fixed import for laptop

.sops.yaml

@@ -0,0 +1,9 @@
+keys:
+  - &john-p14s age1f6drjusg866yscj8029tk4yfpgecklrvezldm02ankm6h8nnwu5s2u6ahy
+  - &john-pc age1ykcs39e62pz3xu6cedg8ea685kv5d5qsrhgkndygzm8rx30xd5ys5t3qxt
+creation_rules:
+  - path_regex: secrets.yaml$
+    key_groups:
+    - age:
+      - *john-p14s
+      - *john-pc

flake.nix

@@ -12,6 +12,10 @@
       url = "github:nix-community/nixGL";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    sops-nix = {
+      url = "github:Mic92/sops-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs = { self, nixpkgs, ... }@inputs:
@@ -30,7 +34,7 @@
       };
 
       mkhomeManagerModules = config: [
-        self.homeManagerModules.default
+        (self.homeManagerModules.default inputs)
         # { inherit (config) extraImports; }
         {
           user = config.user;
@@ -48,7 +52,9 @@
     {
       lib = { inherit mkhomeManagerModules; };
 
-      homeManagerModules.default = { ... }: { imports = [ ./homeManagerModules ]; };
+      homeManagerModules.default = inputs: { 
+        imports = [ ./homeManagerModules ]; 
+      };
 
       nixosModules.default = { config, ... }: {
         imports = [

homeManagerModules/default.nix

@@ -6,6 +6,7 @@
     ./ghostty.nix
     ./git.nix
     ./shell.nix
+    ./sops.nix
     ./ssh.nix
     ./vscode.nix
 
@@ -52,7 +53,7 @@
     lazygit
     btop
     yazi
-    sops
+    uv
     (writeShellScriptBin "nhmu" ''
       nix flake update --flake ~/.config/home-manager
       nix run home-manager -- switch --flake ~/.config/home-manager --impure

homeManagerModules/restic/flake.nix

@@ -0,0 +1,46 @@
+{
+  description = "Flake packaging resticprofile with a Home Manager module for programs.resticprofile";
+
+  inputs = {
+    nixpkgs.url = "nixpkgs/nixos-unstable";  # Use latest Nixpkgs for Go package build
+    home-manager.url = "github:nix-community/home-manager";
+    home-manager.inputs.nixpkgs.follows = "nixpkgs";
+  };
+
+  outputs = { self, nixpkgs, home-manager }:
+    let
+      systems = [ "x86_64-linux" "aarch64-linux" ];
+      # Define a function to build the resticprofile package for a given system:
+      resticprofilePkg = { pkgs, lib, ... }:
+        pkgs.buildGoModule rec {
+          pname = "resticprofile";
+          version = "0.31.0";
+          src = pkgs.fetchFromGitHub {
+            owner = "creativeprojects";
+            repo  = "resticprofile";
+            rev   = "v${version}";
+            sha256 = "sha256-ezelvyroQG1EW3SU63OVHJ/T4qjN5DRllvPIXnei1Z4=";  # source tarball hash
+          };
+          vendorHash = "sha256-M9S6F/Csz7HnOq8PSWjpENKm1704kVx9zDts1ieraTE=";  # Correct vendor hash
+          goPackagePath = "github.com/creativeprojects/resticprofile";
+          doCheck = false;  # Disable tests due to sandboxed build environment
+          meta = with lib; {
+            description = "Configuration profiles manager and scheduler for restic backup";
+            homepage    = "https://creativeprojects.github.io/resticprofile/";
+            license     = licenses.gpl3Only;
+            maintainers = [ ];  # (Add yourself or skip)
+          };
+        };
+    in {
+      # Provide the package for all supported systems:
+      packages = nixpkgs.lib.genAttrs systems (system: 
+        let pkgs = import nixpkgs { inherit system; }; 
+        in { resticprofile = resticprofilePkg { inherit pkgs; lib = pkgs.lib; }; }
+      );
+
+      # Provide the Home Manager module
+      homeManagerModules = {
+        resticprofile = ./resticprofile.nix;
+      };
+    };
+}

homeManagerModules/restic/profiles/base.nix

@@ -0,0 +1,38 @@
+{ lib, config, ... }:
+{
+  base = {
+    repository = "local:/mnt/backup";
+    password-file = "${config.xdg.configHome}/resticprofile/password.txt";
+    status-file = "{{ .ConfigDir }}/backup-status.json";
+    retention = {
+      after-backup = true;
+      keep-last = "10";
+      keep-hourly = "8";
+      keep-daily = "14";
+      keep-weekly = "8";
+    };
+    backup = {
+      verbose = true;
+      exclude = [
+        ".vscode-server"
+        ".cache"
+        ".venv"
+        ".pyenv"
+        "data/postgres"
+        "build"
+        "__pycache__"
+        "*.log"
+        "*.egg-info"
+        "*.csv"
+        "*.m4a"
+      ];
+      schedule-permission = "user";
+      schedule-priority = "background";
+      check-after = true;
+    };
+    prune = {
+      schedule-permission = "user";
+      schedule-lock-wait = "1h";
+    };
+  };
+}

