ft: sops-nix + secrets

secrets/default.nix

@@ -0,0 +1,48 @@
+# All sops secrets are edclared here (ssot).
+# Each secret is a file stored in this directory as binary files (edit with `sops edit <filename>`)
+let
+  # make secrets readable by our processes
+  djaiOnly = {
+    format = "binary";
+    owner = "djai";
+    mode = "0400";
+  };
+in
+{
+  # machine's age key, also used by `sops edit`.  
+  sops.age.keyFile = "/home/djai/.config/sops/age/keys.txt";
+  # gotta make these lists empty or sops-nix will try to import our ssh keys 
+  sops.age.sshKeyPaths = [ ];
+  sops.gnupg.sshKeyPaths = [ ];
+
+  sops.secrets = {
+    # ssh config (exposes hostnames/ips/ports)
+    "ssh-config" = djaiOnly // {
+      sopsFile = ./ssh-config.bin; # TODO: actually use this
+    };
+
+    # npm caddy certificates
+    "npm-certificate-private" = djaiOnly // {
+      sopsFile = ./npm-certificate-private.bin;
+    };
+    "npm-certificate-shared" = djaiOnly // {
+      sopsFile = ./npm-certificate-shared.bin;
+    };
+    "npm-certificate-public" = djaiOnly // {
+      sopsFile = ./npm-certificate-public.bin;
+    };
+
+    # wireguard tunnels
+    "wg-config-nixbook" = djaiOnly // {
+      sopsFile = ./wg-config-nixbook.bin;
+    };
+    "wg-config-tuxcomp" = djaiOnly // {
+      sopsFile = ./wg-config-tuxcomp.bin;
+    };
+
+    # thunderbird's logins.json + key4.db as a tarball, seeded on fresh hosts.
+    "thunderbird-creds" = djaiOnly // {
+      sopsFile = ./thunderbird-creds.bin;
+    };
+  };
+}