reorg

2026-03-11 08:49:07 -05:00
parent dac3b84ffb
commit cf2ba8731d
19 changed files with 56 additions and 9 deletions
--- a/modules/programs/sops.nix
+++ b/modules/programs/sops.nix
@@ -0,0 +1,80 @@
+{ inputs, ... }:
+let
+  inputs' = inputs;  # save a reference before it's shadowed
+in
+{
+  flake-file.inputs = {
+    # Adding sops-nix to the flake-file inputs causes it to get added to the inputs in flake.nix when it gets generated.
+    # This also makes the sops-nix module available
+    sops-nix.url = "github:Mic92/sops-nix";
+    sops-nix.inputs.nixpkgs.follows = "nixpkgs";
+  };
+  
+  # Define the homeModules that are used by flake-parts
+  # https://flake.parts/options/home-manager.html#opt-flake.modules.homeManager
+  flake.modules.homeManager.sops = { inputs, config, pkgs, lib, ... }:
+  let
+    sopsBin = lib.getExe pkgs.sops;
+    sopsConfigPath = ../../.sops.yaml;
+    sopsSecretsPath = ../../keys/secrets.yaml;
+    ageKeyFile = "${config.xdg.configHome}/sops/age/keys.txt";
+  in
+  {
+    home.packages = with pkgs; [
+      eza
+      age
+      sops # This is necessary to make the sops binary available
+      ssh-to-age
+      (writeShellScriptBin "gen-age-key" ''
+        ${lib.getExe pkgs.ssh-to-age} -i ${config.ssh.IdentityFile} -private-key > ${ageKeyFile}
+        echo -n "Created ${ageKeyFile}: "
+        echo $(show-age-key)
+      '')
+      (writeShellScriptBin "show-age-key" "${lib.getExe' pkgs.age "age-keygen"} -y ${ageKeyFile}")
+      (writeShellScriptBin "edit-secrets" "${sopsBin} --config ${sopsConfigPath} ${sopsSecretsPath}")
+      (writeShellScriptBin "ls-secrets" "${lib.getExe pkgs.eza} -alT --follow-symlinks ~/.config/sops-nix/secrets")
+    ];
+
+    home.shellAliases.sops = "${sopsBin} --config ${sopsConfigPath}";
+
+    imports = [
+      # This import makes the sops config attribute available below
+      inputs'.sops-nix.homeManagerModules.sops
+    ];
+
+    home.sessionVariables = {
+      GMAIL_CREDS_PATH = "${config.xdg.configHome}/sops-nix/gmail_api_credentials.json";
+    };
+
+    # Option definitions for the sops home-manager module:
+    # https://github.com/Mic92/sops-nix/blob/master/modules/home-manager/sops.nix
+    sops = {
+      defaultSopsFile = sopsSecretsPath;
+      defaultSopsFormat = "yaml";
+      age.sshKeyPaths = [ "${config.ssh.IdentityFile}" ];
+      # age.keyFile = "${ageKeyFile}";
+      # age.generateKey = true;
+
+      secrets."api/gmail_client_secret" = {
+        path = "${config.xdg.configHome}/resticprofile/dendrite.txt";
+      };
+
+      templates."gmail_creds" = {
+        path = "${config.xdg.configHome}/sops-nix/gmail_api_credentials.json";
+        content = ''
+          {
+              "installed": {
+                  "client_id": "499012320469-vtml6emu6bmujpsj9lud2b44jqu7h26j.apps.googleusercontent.com",
+                  "project_id": "python-apis-423500",
+                  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
+                  "token_uri": "https://oauth2.googleapis.com/token",
+                  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
+                  "client_secret": "${config.sops.placeholder."api/gmail_client_secret"}",
+                  "redirect_uris": [ "http://localhost" ]
+              }
+          }
+        '';
+      };
+    };
+  };
+}