From 3b13d9a2a367db84d48940460532c17a374bb488 Mon Sep 17 00:00:00 2001
From: schererleander <leander@schererleander.de>
Date: Thu, 5 Feb 2026 12:03:07 +0100
Subject: feat(modules): use dendritic pattern

---
 modules/system/secrets.nix | 50 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 50 insertions(+)
 create mode 100644 modules/system/secrets.nix

(limited to 'modules/system/secrets.nix')

diff --git a/modules/system/secrets.nix b/modules/system/secrets.nix
new file mode 100644
index 0000000..e59c7da
--- /dev/null
+++ b/modules/system/secrets.nix
@@ -0,0 +1,50 @@
+{
+  flake.modules.nixos.secrets =
+    { inputs, ... }:
+    {
+      imports = [ inputs.sops-nix.nixosModules.sops ];
+      sops = {
+        defaultSopsFile = inputs.self + /secrets/secrets.yaml;
+        age.keyFile = "/etc/sops/age_key";
+        secrets = {
+          "borgbase_ssh_key" = {
+            owner = "root";
+            mode = "0600";
+          };
+          "nextcloud-secret" = {
+            owner = "nextcloud";
+            group = "nextcloud";
+            mode = "0400";
+          };
+          "nextcloud-admin-pass" = {
+            owner = "root";
+            mode = "0600";
+          };
+          "ssh_github_key" = {
+            owner = "administrator";
+            mode = "0600";
+          };
+          "ssh_jonsbo_key" = {
+            owner = "administrator";
+            mode = "0600";
+          };
+          "ssh_sachiel_key" = {
+            owner = "administrator";
+            mode = "0600";
+          };
+          "borg_repo" = {
+            owner = "root";
+            mode = "0600";
+          };
+          "cert_fullchain" = {
+            owner = "nginx";
+            group = "nginx";
+          };
+          "cert_private" = {
+            owner = "nginx";
+            group = "nginx";
+          };
+        };
+      };
+    };
+}
-- 
cgit v1.3.1