Padreug
7af3bce544
Wires sops-nix as a flake input and bakes the NixOS module into
configuration.nix via modules/secrets.nix. Per-host defaults live in
modules/secrets.nix:
- defaultSopsFile = ../secrets/${settings.hostName}.yaml
- defaultSopsFormat = yaml
- age.keyFile = /home/${settings.user}/.config/sops/age/keys.txt
The whole sops block is gated on `builtins.pathExists` so flake eval
succeeds before the encrypted file is created — important during the
scaffold-bootstrap phase where the consumer hasn't yet generated an
age key.
Adds .sops.yaml with a placeholder admin recipient (overwrite with
your real age public key before encrypting anything) and a
creation_rules block matching `secrets/*.yaml`.
.gitignore loosened so `secrets/*.yaml` and `secrets/README.md` can
be checked in while plaintext key material (`*.key`, `*.pem`) and
anything else under `secrets/` stays ignored. The pre-commit secret
scanner most consumers use is the second line of defense.
secrets/README.md documents the workflow at the directory level.
The substantive beginner walkthrough lands in a follow-up commit at
docs/secrets-management.md.
`nix flake check --no-build` stays green.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
86 lines
2.1 KiB
JSON
86 lines
2.1 KiB
JSON
{
|
|
"nodes": {
|
|
"home-manager": {
|
|
"inputs": {
|
|
"nixpkgs": [
|
|
"nixpkgs"
|
|
]
|
|
},
|
|
"locked": {
|
|
"lastModified": 1779678629,
|
|
"narHash": "sha256-gHcIFg0mm+KFsg7iZQt67kni3+qR5U3PhEC9P7vKlZ4=",
|
|
"owner": "nix-community",
|
|
"repo": "home-manager",
|
|
"rev": "612bbe3b405ad5f71d7bf9edecc04b678a061652",
|
|
"type": "github"
|
|
},
|
|
"original": {
|
|
"owner": "nix-community",
|
|
"repo": "home-manager",
|
|
"type": "github"
|
|
}
|
|
},
|
|
"lnbits-src": {
|
|
"flake": false,
|
|
"locked": {
|
|
"lastModified": 1779693880,
|
|
"narHash": "sha256-Gp+Dwj+zxMS7HaNksazfygMIFrAwW1nyWlNvKnaUta8=",
|
|
"owner": "lnbits",
|
|
"repo": "lnbits",
|
|
"rev": "88672501d8dbb3a77e2ebb5dfc7878dc43adadbd",
|
|
"type": "github"
|
|
},
|
|
"original": {
|
|
"owner": "lnbits",
|
|
"repo": "lnbits",
|
|
"type": "github"
|
|
}
|
|
},
|
|
"nixpkgs": {
|
|
"locked": {
|
|
"lastModified": 1779508470,
|
|
"narHash": "sha256-Ap9KJX+5xHIn3bPIpfNgT6MEXdAECECwo4/rmlQD74M=",
|
|
"owner": "NixOS",
|
|
"repo": "nixpkgs",
|
|
"rev": "29916453413845e54a65b8a1cf996842300cd299",
|
|
"type": "github"
|
|
},
|
|
"original": {
|
|
"owner": "NixOS",
|
|
"ref": "nixos-unstable",
|
|
"repo": "nixpkgs",
|
|
"type": "github"
|
|
}
|
|
},
|
|
"root": {
|
|
"inputs": {
|
|
"home-manager": "home-manager",
|
|
"lnbits-src": "lnbits-src",
|
|
"nixpkgs": "nixpkgs",
|
|
"sops-nix": "sops-nix"
|
|
}
|
|
},
|
|
"sops-nix": {
|
|
"inputs": {
|
|
"nixpkgs": [
|
|
"nixpkgs"
|
|
]
|
|
},
|
|
"locked": {
|
|
"lastModified": 1777944972,
|
|
"narHash": "sha256-VfGRo1qTBKOe3s2gOv8LSoA6Fk19PvBlwQ1ECN0Evn8=",
|
|
"owner": "Mic92",
|
|
"repo": "sops-nix",
|
|
"rev": "c591bf665727040c6cc5cb409079acb22dcce33c",
|
|
"type": "github"
|
|
},
|
|
"original": {
|
|
"owner": "Mic92",
|
|
"repo": "sops-nix",
|
|
"type": "github"
|
|
}
|
|
}
|
|
},
|
|
"root": "root",
|
|
"version": 7
|
|
}
|