sops

fixed path and setup homemanager

.sops.yaml

@@ -0,0 +1,7 @@
+keys:
+  - &host age1ammls20r5t3dx4cvhpt8n5dejxcpdmpqt37sa9r9fuztd8c43g4sz889zd
+creation_rules:
+  - path_regex: secrets/secrets.yaml$
+    key_groups:
+      - age:
+          - *host

builds/sops.nix

@@ -0,0 +1,10 @@
+{ ... }:
+
+{
+  sops = {
+    defaultSopsFile = ../secrets/secrets.yaml;
+    defaultSopsFormat = "yaml";
+    age.keyFile = "/etc/sops/keys.txt";
+    secrets."user_password".neededForUsers = true;
+  };
+}

configuration.nix

@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ config, pkgs, ... }:
 
 let
   images = pkgs.callPackage ./home/themes/images.nix { };
@@ -6,8 +6,9 @@ in
 {
   # ── Steam & Printer ───────────────────────────────────────────────────
   imports = [
-    ./builds/steam/default.nix
-    ./home/extras/printer.nix
+    ./builds/steam.nix
+    ./builds/printer.nix
+    ./builds/sops.nix
   ];
 
   # ── Use the systemd-boot EFI boot loader. ─────────────────────────────
@@ -98,7 +99,7 @@ in
         "render"
         "adbusers"
       ];
-      hashedPassword = "$6$pdAJt1f0v7Zb13Ri$1WpKrErAp5JCb7eXs7EeeWYRMBLu5/WKDdMyGzJyYQDijG2NiywUXpAkl/8p1noxOOqYbb.MTw7JmTzhWGsT21";
+      hashedPasswordFile = config.sops.secrets."user_password".path;
     };
   };
 

flake.lock

@@ -270,7 +270,28 @@
         "nix-vscode-extensions": "nix-vscode-extensions",
         "nixpkgs": "nixpkgs_3",
         "nixvim": "nixvim",
-        "nur": "nur"
+        "nur": "nur",
+        "sops-nix": "sops-nix"
+      }
+    },
+    "sops-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1774154798,
+        "narHash": "sha256-zsTuloDSdKf+PrI1MsWx5z/cyGEJ8P3eERtAfdP8Bmg=",
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "rev": "3e0d543e6ba6c0c48117a81614e90c6d8c425170",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "type": "github"
       }
     },
     "systems": {

flake.nix

@@ -28,6 +28,11 @@
     nur = {
       url = "github:nix-community/NUR";
     };
+
+    sops-nix = {
+      url = "github:Mic92/sops-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs =
@@ -39,6 +44,7 @@
       nixpkgs,
       nixvim,
       nur,
+      sops-nix,
       ...
     }@inputs:
     {
@@ -50,10 +56,11 @@
           modules = [
             ./machines/configuration-laptop.nix
             ./home/services/pipewire.nix
-            nur.modules.nixos.default
             catppuccin.nixosModules.catppuccin
             home-manager.nixosModules.home-manager
             # impermanence.nixosModules.impermanence
+            nur.modules.nixos.default
+            sops-nix.nixosModules.sops
             {
               home-manager = {
                 useUserPackages = true;
@@ -61,6 +68,7 @@
                 users.elias.imports = [
                   ./home/default-laptop.nix
                   catppuccin.homeModules.catppuccin
+                  sops-nix.homeManagerModules.sops
                 ];
               };
               nixpkgs.overlays = [
@@ -76,35 +84,11 @@
           modules = [
             ./machines/configuration-desktop.nix
             ./home/services/pipewire.nix
-            nur.modules.nixos.default
-            catppuccin.nixosModules.catppuccin
-            home-manager.nixosModules.home-manager
-            # impermanence.nixosModules.impermanence
-            {
-              home-manager = {
-                useUserPackages = true;
-                extraSpecialArgs = { inherit inputs; };
-                users.elias.imports = [
-                  ./home/default-desktop.nix
-                  catppuccin.homeModules.catppuccin
-                ];
-              };
-              nixpkgs.overlays = [
-                inputs.nur.overlays.default
-                inputs.nix-vscode-extensions.overlays.default
-              ];
-            }
-          ];
-        };
-        nixos = nixpkgs.lib.nixosSystem {
-          system = "x86_64-linux";
-          modules = [
-            ./machines/configuration-desktop.nix
-            ./home/services/pipewire.nix
-            nur.modules.nixos.default
             catppuccin.nixosModules.catppuccin
             home-manager.nixosModules.home-manager
             # impermanence.nixosModules.impermanence
+            nur.modules.nixos.default
+            sops-nix.nixosModules.sops
             {
               home-manager = {
                 useUserPackages = true;
@@ -112,6 +96,7 @@
                 users.elias.imports = [
                   ./home/default-desktop.nix
                   catppuccin.homeModules.catppuccin
+                  sops-nix.homeManagerModules.sops
                 ];
               };
               nixpkgs.overlays = [

