Padreug
0224279b61
Secrets were implicitly active whenever secrets/omnixy.yaml existed. Gate them behind an explicit omnixy.secrets.enable (default false) so a fresh fork builds and runs with zero secret setup, and derive age.keyFile from omnixy.user instead of hardcoding padreug. bohm sets the flag in its host. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
29 lines
1 KiB
Nix
29 lines
1 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
# sops-nix per-host wiring.
|
|
#
|
|
# The sops-nix module itself is injected by lib/mksystem.nix. This
|
|
# file points sops at the omni default file and the host's age
|
|
# key. Secrets are exposed to services as files under
|
|
# /run/secrets/<name>, declared per-secret via `sops.secrets.<name>`
|
|
# in the module that consumes them.
|
|
#
|
|
# Recipients live in /etc/nixos/.sops.yaml; the matching age key
|
|
# lives at ~/.config/sops/age/keys.txt on the host's primary user.
|
|
#
|
|
# Activation is doubly guarded: `omni.secrets.enable` (explicit opt-in,
|
|
# default false) AND the encrypted file actually existing. A fork that
|
|
# wants no secrets leaves the flag off and never touches sops; one that
|
|
# enables it but hasn't created secrets/omni.yaml yet still evaluates.
|
|
|
|
let
|
|
cfg = config.omni;
|
|
sopsFile = ../secrets/omni.yaml;
|
|
in
|
|
{
|
|
sops = lib.mkIf (cfg.secrets.enable && builtins.pathExists sopsFile) {
|
|
defaultSopsFile = sopsFile;
|
|
defaultSopsFormat = "yaml";
|
|
age.keyFile = "/home/${cfg.user}/.config/sops/age/keys.txt";
|
|
};
|
|
}
|