Padreug
7af3bce544
Wires sops-nix as a flake input and bakes the NixOS module into
configuration.nix via modules/secrets.nix. Per-host defaults live in
modules/secrets.nix:
- defaultSopsFile = ../secrets/${settings.hostName}.yaml
- defaultSopsFormat = yaml
- age.keyFile = /home/${settings.user}/.config/sops/age/keys.txt
The whole sops block is gated on `builtins.pathExists` so flake eval
succeeds before the encrypted file is created — important during the
scaffold-bootstrap phase where the consumer hasn't yet generated an
age key.
Adds .sops.yaml with a placeholder admin recipient (overwrite with
your real age public key before encrypting anything) and a
creation_rules block matching `secrets/*.yaml`.
.gitignore loosened so `secrets/*.yaml` and `secrets/README.md` can
be checked in while plaintext key material (`*.key`, `*.pem`) and
anything else under `secrets/` stays ignored. The pre-commit secret
scanner most consumers use is the second line of defense.
secrets/README.md documents the workflow at the directory level.
The substantive beginner walkthrough lands in a follow-up commit at
docs/secrets-management.md.
`nix flake check --no-build` stays green.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
65 lines
1.6 KiB
Nix
65 lines
1.6 KiB
Nix
# lnbits-sensei — NixOS entry point.
|
|
#
|
|
# Thin by design. All real config lives in modules/. This file imports
|
|
# the module set and wires per-host settings (hostname, timezone) from
|
|
# the shared `settings` attrset.
|
|
{
|
|
config,
|
|
pkgs,
|
|
lib,
|
|
settings,
|
|
...
|
|
}:
|
|
|
|
{
|
|
imports = [
|
|
# Ships as a placeholder (unbootable values) so `nix flake check`
|
|
# evaluates cleanly. Overwrite with `nixos-generate-config` output
|
|
# before the first real `nixos-rebuild switch`.
|
|
./hardware-configuration.nix
|
|
|
|
# Shared helpers (config.lnbits-sensei.lib).
|
|
./modules/lib.nix
|
|
|
|
# Option schema (lnbits-sensei.*).
|
|
./modules/core.nix
|
|
|
|
# sops-nix wiring. Inert until secrets/<hostName>.yaml exists.
|
|
./modules/secrets.nix
|
|
|
|
# Git remote topology — upstream / fork / extras.
|
|
./modules/git/remotes.nix
|
|
|
|
# Dev environment (worktree mgmt, regtest stack, dev CLI, tmux).
|
|
./modules/dev-env
|
|
];
|
|
|
|
# --- Per-host settings ---
|
|
|
|
lnbits-sensei = {
|
|
enable = true;
|
|
user = settings.user;
|
|
hostName = settings.hostName;
|
|
};
|
|
|
|
networking.hostName = settings.hostName;
|
|
time.timeZone = settings.timeZone;
|
|
|
|
# Primary user. Group declared explicitly per NixOS warning about
|
|
# implicit `nogroup` defaults. Consumer extends extraGroups as needed.
|
|
users.users.${settings.user} = {
|
|
isNormalUser = true;
|
|
group = settings.user;
|
|
extraGroups = [ "wheel" ];
|
|
};
|
|
users.groups.${settings.user} = { };
|
|
|
|
nix.settings.experimental-features = [
|
|
"nix-command"
|
|
"flakes"
|
|
];
|
|
|
|
# Pin the state version that matches the nixpkgs input. Bump
|
|
# deliberately after reviewing release notes — never auto.
|
|
system.stateVersion = "24.11";
|
|
}
|