home/default.nix

@@ -2,6 +2,7 @@
 
 {
   imports = [
+    ./extras
     ./services
     ./themes
   ];
@@ -45,6 +46,10 @@
       cups
       firefox
       bitwarden-desktop
+
+      # Sops
+      age
+      sops
     ];
 
     stateVersion = "23.11";

home/extras/default.nix

@@ -0,0 +1,7 @@
+{ ... }:
+
+{
+  imports = [
+    ./sops.nix
+  ];
+}

home/extras/sops.nix

@@ -0,0 +1,13 @@
+{ ... }:
+
+{
+  sops = {
+    defaultSopsFile = ../../secrets/secrets.yaml;
+    defaultSopsFormat = "yaml";
+    age.keyFile = "/etc/sops/keys.txt";
+
+    # ── Define Secrets ────────────────────────────────────────────────────
+    secrets."ssh/private".path = "/home/elias/.ssh/id_rsa";
+    secrets."ssh/public".path = "/home/elias/.ssh/id_rsa.pub";
+  };
+}

home/programs/git.nix

@@ -1,4 +1,9 @@
-{ lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 {
   home.packages = with pkgs; [

home/programs/zsh.nix

@@ -13,12 +13,17 @@
     enable = true;
     dotDir = "${config.xdg.configHome}/zsh";
     shellAliases = {
+      encryptSops = "sops --age age1ammls20r5t3dx4cvhpt8n5dejxcpdmpqt37sa9r9fuztd8c43g4sz889zd -e -i secrets/secrets.yaml";
       update = "sudo nixos-rebuild switch";
       conWG = "ssh elias@logout.nonagon.dev -p 6969";
       conWS = "ssh elias@192.168.31.200";
       setupPC = "wlr-randr --output HDMI-A-2 --on --mode 1920x1080 --pos 0,0;wlr-randr --output DVI-D-1 --on --mode 1920x1080 --pos 1920,0;wlr-randr --output DP-2 --on --mode 1920x1080 --pos 3840,0 --primary";
     };
     autosuggestion.enable = true;
+    localVariables = {
+      EDITOR = "nvim";
+      SOPS_AGE_KEY_FILE = "/etc/sops/keys.txt";
+    };
     enableCompletion = true;
     enableVteIntegration = true;
     history = {
@@ -30,8 +35,9 @@
       enable = true;
     };
     initContent = ''
-      export LD_LIBRARY_PATH="/nix/store/yjm4j9n85bcp42v5nkz2xifrp4a9s63k-sqlite-3.46.1/lib"o
+      export LD_LIBRARY_PATH="/nix/store/yjm4j9n85bcp42v5nkz2xifrp4a9s63k-sqlite-3.46.1/lib"
       export CHROME_EXECUTABLE="/run/current-system/sw/bin/google-chrome-stable"
+      export SOPS_AGE_KEY_FILE="/etc/sops/key.txt"
       fastfetch
 
       PROMPT='%F{green}%n%f@%F{magenta}%m%f %F{blue}%B%~%b%f %# '

home/services/ssh-agent.nix

@@ -1,6 +1,5 @@
 { ... }:
 
