aiolabs/omnixient
9
0
Fork 0
Code Issues 5 Pull requests Projects Releases Packages Wiki Activity Actions

feat(secrets): make sops opt-in via omnixy.secrets.enable

Browse source 
Secrets were implicitly active whenever secrets/omnixy.yaml existed. Gate
them behind an explicit omnixy.secrets.enable (default false) so a fresh
fork builds and runs with zero secret setup, and derive age.keyFile from
omnixy.user instead of hardcoding padreug. bohm sets the flag in its host.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Padreug 2026-06-28 09:47:37 +02:00
commit 0224279b61
2 changed files with 15 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

12
modules/secrets.nix
View file

@ -9,15 +9,21 @@
# in the module that consumes them.
#
# Recipients live in /etc/nixos/.sops.yaml; the matching age key
# lives at ~/.config/sops/age/keys.txt on omni/bohm.
# lives at ~/.config/sops/age/keys.txt on the host's primary user.
#
# Activation is doubly guarded: `omni.secrets.enable` (explicit opt-in,
# default false) AND the encrypted file actually existing. A fork that
# wants no secrets leaves the flag off and never touches sops; one that
# enables it but hasn't created secrets/omni.yaml yet still evaluates.
let
cfg = config.omni;
sopsFile = ../secrets/omni.yaml;
in
{
sops = lib.mkIf (builtins.pathExists sopsFile) {
sops = lib.mkIf (cfg.secrets.enable && builtins.pathExists sopsFile) {
defaultSopsFile = sopsFile;
defaultSopsFormat = "yaml";
age.keyFile = "/home/padreug/.config/sops/age/keys.txt";
age.keyFile = "/home/${cfg.user}/.config/sops/age/keys.txt";
};
}