trying out sops-nix for secrets management

documented here: https://github.com/Mic92/sops-nix?tab=readme-ov-file

2 files changed, 72 insertions, 0 deletions

diff --git a/secrets/biski/api.yaml b/secrets/biski/api.yaml
new file mode 100644
index 0000000..caae5b7
--- /dev/null
+++ b/secrets/biski/api.yaml
@@ -0,0 +1,28 @@
+porkbun:
+    api:
+        secret: ENC[AES256_GCM,data:FH1VvwBOJRr77WV8/1Q7/ad2zSIAEZc9eJC5JMXNbUzg1gVXsfOvd1dH8Lk5ftsmbaIRROukZoX45KVZK6RDcf8UzqE=,iv:8ylwfaSp78ffGQtuyUCr9J2H4A+cugQqpsTCitTyu8M=,tag:kxEyPmYZMvkzKYoIyduBNA==,type:str]
+        api_key: ENC[AES256_GCM,data:52HK2eKMvxC0abGN1A03yDaNKzQ5f+6vfsP33wqO4T8pW99sVzkM//tZ2Je0meNs2xeyYpAVXjIZDZSVuma55pw+TRY=,iv:GfeIyftzgBCUD8ervmFnp6sg6Jh3oTSveZVcu1xoGLk=,tag:1twFOpl/Qrlewphxl8AQ1A==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmMkpmTjNmaHZxaXZJUmta
+            WlYrOTZ2YlpMV0thbnJseHMrYm1nSm90QlZzCjErd0JydFRaSE1DMEJKK1FaN0R5
+            cWoza2dVV0RiRm1FQnZubGI2Q1BBRmMKLS0tIGpEV3dPc1ZNaW9pQlpaZEdyUTFI
+            V2dSc1lzbGo4NWlXSHROQnpYUVVWM3cK96NnR47/zh/zAjCcty9J9B27B9J2LFUF
+            zXU2+pk2tryJIsp5FVFmHd5gSKtDDxgQ3WddtbhujbqOCMTACnCfhw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1elwua27zpyazka2l2k3djq7nc0dsclvhd8yknc07u3uqj0hnkfasmmfz6w
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiQmIrcEREQTFTS2FoSVhr
+            b1FFRkVTRHpmZDNvSmdxZUZudm90c0VvU2dJCkN0MGxsYVpwbVlHNDNYaUZyNTV4
+            OWNnOVFYT1h1V2dhS0NoU0VUV1hqVE0KLS0tIHp3QkpMZ0w4QStpQnZJS1h4U1Rk
+            SHlkZmdGL09mK0dpOE9HcFBPcmR2V0UKRZvKwe7VXv1vl0wJ3ORyEcZtiZOlWQkI
+            7JwzL+SjWbB17oHEhjQ9Boide6aznwYT0rkUWCjZaOu9QsqWsrB+VQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1k38l2drejmpr9dd24zy0dglzny0703yxg8ff29q2yyjlmmpu7g6q60hz4x
+    lastmodified: "2026-09-04T09:34:44Z"
+    mac: ENC[AES256_GCM,data:i7KKPzBkoaN5/c7gf4IFVQgjhM4ODUF/CCDupWW4cresNbaiYFZl+CUh6s9eht1mBseCKT7PtTSMogd4KV7c0p3d10hxRQPgqUEC2BplHD8bNRqb+jrjm3xtyy5WgntqVg7qi4WdUn1dD/q5jLW7/aaCI6aRTtsMcaEyVET8TTU=,iv:1mPNAQoxCwTC0D4N1+pBTdjeXXUIddDUA+b0Hpobng8=,tag:GZ0ZQ68XPmQsBikcU31rzg==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.3
diff --git a/secrets/example.yaml b/secrets/example.yaml
new file mode 100644
index 0000000..492c0dc
--- /dev/null
+++ b/secrets/example.yaml
@@ -0,0 +1,44 @@
+hello: ENC[AES256_GCM,data:TxSuMQ4JdDl2zjDXOgUpJLXltEzfTkyI3TE78dssxf9d2zUu5wclK0CS1tT6yQ==,iv:nMMJAAyZBr48v9b5bLcFgxaPkK1Nx7o9sTWbIBCAR2U=,tag:sBmWH18ya19eF9qvTRRX0w==,type:str]
+example_key: ENC[AES256_GCM,data:MfVINYFL1yKbLdH7Hg==,iv:G6787F+lwGTpfg9QQLLSu7FvGTVNp+btJADNTizpNXs=,tag:vIxSCMLDxeDbJFAp9Q0j+w==,type:str]
+#ENC[AES256_GCM,data:7/cjr5hO1GmlOmNPdcFK/A==,iv:9YtMaHUUhUsPbSrbc4MPVDodB6iZgotJ4u4X2hUqT+Q=,tag:VHBbaS69StjSywCTaY73gA==,type:comment]
