trying out sops-nix for secrets management

documented here: https://github.com/Mic92/sops-nix?tab=readme-ov-file

6 files changed, 113 insertions, 1 deletions

diff --git a/.sops.yaml b/.sops.yaml
new file mode 100644
index 0000000..201bcc5
--- /dev/null
+++ b/.sops.yaml
@@ -0,0 +1,21 @@
+# https://github.com/Mic92/sops-nix?tab=readme-ov-file#generate-a-key-for-yourself
+keys:
+  - &defin_zenbook age1elwua27zpyazka2l2k3djq7nc0dsclvhd8yknc07u3uqj0hnkfasmmfz6w
+  - &root_zenbook age1yxfe6zpmxckth5dzp0emzfjrrxhjs7h6x33ally8ka4sxawqw9zqkkxpgm
+  - &server_biski age1k38l2drejmpr9dd24zy0dglzny0703yxg8ff29q2yyjlmmpu7g6q60hz4x
+creation_rules:
+  - path_regex: secrets/[^/]+\.(yaml|json|env|ini)$
+    key_groups:
+      - age:
+          - *defin_zenbook
+          - *server_biski
+          - *root_zenbook
+        # pgp:
+        #   - *insert_here
+  - path_regex: secrets/biski/[^/]+\.(yaml|json|env|ini)$
+    key_groups:
+      - age:
+          - *defin_zenbook
+          - *server_biski
+      # pgp:
+      #   - *insert_here
diff --git a/flake.nix b/flake.nix
index f421e00..2100ba8 100644
--- a/flake.nix
+++ b/flake.nix
@@ -308,6 +308,9 @@
         ./modules/nixos/system-packages.nix
         ./modules/nixos/tailscale.nix
 
+        sops-nix.nixosModules.sops
+        ./modules/nixos/sops.nix
+
         ./modules/users/defin.nix
         ./modules/users/root.nix
           # # Let 'nixos-version --json' know the Git revision of this flake. (for containers?)
@@ -343,7 +346,6 @@
         khad = lib.nixosSystem { # Main desktop
           modules = minimalModuleConfig ++ [ ./machines/khad
             # lix-module.nixosModules.default
-            sops-nix.nixosModules.sops
             home-manager.nixosModules.home-manager { home-manager.users.defin = import ./home-manager/gaming.nix; }
           ];
         };
diff --git a/modules/nixos/sops.nix b/modules/nixos/sops.nix
new file mode 100644
index 0000000..41e828e
--- /dev/null
+++ b/modules/nixos/sops.nix
@@ -0,0 +1,15 @@
+{config, ... }: {
+  # This will add secrets.yml to the nix store
+  # You can avoid this by adding a string to the full path instead, i.e.
+  # sops.defaultSopsFile = "/root/.sops/secrets/example.yaml";
+  sops.defaultSopsFile = ../../secrets/example.yaml;
+  # This will automatically import SSH keys as age keys
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+  # This is using an age key that is expected to already be in the filesystem
+  sops.age.keyFile = "/var/lib/sops-nix/key.txt";
+  # This will generate a new key if the key specified above does not exist
+  sops.age.generateKey = true;
+  # This is the actual specification of the secrets.
