From d999d4d0e68b9d7cfa0f477cdbac8fe82850ae78 Mon Sep 17 00:00:00 2001
From: Freya Murphy <freya@freyacat.org>
Date: Fri, 24 Jan 2025 13:06:22 -0500
Subject: use sops-nix for secrets

---
 nix/programs/sops/default.nix | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)
 create mode 100644 nix/programs/sops/default.nix

(limited to 'nix/programs/sops')

diff --git a/nix/programs/sops/default.nix b/nix/programs/sops/default.nix
new file mode 100644
index 0000000..2447935
--- /dev/null
+++ b/nix/programs/sops/default.nix
@@ -0,0 +1,30 @@
+{ config, pkgs, inputs, ... }:
+
+let
+
+  isEd25519 = k: k.type == "ed25519";
+  getKeyPath = k: k.path;
+  keys = builtins.filter isEd25519 config.services.openssh.hostKeys;
+
+in
+{
+    imports = [
+        inputs.sops-nix.nixosModules.sops
+    ];
+
+    environment.systemPackages = with pkgs; [
+        sops
+    ];
+
+    sops = {
+      defaultSopsFile = config.dotfilesPath + "/hosts/${config.hostName}/secrets.yaml";
+      validateSopsFiles = false;
+
+      gnupg.home = config.homePath + "/.gnupg";
+      gnupg.sshKeyPaths = [];
+
+      secrets = {
+        freyanetWg = {};
+      };
+    };
+}
-- 
cgit v1.2.3-freya