secrets, flexget

flake.nix

@@ -20,12 +20,11 @@
     nixos-generators.url = "github:nix-community/nixos-generators";
     nixos-generators.inputs.nixpkgs.follows = "nixpkgs";
 
-    #TODO:
-    /** /
     # https://github.com/Mic92/sops-nix
     sops-nix.url = "github:Mic92/sops-nix";
     sops-nix.inputs.nixpkgs.follows = "nixpkgs";
 
+    /** /
     matrix-next.url = "github:dali99/nixos-matrix-modules"; # see https://git.pvv.ntnu.no/Drift/pvv-nixos-config/src/main/flake.nix
     #https://github.com/considerate/nixos-odroidhc4
     #https://cyberchaos.dev/cyberchaoscreatures/musl-nixos/
@@ -69,6 +68,8 @@
     nixos-hardware,
     nixos-generators,
     home-manager,
+    sops-nix,
+    #flake-programs-sqlite,
     ...
   } @ inputs:
   let
@@ -103,8 +104,19 @@
         flakes = flake inputs system;
       };
       /**/
-      imports = [ ./base.nix "${self}/hosts/${hostname}"] ++ modules;
-      #++ inputs.flake-programs-sqlite.nixosModules.programs-sqlite; # TODO: make work
+      imports = [
+        ./base.nix
+        "${self}/hosts/${hostname}"
+        sops-nix.nixosModules.sops
+      ] ++ modules;
+      #++ flake-programs-sqlite.nixosModules.programs-sqlite; # TODO: make work
+
+      sops = lib.mkIf (builtins.pathExists ./secrets/${hostname}.yaml) {
+        defaultSopsFile = ./secrets/${hostname}.yaml;
+        age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+        age.keyFile = "/var/lib/sops-nix/key.txt";
+        age.generateKey = true;
+      };
 
       # still needed even if using networkd
       networking.hostName = hostname;
@@ -198,6 +210,9 @@
         pkgs.home-manager
         pkgs.nix-output-monitor
         pkgs.cachix
+        pkgs.age
+        pkgs.sops
+        pkgs.ssh-to-age
       ];
     in {
       envrc-local  = mkShell envrc-pkgs;
@@ -208,6 +223,8 @@
       ]);
       remoteenv = mkShell [
         flakes.self.pkgs.nixos-rebuild-nom
+        pkgs.age
+        pkgs.ssh-to-age
       ];
     });