+  # sops.secrets.example-key = {};
+  # sops.secrets.example_array = {};
+}
diff --git a/modules/nixos/system-packages.nix b/modules/nixos/system-packages.nix
index 6430915..b29388b 100644
--- a/modules/nixos/system-packages.nix
+++ b/modules/nixos/system-packages.nix
@@ -3,7 +3,9 @@
   environment.systemPackages = with pkgs; [
     #For root
     age
+    sops
     nix-tree
+    ssh-to-age
     nushell
     bat
     # helix
diff --git a/secrets/biski/api.yaml b/secrets/biski/api.yaml
new file mode 100644
index 0000000..caae5b7
--- /dev/null
+++ b/secrets/biski/api.yaml
@@ -0,0 +1,28 @@
+porkbun:
+    api:
+        secret: ENC[AES256_GCM,data:FH1VvwBOJRr77WV8/1Q7/ad2zSIAEZc9eJC5JMXNbUzg1gVXsfOvd1dH8Lk5ftsmbaIRROukZoX45KVZK6RDcf8UzqE=,iv:8ylwfaSp78ffGQtuyUCr9J2H4A+cugQqpsTCitTyu8M=,tag:kxEyPmYZMvkzKYoIyduBNA==,type:str]
+        api_key: ENC[AES256_GCM,data:52HK2eKMvxC0abGN1A03yDaNKzQ5f+6vfsP33wqO4T8pW99sVzkM//tZ2Je0meNs2xeyYpAVXjIZDZSVuma55pw+TRY=,iv:GfeIyftzgBCUD8ervmFnp6sg6Jh3oTSveZVcu1xoGLk=,tag:1twFOpl/Qrlewphxl8AQ1A==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmMkpmTjNmaHZxaXZJUmta
+            WlYrOTZ2YlpMV0thbnJseHMrYm1nSm90QlZzCjErd0JydFRaSE1DMEJKK1FaN0R5
+            cWoza2dVV0RiRm1FQnZubGI2Q1BBRmMKLS0tIGpEV3dPc1ZNaW9pQlpaZEdyUTFI
+            V2dSc1lzbGo4NWlXSHROQnpYUVVWM3cK96NnR47/zh/zAjCcty9J9B27B9J2LFUF
+            zXU2+pk2tryJIsp5FVFmHd5gSKtDDxgQ3WddtbhujbqOCMTACnCfhw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1elwua27zpyazka2l2k3djq7nc0dsclvhd8yknc07u3uqj0hnkfasmmfz6w
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiQmIrcEREQTFTS2FoSVhr
+            b1FFRkVTRHpmZDNvSmdxZUZudm90c0VvU2dJCkN0MGxsYVpwbVlHNDNYaUZyNTV4
+            OWNnOVFYT1h1V2dhS0NoU0VUV1hqVE0KLS0tIHp3QkpMZ0w4QStpQnZJS1h4U1Rk
+            SHlkZmdGL09mK0dpOE9HcFBPcmR2V0UKRZvKwe7VXv1vl0wJ3ORyEcZtiZOlWQkI
+            7JwzL+SjWbB17oHEhjQ9Boide6aznwYT0rkUWCjZaOu9QsqWsrB+VQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1k38l2drejmpr9dd24zy0dglzny0703yxg8ff29q2yyjlmmpu7g6q60hz4x
+    lastmodified: "2026-09-04T09:34:44Z"
+    mac: ENC[AES256_GCM,data:i7KKPzBkoaN5/c7gf4IFVQgjhM4ODUF/CCDupWW4cresNbaiYFZl+CUh6s9eht1mBseCKT7PtTSMogd4KV7c0p3d10hxRQPgqUEC2BplHD8bNRqb+jrjm3xtyy5WgntqVg7qi4WdUn1dD/q5jLW7/aaCI6aRTtsMcaEyVET8TTU=,iv:1mPNAQoxCwTC0D4N1+pBTdjeXXUIddDUA+b0Hpobng8=,tag:GZ0ZQ68XPmQsBikcU31rzg==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.3
diff --git a/secrets/example.yaml b/secrets/example.yaml
new file mode 100644
index 0000000..492c0dc
--- /dev/null
+++ b/secrets/example.yaml
@@ -0,0 +1,44 @@
+hello: ENC[AES256_GCM,data:TxSuMQ4JdDl2zjDXOgUpJLXltEzfTkyI3TE78dssxf9d2zUu5wclK0CS1tT6yQ==,iv:nMMJAAyZBr48v9b5bLcFgxaPkK1Nx7o9sTWbIBCAR2U=,tag:sBmWH18ya19eF9qvTRRX0w==,type:str]
+example_key: ENC[AES256_GCM,data:MfVINYFL1yKbLdH7Hg==,iv:G6787F+lwGTpfg9QQLLSu7FvGTVNp+btJADNTizpNXs=,tag:vIxSCMLDxeDbJFAp9Q0j+w==,type:str]