+example_array:
+    - ENC[AES256_GCM,data:WSmXVvOS90gP6Svg/yU=,iv:AQqXt2R/0AtPzpVxHGfMBljxEQz/f7w1DLyMyhyFzv8=,tag:zDZH+n85toJhcBpLjxZdWg==,type:str]
+    - ENC[AES256_GCM,data:QIQuAGMC6hHonrmg7+I=,iv:K7wsLv2qlE3+d/GTElOu45wSMRfqNv4ZA8/fNQZhIHs=,tag:6/WJXqSLYRC+te7vAWuofQ==,type:str]
+    - ENC[AES256_GCM,data:UBGVYrK0H8PgB3iVdrE=,iv:aDnq0JAb0CCyjWbirOo+Hq52fn4AAaNudPuYab2jRwY=,tag:xI+6nNm/4vJt2xvysRK6Mw==,type:str]
+example_number: ENC[AES256_GCM,data:R7S5j/IgOY/u4A==,iv:yo3AyKMhkPsKl+hvZPBlK0CN2g646OFX0hOFD6JWt5A=,tag:4S2Uhvr+gD66yM8VtK+6dQ==,type:float]
+example_booleans:
+    - ENC[AES256_GCM,data:eNR8Jw==,iv:exL/Ga5Jdp44EGMsYnP0U0NohRY09m8BCrXZKgDTa4o=,tag:lDeNoSpdbU3JoTjE1a0qmg==,type:bool]
+    - ENC[AES256_GCM,data:WcVg9i8=,iv:vKEFlnk1d1dwVCuAnSqxNtdHW4aCRb1HqpxmL820n3Q=,tag:IEq9zGhH3Ghk0M510izUzA==,type:bool]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzeUZMbGc5SXVIcTFwREE4
+            N0hLdUZ2ZmoxdTh6S3VMT0F6ZEZlNHhuZWk0CnNIOUEycFdpVzZLMC9seXFLSEd0
+            WnJjWm9rWmU5VjJBMjEycThPTHFva1UKLS0tIElCMlRWQ0gvNnEwUTgzVUNHcDVq
+            elJvemdKejB0amIyTnpZR2dHK1liemsKnOPViyGNcJ+WU6U1nfPglGs/l/n6oUiz
+            Raa2Kixa4naTCnuSweQD0yiu/I9ZxRi3ytibvFLsQGRB9p8egLl+bw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1elwua27zpyazka2l2k3djq7nc0dsclvhd8yknc07u3uqj0hnkfasmmfz6w
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4aG1tZXpvZDNrNm1nY2o1
+            VEs2cEpMMHZwYUY1OSswN21QVTNiMGZycXh3CndZQUhGd2hqcm5jYWJrdXRERHNM
+            SjBUZVNhYkp1cW5GUTZLaEljMWFGVWcKLS0tIHd5RUpuTmhrdFZRNEd0bFl5VUtO
+            bk0ra2U1OVZkN01iZ1dkbXdwUnV3Z0EKheToYSNedDspJ2UKPq22+EHYsoH7JqiV
+            APq/wHPmVv5UtdB/xsWKaOY9tXMhEI8D+o7ROdOEWd8BMc6sdmleTA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1k38l2drejmpr9dd24zy0dglzny0703yxg8ff29q2yyjlmmpu7g6q60hz4x
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUTHhWQ3lPV0tNYk9NWW1v
+            ckh3TnBzMHUwRDlBQjNlT1RMRGpzZXV5dFN3Cm1FSkplZGcwa1NPdzdGa3FKMlJo
+            N0hRSjlYQWdGWHRnbVM3VVdRMCtTaUUKLS0tIC9RNUFMNlNYVitBM1dFdm44cGJ5
+            MVBTcHdOTkxBeWxVODlSaGtDZUtodVUKwLok7EHhzQwiZJgq88WQQQ1iZxYWphS+
+            XWJHk8uD3ipcOx079o8zhnFJ15E7MmBr81i9MHGy5cDnkaeI8TBJBA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1yxfe6zpmxckth5dzp0emzfjrrxhjs7h6x33ally8ka4sxawqw9zqkkxpgm
+    lastmodified: "2026-09-04T09:31:35Z"
+    mac: ENC[AES256_GCM,data:ba6NogjnL6zr9/3soWp4I/xDWh/+zqbZreWPN5kfPLNeDEVf46fsB7CEHXPtYl7K1KTuZwpfu17Zka2PBqL+IW/l8HiwY/y0tSaXdPZrc68YRnmSTot8CYKkfrIh27DJ0ueEHyTdJcfDsndQYWbGhgJ1rlpv2kTAtvNy/7OlEsM=,iv:P9lLDLWxug4xiid6qV+Sde7X4xIotQuVYFPi8mSolpU=,tag:Z/0A7FUCt1nrpLSnFna1Rg==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.3