4 files changed, 51 insertions, 9 deletions
diff --git a/nix/programs/default.nix b/nix/programs/default.nix
index c4a6f61..a6c2996 100644
--- a/nix/programs/default.nix
+++ b/nix/programs/default.nix
@@ -9,6 +9,7 @@
 		./kitty
 		./mako
 		./neovim
+		./sops
 		./ssh
 		./starship
 		./waybar
diff --git a/nix/programs/gpg/default.nix b/nix/programs/gpg/default.nix
index 92549ff..5629995 100644
--- a/nix/programs/gpg/default.nix
+++ b/nix/programs/gpg/default.nix
@@ -1,24 +1,35 @@
 { config, lib, pkgs, ... }:
 
+let
+
+  keysDir = ../../../files/keys;
+  keys = lib.attrsets.mapAttrsToList (name: type: "${keysDir}/${name}") (builtins.readDir keysDir);
+
+in
 {
   home-manager.users.${config.user} = {
+
+    # install keys into gpg keyring
     programs.gpg = {
       enable = true;
-      publicKeys = [
-        {
-          source = ../../../files/keys/freya-gpg.pub;
-          trust = 5;
-        }
-      ];
+      publicKeys = map (file: { source = file; trust = 5; }) keys;
     };
 
+    # global gpg agent
     services.gpg-agent = {
       enable = true;
       enableExtraSocket = true;
       enableSshSupport = true;
-      #updateStartupTty = true;
-
       pinentryPackage = pkgs.pinentry-curses;
     };
+
+  };
+
+  # yubikey support
+  services = {
+    pcscd.enable = true;
+    udev.packages = with pkgs; [
+      yubikey-personalization
+    ];
   };
 }
diff --git a/nix/programs/sops/default.nix b/nix/programs/sops/default.nix
new file mode 100644
index 0000000..2447935
--- /dev/null
+++ b/nix/programs/sops/default.nix
@@ -0,0 +1,30 @@
+{ config, pkgs, inputs, ... }:
+
+let
+
+  isEd25519 = k: k.type == "ed25519";
+  getKeyPath = k: k.path;
+  keys = builtins.filter isEd25519 config.services.openssh.hostKeys;
+
+in
+{
+    imports = [
+        inputs.sops-nix.nixosModules.sops
+    ];
+
+    environment.systemPackages = with pkgs; [
+        sops
+    ];
+
+    sops = {
+      defaultSopsFile = config.dotfilesPath + "/hosts/${config.hostName}/secrets.yaml";
+      validateSopsFiles = false;
+
+      gnupg.home = config.homePath + "/.gnupg";
+      gnupg.sshKeyPaths = [];
+
+      secrets = {
+        freyanetWg = {};
+      };
+    };
+}
diff --git a/nix/programs/wireguard/default.nix b/nix/programs/wireguard/default.nix
index 83c2585..7e4ab7a 100644
--- a/nix/programs/wireguard/default.nix
+++ b/nix/programs/wireguard/default.nix
@@ -9,7 +9,7 @@
     freyanet = {
       address = [ "10.2.0.2/32" "fd:cafe:dead:bee::2/128" "fe80::2/128" ];
       dns = [ "10.2.2.2" ];
-      privateKeyFile = "${config.dotfilesPath}/secrets/freyanet.key";
+      privateKeyFile = config.sops.secrets.freyanetWg.path;
 
       peers = [{
         publicKey = "x0ykwakpYCvI/pG+nR83lNUyeOE9m54thnX3bvZ+FUk=";