+#ENC[AES256_GCM,data:7/cjr5hO1GmlOmNPdcFK/A==,iv:9YtMaHUUhUsPbSrbc4MPVDodB6iZgotJ4u4X2hUqT+Q=,tag:VHBbaS69StjSywCTaY73gA==,type:comment]
+example_array:
+    - ENC[AES256_GCM,data:WSmXVvOS90gP6Svg/yU=,iv:AQqXt2R/0AtPzpVxHGfMBljxEQz/f7w1DLyMyhyFzv8=,tag:zDZH+n85toJhcBpLjxZdWg==,type:str]
+    - ENC[AES256_GCM,data:QIQuAGMC6hHonrmg7+I=,iv:K7wsLv2qlE3+d/GTElOu45wSMRfqNv4ZA8/fNQZhIHs=,tag:6/WJXqSLYRC+te7vAWuofQ==,type:str]
+    - ENC[AES256_GCM,data:UBGVYrK0H8PgB3iVdrE=,iv:aDnq0JAb0CCyjWbirOo+Hq52fn4AAaNudPuYab2jRwY=,tag:xI+6nNm/4vJt2xvysRK6Mw==,type:str]
+example_number: ENC[AES256_GCM,data:R7S5j/IgOY/u4A==,iv:yo3AyKMhkPsKl+hvZPBlK0CN2g646OFX0hOFD6JWt5A=,tag:4S2Uhvr+gD66yM8VtK+6dQ==,type:float]
+example_booleans:
+    - ENC[AES256_GCM,data:eNR8Jw==,iv:exL/Ga5Jdp44EGMsYnP0U0NohRY09m8BCrXZKgDTa4o=,tag:lDeNoSpdbU3JoTjE1a0qmg==,type:bool]
+    - ENC[AES256_GCM,data:WcVg9i8=,iv:vKEFlnk1d1dwVCuAnSqxNtdHW4aCRb1HqpxmL820n3Q=,tag:IEq9zGhH3Ghk0M510izUzA==,type:bool]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzeUZMbGc5SXVIcTFwREE4
+            N0hLdUZ2ZmoxdTh6S3VMT0F6ZEZlNHhuZWk0CnNIOUEycFdpVzZLMC9seXFLSEd0
+            WnJjWm9rWmU5VjJBMjEycThPTHFva1UKLS0tIElCMlRWQ0gvNnEwUTgzVUNHcDVq
+            elJvemdKejB0amIyTnpZR2dHK1liemsKnOPViyGNcJ+WU6U1nfPglGs/l/n6oUiz
+            Raa2Kixa4naTCnuSweQD0yiu/I9ZxRi3ytibvFLsQGRB9p8egLl+bw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1elwua27zpyazka2l2k3djq7nc0dsclvhd8yknc07u3uqj0hnkfasmmfz6w
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4aG1tZXpvZDNrNm1nY2o1
+            VEs2cEpMMHZwYUY1OSswN21QVTNiMGZycXh3CndZQUhGd2hqcm5jYWJrdXRERHNM
+            SjBUZVNhYkp1cW5GUTZLaEljMWFGVWcKLS0tIHd5RUpuTmhrdFZRNEd0bFl5VUtO
+            bk0ra2U1OVZkN01iZ1dkbXdwUnV3Z0EKheToYSNedDspJ2UKPq22+EHYsoH7JqiV
+            APq/wHPmVv5UtdB/xsWKaOY9tXMhEI8D+o7ROdOEWd8BMc6sdmleTA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1k38l2drejmpr9dd24zy0dglzny0703yxg8ff29q2yyjlmmpu7g6q60hz4x
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUTHhWQ3lPV0tNYk9NWW1v
+            ckh3TnBzMHUwRDlBQjNlT1RMRGpzZXV5dFN3Cm1FSkplZGcwa1NPdzdGa3FKMlJo
+            N0hRSjlYQWdGWHRnbVM3VVdRMCtTaUUKLS0tIC9RNUFMNlNYVitBM1dFdm44cGJ5
+            MVBTcHdOTkxBeWxVODlSaGtDZUtodVUKwLok7EHhzQwiZJgq88WQQQ1iZxYWphS+
+            XWJHk8uD3ipcOx079o8zhnFJ15E7MmBr81i9MHGy5cDnkaeI8TBJBA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1yxfe6zpmxckth5dzp0emzfjrrxhjs7h6x33ally8ka4sxawqw9zqkkxpgm
+    lastmodified: "2026-09-04T09:31:35Z"
+    mac: ENC[AES256_GCM,data:ba6NogjnL6zr9/3soWp4I/xDWh/+zqbZreWPN5kfPLNeDEVf46fsB7CEHXPtYl7K1KTuZwpfu17Zka2PBqL+IW/l8HiwY/y0tSaXdPZrc68YRnmSTot8CYKkfrIh27DJ0ueEHyTdJcfDsndQYWbGhgJ1rlpv2kTAtvNy/7OlEsM=,iv:P9lLDLWxug4xiid6qV+Sde7X4xIotQuVYFPi8mSolpU=,tag:Z/0A7FUCt1nrpLSnFna1Rg==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.3