homeManagerModules/restic/resticprofile.nix

@@ -0,0 +1,68 @@
+{ config, lib, pkgs, ... }:
+
+let
+  inherit (lib) mkEnableOption mkOption mkPackageOption mkIf types;
+  cfg = config.programs.resticprofile;
+  yamlFormat = pkgs.formats.yaml { };
+  baseProfile = import ./profiles/base.nix { inherit lib config; };
+  profiles = lib.recursiveUpdate baseProfile cfg.profiles;
+in {
+  options.programs.resticprofile = {
+    enable = mkEnableOption "Enable resticprofile (Restic backup profile manager)";
+
+    package = mkPackageOption pkgs "resticprofile" { };
+
+    # Multiple configuration files support
+    profiles = mkOption {
+      type = types.attrsOf yamlFormat.type;
+      default = { };
+      description = ''
+        Multiple configuration files for resticprofile. Each attribute name
+        becomes a YAML file under `$XDG_CONFIG_HOME/resticprofile/`.
+      '';
+      example = {
+        common = {
+          repository = "local:/backup";
+          passwordFile = "password.txt";
+          includes = [ "common.yaml" ];
+          backup = {
+            source = [ "/home/user/Documents" ];
+            schedule = "12:30";
+          };
+          forget = {
+            keep-daily = 7;
+            keep-weekly = 4;
+            keep-monthly = 6;
+          };
+        };
+      };
+    };
+  };
+
+  config = mkIf cfg.enable (
+    let
+      resticprofileCmd = ''
+        ${cfg.package}/bin/resticprofile --config "${config.xdg.configHome}/resticprofile/profiles.yaml"
+      '';
+    in {
+      # Add a script to manually unschedule and reschedule all resticprofiles
+      home.packages = [
+        cfg.package
+        (pkgs.writeShellScriptBin "rp" ''
+          set -e
+          sudo ${cfg.package}/bin/resticprofile --config "${config.xdg.configHome}/resticprofile/profiles.yaml" $@
+        '')
+        (pkgs.writeShellScriptBin "rps" ''
+          set -e
+          rp unschedule --all
+          rp schedule --all
+        '')
+        (pkgs.writeShellScriptBin "rp-test" "rp run-schedule backup@default --dry-run")
+      ];
+      xdg.configFile."resticprofile/profiles.yaml".source = yamlFormat.generate "profiles" {
+        version = "2";
+        profiles = profiles;
+      };
+    }
+  );
+}

homeManagerModules/sops.nix

@@ -0,0 +1,24 @@
+{ inputs, config, pkgs, lib, ... }:
+let
+  sopsConfigPath = "${config.home.homeDirectory}/.config/home-manager/jsl-home/.sops.yaml";
+  sopsSecretsPath = "${config.home.homeDirectory}/.config/home-manager/jsl-home/keys/secrets.yaml";
+in
+{
+  imports = [
+    inputs.sops-nix.homeManagerModules.sops
+  ];
+  sops = {
+    # It's also possible to use a ssh key, but only when it has no password:
+    age.sshKeyPaths = [ "${config.home.homeDirectory}/.ssh/id_ed25519" ];
+    defaultSopsFile = ../keys/secrets.yaml;
+    defaultSopsFormat = "yaml";
+  };
+  home.packages = with pkgs; [
+    (writeShellScriptBin "edit-secrets" ''
+      sops --config ${sopsConfigPath} ${sopsSecretsPath}
+    '')
+    sops
+    age
+  ];
+  programs.zsh.shellAliases.sops = lib.mkIf config.enableShell "sops --config ${sopsConfigPath}";
+}

homeManagerModules/ssh.nix

@@ -8,6 +8,14 @@
     '';
     matchBlocks = lib.mkMerge [
       (lib.mkIf (config.profile == "personal") {
+        "ad-nix" = {
+          hostname = "192.168.1.201";
+          user = "appdaemon";
+        };
+        "docs" = {
+          hostname = "192.168.1.110";
+          user = "root";
+        };
         "panoptes" = {
           hostname = "192.168.1.107";
           user = "panoptes";