 {
-  services.ssh-agent.enable = true;
+  services.ssh-agent.enable = false;
 }
-

secrets/secrets.yaml

@@ -0,0 +1,19 @@
+user_password: ENC[AES256_GCM,data:+y3eoDmYNSRA5b/ywkZdJ6ai4DbU19LKIk0EbvRt9qXyfswr5fhGEgHPa+vpdbSCEaUukcW1Ch1JcLpDV/EhiI+gErjxl4iB44ul1naUT+yVqZ00Q2s9OCjI9VpWH+fVcRpJpYdOGFsztg==,iv:6t+pKJxT00kSCF6QdR319oKXXtCbKQdkXW5lDaJotBE=,tag:DO8XyiwdGrg2wpRObo7law==,type:str]
+ssh:
+    private: ENC[AES256_GCM,data:EQKeJYDXQgHSVwswKqbIRfmQoBTiGEHHRNOt3QPi0+lbSRguUHBE4GdBGqVjKFuWrQcs7s09ET8nt226u4PO6rjpZBHUbksUYXR4jwqH4h7El1Xb7vKenxAMwEVHx8giqQBF3VNYpzfIAPTAWnBMpBgJuIDFhtgKPJ2pUscNfbIitKyEe8gbByRAz2XtkddeGY5fuSN7qYeyuQO4C5evcmyM3wmmoE6fcrW4gnP+XiNCOJOQXkQjfvmM7kInnz+z0kBCOfdjbf8BzJ+9zdZEtTQXhy6wDHYAf/BY4SFHjYhrckeX7pzXxyr6WqMWRVEu/qEk3BuPCw4PTpVBZ4fmBbg0LT0Te3pM31IqNykFop6G1Mry4JnRry6kxfo5VF6bQRZAP86+iHq1kxXceJ7tJbLo0Mhjz2uIThTv8Q6IB1W3DL/DeYxaYdtGL8U/zZeNClOfQ/AxVRA8qwa9XrifEnSh8Ov40gsy+PE+xNM+Sxs6B6goOT2/D6WJqcG37GPgnHzNw7SwDXZtn/lslALrYGa4eOtpZAzV8i/8jJrB8eSYJxnb9rT4Bdk4foNMMV3qTWJs0NCvUQhQjUDkXoVeo+r2EiL+o1ccKj1NRTuWn222J9vhYO+L4K1uIeuSPjS3VOqdnJ6jXk8pRPm1VrRarNxsB/11/lckG5hsXgkSrf/81rclsxPHsWN+cEfin7oe9URFvyzOoAgxDixeSchjEre31RkRekeL9PIo7LS4vHHTcCcpmDL9BE42ft2jDWfcw1QbX3PTW7YFOse6M7LBOMEZAwv4QSIwZMaVINvTLsJwnB8X4wvqITLvvPoZ+DV7Nji3QbUo6OeVtJ3fwe0DaZ1aHC+13+nVB+WXvBH4j9eSqn2TI/xT4xEAlPaLrSL6E1EfyiyjVfzHcVHkenPGNcQdAmWlWvC3UbIqDmPNE35Vw3IGb0jA8c7+HJdfBrpIcdwxioFCiksxL6eG4IttQO80HymltypjVzSgaVBUBch8CYkPIgtnpc1zCLZoY9I0VkhtkS17t03qWbK3hYhOUjTZwiMMBTqvm+H+sMLDQLqkRJGnQhm3JE9CnWH8yXvl6U+2h/LUaKpywYqCZcU0lFOUPWFKLdWhpbI3vqGwobs/7k4U6fwjyL9DKV4IEQs1d6hth4ryg5ea0IA3M6qWVeAUmzBzcD6mM7FmyEHVq44ja5WuEbWoO2/KXZFmPxObnVl5ZyQt40yRchZn5qschGKJ/ORK4iBhGENspXfyPCTD1nrZJbutX6fTo92AvZbrdpTr2nk5ZXbIaBF2vW2jIqk73Ynmyd2aaQWn1pLZIz+CG9JjsDhiQ6C9Q/svmt9HxZuE73X7LZ4NyqyDBJzD1vtn9vZ+iRFmxdigdOxYIeVnOdqvDt9yfiEwya+I/02zWOzI8KF1Vr158V4bWc9GF4xEgV5UvCvI0RX4E7CBQMirS1SRidwEcCRtgC8B7h3GN2EjKDB4iaRoMQS3l8s/rHdLUuVTDro0I3aDSlyWb3EYjSvj6Gg8tLlgO358hkAOQoM7tE9pG2S4JqGBrGUU4Vy9490ucjRKzhJC0XjkFD2Rs/r14eaYfxSBTthpYeLqX2AB1wS9SoFAxlg+dQIKyxYgsRu5ix/xWz6QbMHEw9w/PeYITew/rT9tzqv4cvh2B+zGyRwOouphprOjfB/hk202VESKSrf5qyV5qAqgD3en8ZdGEMkWMTYZ10qPS8zIbRy7MLQL7zyCcNr4Ebind4qnGFEXT+D3VIM+qN8qyEpN48Xk6eV6upudLJ+GzAcH/F7S41TqJZIkwnKfio7Ac+xe9XRONu8HCO7s8AeLSsbd584H6B6Bmf06FSIh835DkUnlrBEuFOwIB1i9ZnfDwVBAxijvlb8BzSnVjhJvlPMsrLxAPbi8bURN77j9FZRCU5rL9MT6yhTGT8aC+jA6tiU4VVZDcrvjWyw/1n85gKn3Vuli9gJ8hMaL9e941A+7klaHDHAi1R1zdH7yBqN+uNHpJca4REwOKGRN+diYws6oGS7PgI6U+BBOuHmHMPPObt2RG5SaOlz6m4dMSy2gZYQQpPSHrWF4QnQQuBQ4cDigUxgI0BseZoy3niTAGp3aWHi8ftF11ISRvs7NF1cuu9sV0CrVMBah6zcpH8+rVlyISP8H3iGuLQ9hwyryM2j0DQOV5e3rbb+qWZYtOK/ly/E+3K6NzhTIctrwZddPgfuMjFTaeOQUaKNxzHJRiG6G1mwOp9BRjoDaxsDh9uL7TMZXSER8cGe+63S324C0bR7Y519z1XNbHOGKhZOolgo2JFDVAkHAjaL5gpsdq6UjOig9hG48PsFYsDxRxgX/GZtQbI+VEVyeoJkTFmTCUfD39KVvJbUKs4K1Eo07HR4SxRAOh3P3sMavucjG1hHNbtYH9wZZy3+WTCoYHZ69fwLncmkMXLcSQA6CuFRGOLq4dfgtHWYf1xrwEIf9qPANGLejXcoFwB5Vs5Wo4tHUXW5MMbRT9zUVm/0vQ3wW93PwLQoSmsZ+rGEi91dtylHhTKnBX8SaoLvQuf0Vn1TGqBdvr71wLugViEk4q5CqX5vDCo9ry5MMtisDT2bLaWL7TTBpisjOgwQj6tpakMhVG7x4pn67rDKmg0B+j3vRuEY9gc93AAvw9oyzJ45UrwI0szMjdHO9Yza/8X3ETXvbGldzvIx7+fHNH4f/koEWwy7BRpRZ/G5qgoSjXkBFhvnL6mM5YqjjYniQUnngCJbjeJDMepcTtvsE/tznVZ2cyDlT8kxeoWcpUp6hsHOj+CcNPW9Ay3b9Uv4Ffd4e/gyyY6ziUn8Wv5uMUzMCkISVzwNuk5vdEvdhOuEW7wOKReAr+dKWfZ0JG06iYKRT4hobenOHKehGRICDMjylEiVVFihLYd5vJZnUtlbLelA/ZTPtGSwUGezCdXXN32OFNyN1n4W6CsnHq8K/B3SEe3Efc8/O9hEq6B/5R74xPsz8dnNQ6KGBaMbTpnRt3P6HVW5Zgg02ePLZ6nCZq7CqvexcG06IeV0iR4PlcvYPhHxVX91psd62f5yNiAl1Ty5bPo2ROYOhLOMoOfw+pLTEgKNOTFEWBvX1ws7ISAMrBi+mn7h9ULtYFw5OfdU0pSNSPVCOHBFB7oqzZpFuK4x/czwrJ66e4B7jnjqh+7r4a9Rj7Wcsls4q2uOzA1TpcC4aI6OrGZAlItbxhjMqhF3tcIMnp+d604DcelyUOqFTCbXTADtjOTMce3BCgm46KlFoS9X/Jpi9HuIadkyyPlTjbePVfsCYNoeYzo9tJe8yItYXcARfdmW3UifHXZsXIXjr7T+NGmykSFeQpw33oVoGwk6RZzzNNLIkDxTUXukYDx5YPmA7tx6/VSFQsnlrnbDiow0b1od8k7up7dA0iMy8QiV0kmm9EG0VfE4f2+8vj4raY1KNG3QmMJ1cDffG4XW0FFSGe7znXB0tltzv51FPIWqWWww9RSSTVvRJ3gvsHpAbfQ0/q1jbweVNqv/3HPpbqQGsGyRl9oSRRSbg9wbqY2+3CnO8n/Wwr9jv2JgImLWwlS/PBx6Ma4KRYMvKrqLZI3+niAPBa9LfMgqnmqaDzhE8ZvztTnlch1grvsoz8YzDDL4ZdoUMjR6/7ODMPYiFRMFDuYbzDOexCh4O1ublL2pEO0wYoZNFrTgVOtyjoDp1rgS8nRdg3JAQ/2RypmDg4WJJ5HiTsAFHLnWhkXVyOFzUY479C/LdziSdjMI/7M5hs0MVndPNUSCP8eruu2Q8Ux8COr8kUFBX2wYhXNq8ElFATwhaQmqWJaIvap2nvWjztf4B5EMfu/Ri0472mXyguT6peiwRKoPgjIklEShWUmTtMcLyx3U5BSL3JbTPMtwF/0FmQfFY1d7OLEErF/Nn2x2KTH64UWeCZ7D6te9l611bE1LU3BEdKyr8SeqvXlfE5SdSTNN3gqWCTHDZvLvJ3/suO4ksQyOo+svEZYmbpw6QfamFR4TclF0d5R8k8JQh7BKX4XSVMfYjI9LCzWU4AcVOOxLQw/6lSJu+Oa3PMdWg2CcLwl6+g0c5Wd2DLAuDE4joCg0c9JZTTh06lh0MLlpRKm2oP8lbnlt9sGXVLFPO/zgPqURYFJOtFrLiERrn0k7r8NwTquZxLrCSWKijqCQkrknpQqNFH8dD2SdxmV263IccuwSMUsPcFCNjAVSqsMGODWstbND6uF78013OFGu5HS+rjbqpenAcSdsRU9c075YFLLoqGBkaHNXoXGp8M78LbshnSJdbM4Ra5amWOjnhwpse/ZTyHq6/Rdrw96zr7OiC4PbiqrO2yuCYZkAMFXFJpjFpvR0O9oJm+7ciBwYTaKO8Cjd1uqURByUCe+hLalOb4JE9Hok/0T8DqAEUg2/MmQyAHeeq+YMO4Ai4QnJ/PE486GQaXy7VoHLS5euI7e05rgK5mkhHkqn8lhbvti2174RM8nfBjPzkPyr459uGxgu6wJhldGc8NOAhtei15REZkxU2021xJtn0yszeqHMVMJu3boyS0ucOEksN3wjvLhiltLvKjHGndY3FzX4otLYb6+0xDJA8WjK3OW8=,iv:AW+ynRivEz5XqDmzDkTye25b8puk10xNaDSnN1tBMpk=,tag:2JRwGswvdZjOkHyuzA2QFw==,type:str]
