feat(sops): host specific secrets config

5 files changed, 93 insertions, 2 deletions

diff --git a/modules/hosts/adam/flake-parts.nix b/modules/hosts/adam/flake-parts.nix
index cf50170..9f23227 100644
--- a/modules/hosts/adam/flake-parts.nix
+++ b/modules/hosts/adam/flake-parts.nix
@@ -4,7 +4,6 @@
     specialArgs = { inherit inputs; };
     modules = [
       inputs.self.modules.nixos.adam
-      inputs.self.modules.nixos.secrets
       inputs.self.modules.nixos.home-manager
       inputs.self.modules.nixos.plymouth
       inputs.self.modules.nixos.kde
diff --git a/modules/hosts/adam/secrets.nix b/modules/hosts/adam/secrets.nix
new file mode 100644
index 0000000..f88e1bf
--- /dev/null
+++ b/modules/hosts/adam/secrets.nix
@@ -0,0 +1,28 @@
+{
+  flake.modules.nixos.adam =
+    { inputs, ... }:
+    {
+      imports = [ inputs.sops-nix.nixosModules.sops ];
+      sops = {
+        defaultSopsFile = inputs.self + /secrets/secrets.yaml;
+        age.keyFile = "/etc/sops/age_key";
+        secrets = {
+          "ssh_github_key" = {
+            owner = "schererleander";
+            group = "users";
+            mode = "0600";
+          };
+          "ssh_jonsbo_key" = {
+            owner = "administrator";
+            group = "users";
+            mode = "0600";
+          };
+          "ssh_sachiel_key" = {
+            owner = "administrator";
+            group = "users";
+            mode = "0600";
+          };
+        };
+      };
+    };
+}
diff --git a/modules/hosts/lilith/secrets.nix b/modules/hosts/lilith/secrets.nix
new file mode 100644
index 0000000..b02dacc
--- /dev/null
+++ b/modules/hosts/lilith/secrets.nix
@@ -0,0 +1,25 @@
+{
+  flake.modules.darwin.lilith =
+    { inputs, ... }:
+    {
+      imports = [ inputs.sops-nix.darwinModules.sops ];
+      sops = {
+        defaultSopsFile = inputs.self + /secrets/secrets.yaml;
+        age.keyFile = "/etc/sops/age_key";
+        secrets = {
+          "ssh_github_key" = {
+            owner = "schererleander";
+            mode = "0600";
+          };
+          "ssh_jonsbo_key" = {
+            owner = "schererleander";
+            mode = "0600";
+          };
+          "ssh_sachiel_key" = {
+            owner = "schererleander";
+            mode = "0600";
+          };
+        };
+      };
+    };
+}
diff --git a/modules/hosts/sachiel/flake-parts.nix b/modules/hosts/sachiel/flake-parts.nix
index 42d7551..6f33503 100644
--- a/modules/hosts/sachiel/flake-parts.nix
+++ b/modules/hosts/sachiel/flake-parts.nix
@@ -4,7 +4,6 @@
     specialArgs = { inherit inputs; };
     modules = [
       inputs.self.modules.nixos.sachiel
-      inputs.self.modules.nixos.secrets
       inputs.self.modules.nixos.openssh
       inputs.self.modules.nixos.nginx
       inputs.self.modules.nixos.nextcloud
diff --git a/modules/hosts/sachiel/secrets.nix b/modules/hosts/sachiel/secrets.nix
new file mode 100644
index 0000000..c0968fd
--- /dev/null
+++ b/modules/hosts/sachiel/secrets.nix
@@ -0,0 +1,40 @@
+{
+  flake.modules.nixos.sachiel =
+    { inputs, ... }:
+    {
+      imports = [ inputs.sops-nix.nixosModules.sops ];
+      sops = {
+        defaultSopsFile = inputs.self + /secrets/secrets.yaml;
+        age.keyFile = "/etc/sops/age_key";
+        secrets = {
+          "nextcloud-secrets" = {
+            owner = "nextcloud";
+            group = "nextcloud";
+            mode = "0400";
+          };
+          "nextcloud-admin-pass" = {
+            owner = "root";
+            mode = "0600";
+          };
+          # SSL certificates
+          "cert_fullchain" = {
+            owner = "nginx";
+            group = "nginx";
+          };
+          "cert_private" = {
+            owner = "nginx";
+            group = "nginx";
+          };
+          # Backup configuration
+          "borgbase_ssh_key" = {
+            owner = "root";
+            mode = "0600";
+          };
+          "borg_repo" = {
+            owner = "root";
+            mode = "0600";
+          };
+        };
+      };
+    };
+}