keys/secrets.yaml

@@ -0,0 +1,36 @@
+restic_password:
+    john_ubuntu: ENC[AES256_GCM,data:Q4lUaFFDgoK9k4kQj7hSVKaFDGW0T+6V+OpFU5R528R3EKM7YJMgcFX+sK3mWl9XA4/6E1GeINpIqOpx+FP5Cf/8qt9sXBXCmXXSYdA4IH3RS6a1NkcIVjsTMvpn4q/fslCeYN4LB+r4pBGmdca105miqVun8J69cZGwjZ+wuxrMAP+mdnHdSUPycjNWJJzmEa3waQsygAi4A5cAN5sigOPBxe2pCTh/FEKoTgWmzHGJvcjrzuL6wNOpQrkMWwTsHCtbe9dyMP/fQpoBgYDT4W9Rd4XHhbrooje+g3x48EL1rkRIVVNRavpRUih/mjcdJGzzJ6jZmLLcc1f7SZIKZht7f+ZcdZl3rKQB+WanZgK/KAgKBRCrbIk2eeBZwkcRSw5kmGFU7x0azdIipJYj+3KHHQS5S2VW4j2tQG74xK3qaNJcSMjpKmdI1dHcPf0x2ILaDDV9Ts0H4GTOB2zO9iGy7x2tdPd4tugxxk5rr5rphTZL3lgUf0Ri/qMkJh9I8CsjUdvRycHeIEUZPmEVaIqJC2jrd2pBslis5VWD/6PHQBCob07d1fcpIYox4YXM3GcLg3OxiD8nZ7DTzGRMhciZtTKKWbBT8qzPud4ZQvDkT5l+XOpeM13wXFIMa13CwOzYeyWjycED0VQ/i3XRw9+9lg3cosfxaPdaFtv4MjV7Od62G/UJw3OxaQOHM2y24N+Q0pSBoTdDAFwDCH/kcqZji6ZrVTu4Rad8opcILJJcqC+pjegDvBtUdDz+G3/dFiS6m8RYIRb7qB5yEX/lCgzlECmRS2XP8uraNJ5NN8rtk0gdBtaI9/78YyAjLLGkjIcIR4uJA5buCZBR9jIdqf4f52fowbx18VPrwFXN2mYX6mPsKbDmaz0ILHq/I9n8bS/KM7gIQmTw/RAUwnmL4IRu8zHn6nmIqj6d8AkjYx7s6pG8OF8LgfhqZT7tdPKCd+n/HnYn1fZGSw26zHzPd4nKnVV1e3NYvX6CVwVycerGs9elOKtOI8GsrWYyXzJbfC+nWxbHKI/t6sxyzTBrHPR4r6l/CchQF+SfBs5aELKExe7h325qBB2y6EFdkbxTj1tPGqxttp9xJB1LUyNtwsEAkpD44JNqPxZCYHQbeVE3Oo3TYtRUSVWREc1WNIsfSG/anScYUhDEah9YyIdiG+O71QqegunusLoxmpF2rQtx7shtAvJV3skDBB0tFDoQyIV+yPo7kPV0D7Ig+Ba+mk5ASJrT9DXZ53Q2CCTLAuslU4MP7g22RX8rU3s2hFJq8m7wvMwpqa9Tr6O38i1wX4PhG1VRMM8EIlMQnLWWKmni6NbOYiRxFYJMioxH5SyE4ODQYXy5YIuLoRsX8VR6UqJ1GZb7sJf3M1aPOFOHzTN9hnziTRRe1KCMoBrAghrqhvL1VRr9X5PYMxnjBh6o0d5YTN0WOGD2iEVbCzqxFXcxQZBBp4KyNAAhFhGNw8WUp/rVoyCYn7+OEYFspY4FmGMTYhvxbq5LEptXeQgOP2ggBkqsw8sYP9oj1cb4kzBNv8M7nR9kM1EqvZpFV47phoTbBeMY4DZOJodkASFVM5/7ijWy/M9rtWMFMCXKURKkAQJRFADs0KqMJ5osnFFnubX7vKgK736XXF4+wIQuuHqEsYDZ90ftInxq8sYRnb2FZ0EV4yc8qqnz++fjwrAA5EV+zhL6l6hum1zL8JkUJ1ICKZ905If6nIeoul8MY3B1Cz4W+osN2Wtl8OeJ2t3iZx3wk/unVa8uDZH1owu47He68e2V8vpYxOaW4/hLyy/XuL5DukETrhRjC+7GbEaKaCwoA2UwAdqU,iv:N8ek+tp16WiZgjTDxXb0CRXH+MbLsl/oZ/OwcOoVRO0=,tag:uIzCSX0R/EObF/RdWxj64w==,type:str]
+hello: ENC[AES256_GCM,data:g/YDwjNQLs4pFRzFO3nwcbmeJd6tMLNNhhnSsAFyOQ8U8yjjUoCReDvrqpqBXIP1T9B80qyBVzxBY2bAYg==,iv:YdiJdG1ZjA95DGArtfaF1E8LomqW6oHCLmoSLQvwP+k=,tag:/ipWczAvhcjw5Jv7nvMF8A==,type:str]
+example_key: ENC[AES256_GCM,data:cLLYEiJbKg60ANK/h+kG,iv:1yrJt5JhbDP/9/Wb2l93fjwQF1hxERnxjPZ6qF4S/Bw=,tag:wbboaGylFJRSj4/TB+RCZg==,type:str]
+#ENC[AES256_GCM,data:c0Ay18GCW/gowNHmF67TMg==,iv:T+FN8xaVilVSETMQztl6lmpLqnGiyrXhJvWsO+dBdd0=,tag:1D6TkngB116dOeCAX85djg==,type:comment]
+example_array:
+    - ENC[AES256_GCM,data:yUJ7p5VfyQUANjbuz48=,iv:XTGb97tMV3mkPwNyKetSflLLlE31g9UgMPcelMPpNZ0=,tag:j5muB72Ogc/gtenvsWvpbQ==,type:str]
+    - ENC[AES256_GCM,data:8eQ2clCNBxPfdycPMOo=,iv:C9iT+wJH9ENJShNYo3IGceRwHyrlU6LUE7jpc+72KOw=,tag:YTbZqYJVMUoTRqD2ujTOvg==,type:str]
+example_number: ENC[AES256_GCM,data:LhABh/RtBsdKAg==,iv:JGYFnixDNZUIRKJcuaenvO8D60T+Jvx/R7SWxbIPXsM=,tag:+1b/aj3x1yfQZ2j4OM5dcg==,type:float]
+example_booleans:
+    - ENC[AES256_GCM,data:pGnelw==,iv:KAayJZ8px4Qupv0NfapSQ6valrVKndEtCb3U4MTmK/U=,tag:lkl+zBgkEMbFQjNssxYQjg==,type:bool]
+    - ENC[AES256_GCM,data:Vqqfp2w=,iv:SC1DS7G9/lHYtA6PPRbVsi/ZhyNUYvRjXxHIqCxqEPA=,tag:9hv6F1rP7xSd08KCKkuiLQ==,type:bool]
+sops:
+    age:
+        - recipient: age1f6drjusg866yscj8029tk4yfpgecklrvezldm02ankm6h8nnwu5s2u6ahy
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoWkxDSnlNT2Vua1ZXWC8r
+            SU9UMnhaVXVEVlZGL3dtYTBJSzNGbHVaSTJNCm9ZTFM3RndpRktUcWhwZk1Fc2dk
+            ZGtoWXdoOWVyK1F0YStSS3dsMkg2R28KLS0tIFkrdVFZNlVxRjhPaWdMZXl2elV3
+            TVpyTzFsNFNmd3FNU0tlMnlTOHNTQWsKfKdN4epZokF74bCNr9+jxulZJFBQM83P
+            quMhl+H85My8jAsEeC9CW7y2jdNPJkfk9gHun4ozoW8U7o6y5RLfJg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1ykcs39e62pz3xu6cedg8ea685kv5d5qsrhgkndygzm8rx30xd5ys5t3qxt
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSakZRUnkraWtId2h3eUhB
+            REpkUHhYMm1MSmtFU2pvd1BpQ0xRTTlCWkZJCkxrTm1sdDBqclJ3RHR6VkllOFpo
+            ZXRtS2lsazRDS2lyRnZmT3FTTjJ6WUUKLS0tIExxNlFoeDhHQ3l5a1VvUHNRWUdw
+            Mms2UEhFSU82UWR5Z1VvU25qenJUQm8KtQeZDIfJIczm1l8ql/WmVEf8KI9dg0vw
+            9rNSjtBkEttVd21zUSOziG4513abllE8NFTkAc1z3HacuXpHTBnd5A==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-07-29T00:12:59Z"
+    mac: ENC[AES256_GCM,data:5dQiEDyfeIYJt/l1wWH8y5cQm7+PqnUDwezCmyP7nvXs0z1lupYOHV62L5hqeQb7AELi4TriOokra4XdhHfr/QnI9capnYV6qTQrfvBE0EKsUQlxTmE6EnnTQuOWQy1iL8XgM3toEIH2mW2QNwme9k3fF/gGA8bL9t0+OEYGasU=,iv:kVDSFTHQG95rDfkp8sWJnxRQ5Wd9BjfPEzmuMm+alY0=,tag:3KFmBgW6pEEBFkOa14brDw==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.10.2