separated programs directory

2026-03-08 13:31:33 -05:00
parent f7735089df
commit b96b9b2409
17 changed files with 17 additions and 43 deletions
--- a/modules/home-manager/programs/sops.nix
+++ b/modules/home-manager/programs/sops.nix
@@ -0,0 +1,82 @@
+{ inputs, ... }:
+let
+  inputs' = inputs;  # save a reference before it's shadowed
+in
+{
+  flake-file.inputs = {
+    # Adding sops-nix to the flake-file inputs causes it to get added to the inputs in flake.nix when it gets generated.
+    # This also makes the sops-nix module available
+    sops-nix.url = "github:Mic92/sops-nix";
+    sops-nix.inputs.nixpkgs.follows = "nixpkgs";
+  };
+  
+  # Define the homeModules that are used by flake-parts
+  # https://flake.parts/options/home-manager.html#opt-flake.homeModules
+  flake.homeModules.sops = { inputs, config, pkgs, lib, ... }:
+  let
+    sopsBin = lib.getExe pkgs.sops;
+    sopsConfigPath = ../../../.sops.yaml;
+    sopsSecretsPath = ../../../keys/secrets.yaml;
+    ageKeyFile = "${config.xdg.configHome}/sops/age/keys.txt";
+  in
+  {
+    home.packages = with pkgs; [
+      eza
+      age
+      sops # This is necessary to make the sops binary available
+      ssh-to-age
+      (writeShellScriptBin "gen-age-key" ''
+        ${lib.getExe pkgs.ssh-to-age} -i ${config.ssh.IdentityFile} -private-key > ${ageKeyFile}
+        echo -n "Created ${ageKeyFile}: "
+        echo $(show-age-key)
+      '')
+      (writeShellScriptBin "show-age-key" "exec ${lib.getExe' pkgs.age "age-keygen"} -y ${ageKeyFile}")
+      (writeShellScriptBin "edit-secrets" "exec ${sopsBin} --config ${sopsConfigPath} ${sopsSecretsPath}")
+      (writeShellScriptBin "ls-secrets" "exec ${lib.getExe pkgs.eza} -alT --follow-symlinks ~/.config/sops-nix/secrets")
+    ];
+
+    programs.zsh.shellAliases.sops = "exec ${sopsBin} --config ${sopsConfigPath}";
+
+    imports = [
+      # This import makes the sops config attribute available below
+      inputs'.sops-nix.homeManagerModules.sops
+    ];
+
+    home.sessionVariables = {
+      GMAIL_CREDS_PATH = "${config.xdg.configHome}/sops-nix/gmail_api_credentials.json";
+    };
+
+    # Option definitions for the sops home-manager module:
+    # https://github.com/Mic92/sops-nix/blob/master/modules/home-manager/sops.nix
+    sops = {
+      defaultSopsFile = "${sopsSecretsPath}";
+      defaultSopsFormat = "yaml";
+
+      # Not sure any of these are necessary
+      # age.sshKeyPaths = [ "${config.sshIdentityFile}" ];
+      # age.keyFile = "${ageKeyFile}";
+      # age.generateKey = true;
+
+      # secrets."api/gmail_client_secret" = {
+      #   path = "${config.xdg.configHome}/resticprofile/dendrite.txt";
+      # };
+      
+      templates."gmail_creds" = {
+        path = "${config.xdg.configHome}/sops-nix/gmail_api_credentials.json";
+        content = ''
+          {
+              "installed": {
+                  "client_id": "499012320469-vtml6emu6bmujpsj9lud2b44jqu7h26j.apps.googleusercontent.com",
+                  "project_id": "python-apis-423500",
+                  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
+                  "token_uri": "https://oauth2.googleapis.com/token",
+                  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
+                  "client_secret": "${config.sops.placeholder."api/gmail_client_secret"}",
+                  "redirect_uris": [ "http://localhost" ]
+              }
+          }
+        '';
+      };
+    };
+  };
+}