aiolabs/omnixient
9
0
Fork 0
Code Issues 5 Pull requests Projects Releases Packages Wiki Activity Actions

feat(secrets): make sops opt-in via omnixy.secrets.enable

Browse source 
Secrets were implicitly active whenever secrets/omnixy.yaml existed. Gate
them behind an explicit omnixy.secrets.enable (default false) so a fresh
fork builds and runs with zero secret setup, and derive age.keyFile from
omnixy.user instead of hardcoding padreug. bohm sets the flag in its host.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Padreug 2026-06-28 09:47:37 +02:00
commit 0224279b61
2 changed files with 15 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
modules/core.nix
View file

@ -73,6 +73,12 @@ in
description = "Path to wallpaper for automatic color generation";
};
# Secrets management (sops-nix). Opt-in: when false (default) the host
# carries no secrets and sops stays inert, so a fresh fork builds and
# runs with zero secret setup. Enable it AND provide secrets/omni.yaml
# (see secrets/omni.yaml.example + modules/secrets.nix) to activate.
secrets.enable = mkEnableOption "sops-nix age-encrypted secrets for this host";
# Feature Categories - Simple on/off switches for major functionality
features = {
# Development