From 5b94d9999c0295236416d75c13dcdafdef02b8af Mon Sep 17 00:00:00 2001
From: schererleander <leander@schererleander.de>
Date: Tue, 3 Feb 2026 17:52:05 +0100
Subject: feat(sops): setup sops-nix

---
 modules/secrets/default.nix | 56 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 56 insertions(+)
 create mode 100644 modules/secrets/default.nix

(limited to 'modules/secrets/default.nix')

diff --git a/modules/secrets/default.nix b/modules/secrets/default.nix
new file mode 100644
index 0000000..81f7a40
--- /dev/null
+++ b/modules/secrets/default.nix
@@ -0,0 +1,56 @@
+{ inputs, ... }:
+{
+  flake.modules.nixos.secrets = { config, ... }: {
+    imports = [ inputs.sops-nix.nixosModules.sops ];
+    sops.defaultSopsFile = ../../../secrets/secrets.yaml;
+    sops.age.keyFile = "/etc/sops/age_key";
+  sops.secrets."borgbase_ssh_key" = {
+    owner = "root";
+    mode = "0600";
+  };
+  sops.secrets."nextcloud-admin-pass" = {
+    owner = "root";
+    mode = "0600";
+  };
+  sops.secrets."ssh_github_key" = {
+    owner = "schererleander";
+    mode = "0600";
+  };
+  sops.secrets."ssh_jonsbo_key" = {
+    owner = "schererleander";
+    mode = "0600";
+  };
+  sops.secrets."ssh_sachiel_key" = {
+    owner = "schererleander";
+    mode = "0600";
+  };
+  sops.secrets."ssh_borgbase_unraid_key" = {
+    owner = "root";
+    mode = "0600";
+  };
+  sops.secrets."ssh_config" = {
+    owner = "schererleander";
+    mode = "0600";
+  };
+  sops.secrets."borg_repo" = {
+    owner = "root";
+    mode = "0600";
+  };
+  };
+
+  flake.modules.darwin.secrets = { config, ... }: {
+    imports = [ inputs.sops-nix.darwinModules.sops ];
+    sops.defaultSopsFile = ../../../secrets/secrets.yaml;
+    sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+  };
+
+  flake.modules.homeManager.secrets = { config, ... }: {
+    imports = [ inputs.sops-nix.homeManagerModules.sops ];
+    sops.age.sshKeyPaths = [ "${config.home.homeDirectory}/.ssh/id_ed25519" ];
+
+    programs.ssh = {
+      enable = true;
+      includes = [ config.sops.secrets."ssh_config".path ];
+    };
+  };
+}
\ No newline at end of file
-- 
cgit v1.3.1