Padreug
7af3bce544
Wires sops-nix as a flake input and bakes the NixOS module into
configuration.nix via modules/secrets.nix. Per-host defaults live in
modules/secrets.nix:
- defaultSopsFile = ../secrets/${settings.hostName}.yaml
- defaultSopsFormat = yaml
- age.keyFile = /home/${settings.user}/.config/sops/age/keys.txt
The whole sops block is gated on `builtins.pathExists` so flake eval
succeeds before the encrypted file is created — important during the
scaffold-bootstrap phase where the consumer hasn't yet generated an
age key.
Adds .sops.yaml with a placeholder admin recipient (overwrite with
your real age public key before encrypting anything) and a
creation_rules block matching `secrets/*.yaml`.
.gitignore loosened so `secrets/*.yaml` and `secrets/README.md` can
be checked in while plaintext key material (`*.key`, `*.pem`) and
anything else under `secrets/` stays ignored. The pre-commit secret
scanner most consumers use is the second line of defense.
secrets/README.md documents the workflow at the directory level.
The substantive beginner walkthrough lands in a follow-up commit at
docs/secrets-management.md.
`nix flake check --no-build` stays green.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
21 lines
724 B
YAML
21 lines
724 B
YAML
# sops recipient declarations.
|
|
#
|
|
# Replace the placeholder below with YOUR age public key before
|
|
# encrypting any files. One-time setup on this machine:
|
|
# pragma: allowlist secret
|
|
# age-keygen -o ~/.config/sops/age/keys.txt # creates the private key
|
|
# age-keygen -y ~/.config/sops/age/keys.txt # prints the public key
|
|
#
|
|
# Paste the printed `age1...` string in place of the placeholder.
|
|
# See docs/secrets-management.md for the full walkthrough.
|
|
|
|
keys:
|
|
# pragma: allowlist secret
|
|
# PLACEHOLDER — overwrite with your real age public key.
|
|
- &admin age1REPLACEME_run_age_keygen_y_then_paste_the_real_key_here
|
|
|
|
creation_rules:
|
|
- path_regex: secrets/.*\.yaml$
|
|
key_groups:
|
|
- age:
|
|
- *admin
|