploy): resolve colmena issues	2026-04-06 16:29:22 +02:00
hektor	9ce09fbc85	chore(scripts): remove 'git-cb' script	2026-04-06 11:43:43 +02:00