+    public: ENC[AES256_GCM,data:xLdZkf4i26+6SKnWt8Yk5wEBIaLBTzcMkyePq3Ek/slpZd2tnWOGrPrX8spUtWJb1cxXKf3TMhL3QpazJAbnEwS/9fC3lNG7p/lgtIqezTgZU/lUzzVh2JBvEmP8Eh4ZN5JZNd9Qkh+vnkfq+LOMVlBvRqWk51bXBHOC7SfHtrRHFFk4TWLcSAD1dRcee3QSSGXZ6/LeCpoeTM/MLuC7CrW51xc/UJH9UaASuBuje3XJV1VklWEj0m+8Yx+hpIHIQhKuZovhaTt35BtqeNiYCpZaUq79CeWybk13l74mAjPk+jXVm/fQIK75I2tffeSQF1FTAbvggFaXgtxfnyxZPuiVKLY9GFiEL2PZrJaygpYzxBQk5XG1fdFS1V4xRvHgQcIWtNYqzs8wNQULrpphfH0JEMhYKe8stoxKZCxfR/2OatZX5SUtZEtf4KBgwcjFtKHInuIEiOxPE0EsMwR9KpPqhlNK6MEHv4MBlIBLs82mEvJ/uivlwz8blbJlnjX98Jx8pb9752f4JrJ+7mLnFVLmeuz/d2kC2xKbINU2N5Yz0zcaJwv68xNmtzWFOpJ17PUTD328x8IHJ7wyucT9h+ejHmGbKTn0yMby0ktbNUfKwRE0Fx/NaA3cpJzrvSAVkd+1yPw19VKuUb5J3XCa3obP8um7p+zH7jKh1Bn7uud3Krl34ihgfsx/C4ZEL2RhxHgdhEiXSJ8v0lpLZ7jUT17WoGo3n158itQuNuHC43Z9z9RWveQ8JQSBDcjcW2XQVIW6bBTRSpKX51hmwFcsS/XnMf260qi9QA/Ebunv10U9OYKtk0EYDZUZzHcB6A1FqGXDPDdQsAohqKJt+/G8YO+TU7VgaOwasKmlhgPacWr0tGx4gL/9bkYBBOyaytz344bRotGhkMMR52omdtSqebAAgjZWLQ/YVknaEWZ+n8eaeUB8OojPWk8weyxd4PVNGdGWVlk6yRIWCX6zRRwp4lamWDNjD+8cPCS+mZw=,iv:wyszgoMAPYkRxObEtCc7AAmd0gExVooxddCBD60azKk=,tag:+l05FzRoRrogFXtr0SHQmw==,type:str]
+sops:
+    age:
+        - recipient: age1ammls20r5t3dx4cvhpt8n5dejxcpdmpqt37sa9r9fuztd8c43g4sz889zd
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmOVE0cDNvSElzcEZhVlc3
+            NDY0OGRmd1FSMTFFblhOOTQwcmxJU0pnenkwCnFaMUtvWDFSeHhOYVd4MG9ZVDhH
+            Ym52c0FqQnVTR1B6TzJhdW9ZMmRTYm8KLS0tIDdaN08vS2NnRkV5dnVDUEFEaXZZ
+            WWc2ZXl4Mmpjck1JTXYvbTB2bzFnRmMKU7tLqqHSPpmwQluuxQ3UIhrGARneQc9+
+            8hJ4b8/KH9PczWlSqwhx1nOO+/e4ZNDjd6635CQlWWghBI3p/UjhqA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-03-25T14:12:20Z"
+    mac: ENC[AES256_GCM,data:LuN33gAMz/kdJXD0sG5gZWKjiS15WXbkQTIaY6HHRQlGr8JbsUPA4XBsMFtAEMf5pyxodRcGmrvmutNJJaylRLbiSwt1cSlBy4CwhYgYV6DLCQ+0/+/T22m2Iq72SSjGILX/DqTJzKaoapEQYX3nNth6V/C7YnvvmEDzlDApALY=,iv:C7WNDrNdPQcxy0wWf49D2FARnwWU3G3rBY6hQ7LZiZM=,tag:qyLVBHMO1uS9xJFOJcXe+g==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.12.1