modules/common/secrets.nix


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

{
  config,
  inputs,
  lib,
  pkgs,
  this,
  ...
}:
{
  imports = [
    inputs.agenix.nixosModules.default
    (lib.mkAliasOptionModule
      [ "secrets" ]
      [
        "age"
        "secrets"
      ]
    )
  ];

  config = {
    age.identityPaths =
      if this.isHeadful then
        [ "${config.my.home}/.ssh/${this.hostname}_ed25519" ]
      else
        config.services.openssh.hostKeys |> lib.filter (x: x.type == "ed25519") |> map (x: x.path);

    environment.systemPackages = with pkgs; [
      age
      agenix
    ];

    nixpkgs.overlays = [ inputs.agenix.overlays.default ];
  };
}