# All sops secrets are edclared here (ssot).
# Each secret is a file stored in this directory as binary files (edit with `sops edit <filename>`)
let
  # make secrets readable by our processes
  rootOnly = {
    format = "binary";
    mode = "0400";
  };
  djaiOnly = rootOnly // {
    owner = "djai";
  };
in
{
  # machine's age key, also used by `sops edit`.  
  sops.age.keyFile = "/home/djai/.config/sops/age/keys.txt";
  # gotta make these lists empty or sops-nix will try to import our ssh keys 
  sops.age.sshKeyPaths = [ ];
  sops.gnupg.sshKeyPaths = [ ];

  sops.secrets = {
    # ssh config (exposes hostnames/ips/ports)
    "ssh-config" = djaiOnly // {
      sopsFile = ./ssh-config.bin;
    };

    # wireguard tunnels
    "wg-config-nixbook" = djaiOnly // {
      sopsFile = ./wg-config-nixbook.bin;
    };
    "wg-config-tuxcomp" = djaiOnly // {
      sopsFile = ./wg-config-tuxcomp.bin;
    };
  };
}