aiolabs/omnixient
9
0
Fork 0
Code Issues 5 Pull requests Projects Releases Packages Wiki Activity Actions

feat(secrets): make sops opt-in via omnixy.secrets.enable

Browse source 
Secrets were implicitly active whenever secrets/omnixy.yaml existed. Gate
them behind an explicit omnixy.secrets.enable (default false) so a fresh
fork builds and runs with zero secret setup, and derive age.keyFile from
omnixy.user instead of hardcoding padreug. bohm sets the flag in its host.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Padreug 2026-06-28 09:47:37 +02:00
commit 0224279b61
2 changed files with 15 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
modules/core.nix
View file

@ -73,6 +73,12 @@ in
description = "Path to wallpaper for automatic color generation"; description = "Path to wallpaper for automatic color generation";
}; };
# Secrets management (sops-nix). Opt-in: when false (default) the host
# carries no secrets and sops stays inert, so a fresh fork builds and
# runs with zero secret setup. Enable it AND provide secrets/omni.yaml
# (see secrets/omni.yaml.example + modules/secrets.nix) to activate.
secrets.enable = mkEnableOption "sops-nix age-encrypted secrets for this host";
# Feature Categories - Simple on/off switches for major functionality # Feature Categories - Simple on/off switches for major functionality
features = { features = {
# Development # Development

12
modules/secrets.nix
View file

@ -9,15 +9,21 @@
# in the module that consumes them. # in the module that consumes them.
# #
# Recipients live in /etc/nixos/.sops.yaml; the matching age key # Recipients live in /etc/nixos/.sops.yaml; the matching age key
# lives at ~/.config/sops/age/keys.txt on omni/bohm. # lives at ~/.config/sops/age/keys.txt on the host's primary user.
#
# Activation is doubly guarded: `omni.secrets.enable` (explicit opt-in,
# default false) AND the encrypted file actually existing. A fork that
# wants no secrets leaves the flag off and never touches sops; one that
# enables it but hasn't created secrets/omni.yaml yet still evaluates.
let let
cfg = config.omni;
sopsFile = ../secrets/omni.yaml; sopsFile = ../secrets/omni.yaml;
in in
{ {
sops = lib.mkIf (builtins.pathExists sopsFile) { sops = lib.mkIf (cfg.secrets.enable && builtins.pathExists sopsFile) {
defaultSopsFile = sopsFile; defaultSopsFile = sopsFile;
defaultSopsFormat = "yaml"; defaultSopsFormat = "yaml";
age.keyFile = "/home/padreug/.config/sops/age/keys.txt"; age.keyFile = "/home/${cfg.user}/.config/sops/age/keys.txt";
}; };
} }