# All sops secrets are edclared here (ssot).
# Each secret is a file stored in this directory as binary files (edit with `sops edit <filename>`)
let
  # make secrets readable by our processes
  djaiOnly = {
    format = "binary";
    owner = "djai";
    mode = "0400";
  };
in
{
  # machine's age key, also used by `sops edit`.  
  sops.age.keyFile = "/home/djai/.config/sops/age/keys.txt";
  # gotta make these lists empty or sops-nix will try to import our ssh keys 
  sops.age.sshKeyPaths = [ ];
  sops.gnupg.sshKeyPaths = [ ];

  sops.secrets = {
    # ssh config (exposes hostnames/ips/ports)
    "ssh-config" = djaiOnly // {
      sopsFile = ./ssh-config.bin; # TODO: actually use this
    };

    # npm caddy certificates
    "npm-certificate-private" = djaiOnly // {
      sopsFile = ./npm-certificate-private.bin;
    };
    "npm-certificate-shared" = djaiOnly // {
      sopsFile = ./npm-certificate-shared.bin;
    };
    "npm-certificate-public" = djaiOnly // {
      sopsFile = ./npm-certificate-public.bin;
    };

    # wireguard tunnels
    "wg-config-nixbook" = djaiOnly // {
      sopsFile = ./wg-config-nixbook.bin;
    };
    "wg-config-tuxcomp" = djaiOnly // {
      sopsFile = ./wg-config-tuxcomp.bin;
    };

    # thunderbird's logins.json + key4.db as a tarball, seeded on fresh hosts.
    "thunderbird-creds" = djaiOnly // {
      sopsFile = ./thunderbird-creds.bin;
    };
  };
}