dotfiles

 1## Secrets Management ##
 2{
 3  config,
 4  inputs,
 5  ...
 6}: let
 7  inherit (config) util;
 8  inherit (config.flake) files;
 9in {
10  flake.modules = {
11    # System-Wide Secrets
12    nixos.secrets = {
13      config,
14      pkgs,
15      ...
16    }: let
17      path = files.path.gpg;
18    in {
19      imports = [inputs.sops.nixosModules.sops];
20
21      config = {
22        environment = {
23          persist.directories = [path];
24          systemPackages = [pkgs.sops];
25        };
26
27        sops = {
28          gnupg.home = path;
29          secrets = let
30            directory = ./. + "/${config.networking.hostName}";
31          in
32            util.map.secrets {directory = ./.;}
33            // (
34              if (builtins.pathExists directory)
35              then util.map.secrets {inherit directory;}
36              else {}
37            );
38        };
39      };
40    };
41
42    # Per-User Secrets
43    homeManager.secrets = {config, ...}: {
44      imports = [inputs.sops.homeManagerModules.sops];
45      sops = {
46        gnupg.home = "${config.home.homeDirectory}/.gnupg";
47        secrets = let
48          directory = ./user + "/${config.home.username}";
49        in
50          if (builtins.pathExists directory)
51          then util.map.secrets {inherit directory;}
52          else {};
53      };
54    };
55  };
56}