feat: sops-nix secrets management

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

secrets/README.md

@@ -0,0 +1,37 @@
+# omni secrets (sops-nix)
+
+Encrypted YAML files in this directory are decrypted at NixOS
+activation time and exposed under `/run/secrets/<name>` for the
+services that declare `sops.secrets.<name>` to consume.
+
+Recipients are declared in `../.sops.yaml`. On omni/bohm the
+matching private key lives at `~/.config/sops/age/keys.txt`.
+
+## Workflow
+
+```bash
+# First-time: create + encrypt the omni default file
+sops secrets/omni.yaml
+# adds the sops: metadata block and encrypts in place
+
+# Later edits go through sops (auto-decrypts, re-encrypts on save)
+sops secrets/omni.yaml
+```
+
+## First migration targets
+
+See `../modules/mcp.nix` for the current plaintext-file references
+that should move under sops:
+
+- `forgejo-token` — Forgejo personal access token (forgejo-mcp)
+- `lnbits-admin-key` — LNbits admin API key (lnbits-mcp)
+
+Once `secrets/omni.yaml` exists and is encrypted, declare each in
+the consuming module:
+
+```nix
+sops.secrets.forgejo-token = { mode = "0400"; owner = config.omni.user; };
+```
+
+and switch the path reference (e.g. `forgejoTokenFile`) to
+`config.sops.secrets.forgejo-token.path`.

secrets/omni.yaml.example

@@ -0,0 +1,12 @@
+# Template secrets file. Copy to secrets/omni.yaml, then encrypt in
+# place with sops (uses the recipient in ../.sops.yaml):
+#
+#   cp secrets/omni.yaml.example secrets/omni.yaml
+#   sops secrets/omni.yaml
+#
+# modules/secrets.nix only activates sops when omni.secrets.enable is
+# set AND this file exists, so the config evaluates fine without it.
+# Keys below are examples the modules consume — adjust to taste.
+forgejo-token: REPLACE_ME
+lnbits-admin-key: REPLACE_ME
+nextcloud-password: REPLACE_ME