From 388c3d61540a1307a44375d9d9d90d3d7648d46c Mon Sep 17 00:00:00 2001
From: Vegard Bieker Matthey <VegardMatthey@protonmail.com>
Date: Sun, 29 Mar 2026 16:09:12 +0200
Subject: [PATCH] use sops for secrets

---
 .sops.yaml          |  7 +++++++
 flake.lock          | 23 +++++++++++++++++++++-
 flake.nix           | 48 +++++++++++++++++++++++++++++----------------
 home.nix            | 19 +++++++++---------
 secrets/secret.yaml | 18 +++++++++++++++++
 5 files changed, 87 insertions(+), 28 deletions(-)
 create mode 100644 .sops.yaml
 create mode 100644 secrets/secret.yaml

diff --git a/.sops.yaml b/.sops.yaml
new file mode 100644
index 0000000..4a2d266
--- /dev/null
+++ b/.sops.yaml
@@ -0,0 +1,7 @@
+keys:
+  - &admin_vbm age1n67lvtmsnf59p78awr2y7x4w6fuheezh3expl5gmd5u3djhdmdwq6ams5r
+creation_rules:
+  - path_regex: secrets/[^/]+\.(yaml|json|env|ini)$
+    key_groups:
+    - age:
+      - *admin_vbm
diff --git a/flake.lock b/flake.lock
index 5957de4..8abf1fe 100644
--- a/flake.lock
+++ b/flake.lock
@@ -105,7 +105,28 @@
         "dwl": "dwl",
         "home-manager": "home-manager",
         "nixpkgs": "nixpkgs",
-        "nixvim": "nixvim"
+        "nixvim": "nixvim",
+        "sops-nix": "sops-nix"
+      }
+    },
+    "sops-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1774303811,
+        "narHash": "sha256-fhG4JAcLgjKwt+XHbjs8brpWnyKUfU4LikLm3s0Q/ic=",
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "rev": "614e256310e0a4f8a9ccae3fa80c11844fba7042",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "type": "github"
       }
     },
     "systems": {
diff --git a/flake.nix b/flake.nix
index ecda9fb..c7ef0e7 100644
--- a/flake.nix
+++ b/flake.nix
@@ -13,29 +13,43 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    sops-nix = {
+      url = "github:Mic92/sops-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     dwl = {
       url = "git+https://git.pvv.ntnu.no/vegardbm/dwl.git?ref=master";
       inputs.nixpkgs.follows = "nixpkgs";
     };
   };
 
-  outputs = inputs: {
-    nixosConfigurations = {
-      nixos-xenon = inputs.nixpkgs.lib.nixosSystem {
-        system = "x86_64-linux";
-        specialArgs = { inherit inputs; };
-        modules = [
-          ./configuration.nix
-          inputs.home-manager.nixosModules.home-manager
-          {
-            home-manager.useUserPackages = true;
-            home-manager.users.vbm = ./home.nix;
-            home-manager.sharedModules = [
-              inputs.nixvim.homeModules.nixvim
-            ];
-          }
-        ];
+  outputs =
+    inputs:
+    let
+      system = "x86_64-linux";
+    in
+    {
+      nixosConfigurations = {
+        nixos-xenon = inputs.nixpkgs.lib.nixosSystem {
+          specialArgs = {
+            inherit inputs system;
+          };
+          modules = [
+            ./configuration.nix
+            inputs.sops-nix.nixosModules.sops
+            inputs.home-manager.nixosModules.home-manager
+            {
+              home-manager.useUserPackages = true;
+              home-manager.users.vbm = ./home.nix;
+              home-manager.extraSpecialArgs = { inherit inputs; };
+              home-manager.sharedModules = [
+                inputs.nixvim.homeModules.nixvim
+                inputs.sops-nix.homeManagerModules.sops
+              ];
+            }
+          ];
+        };
       };
     };
-  };
 }
diff --git a/home.nix b/home.nix
index 5c33499..46a53ed 100644
--- a/home.nix
+++ b/home.nix
@@ -5,6 +5,10 @@
   ...
 }:
 {
+  sops.age.keyFile = "${config.xdg.configHome}/sops/age/personal.txt";
+  sops.defaultSopsFile = ./secrets/secret.yaml;
+  sops.secrets."email/pvv/password" = { };
+
   home = {
     username = "vbm";
     homeDirectory = "/home/vbm";
@@ -86,16 +90,9 @@
     enable = true;
   };
 
-  # accounts.email.accounts."personal" = {
-  #   primary = true;
-  #   address = "VegardMatthey@protonmail.com";
-  #   realName = "Vegard Bieker Matthey";
-  # };
+  # My mbsync config is kinda weird, need the program to make sure the config file exists.
+  programs.mbsync.enable = true;
   services.mbsync.enable = true;
-  programs.mbsync = {
-    enable = true;
-  };
-
   accounts.email.maildirBasePath = "Mail";
   accounts.email.accounts."pvv" = {
     userName = "vegardbm";
@@ -126,7 +123,9 @@
         useStartTls = true;
       };
     };
-    passwordCommand = "${lib.getExe' pkgs.coreutils "cat"} /home/vbm/Documents/pass.txt";
+    passwordCommand = "${lib.getExe' pkgs.coreutils "cat"} ${
+      config.sops.secrets."email/pvv/password".path
+    }";
   };
 
   programs.zoxide = {
diff --git a/secrets/secret.yaml b/secrets/secret.yaml
new file mode 100644
index 0000000..572fad8
--- /dev/null
+++ b/secrets/secret.yaml
@@ -0,0 +1,18 @@
+email:
+    pvv:
+        password: ENC[AES256_GCM,data:BuXcVO3OHN5OUbQuvVlJQz0zlYxRV4TVYg7g+UbT0gbW8h0RHxdANuD/lVH5ofwiXY8pAeUoUY9GSguo2hCcQw==,iv:J5DdddsY2UJ5KLJ2MEUUTNblGAkkD91zsxKBL0lS0gs=,tag:jT/3+gdJJ4pct56FDTa8Ww==,type:str]
+sops:
+    age:
+        - recipient: age1n67lvtmsnf59p78awr2y7x4w6fuheezh3expl5gmd5u3djhdmdwq6ams5r
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSZ0hlb3lFV0djUU1aM3F5
+            UENQQnhxaXRTOTlMVXkxcFltKzRPbFU5VGpJCjEwQkVMbDJmaW4valM0RDZOaWR6
+            WjZsS2ZoV3F0SDU4VlFmMlRMMlJ2MzAKLS0tIDhDWk96ampCUnZYeWVoMHpacU8y
+            S0g3MmRFSkJWNkE3Mkg0S28zNFByb1UKPB35WUCgmO/75Rc0mXL5PuYUZCOxeBZ4
+            /9shfAH8Uha4iZKJ2AWXMN9kGJBdpooV+el5so6vxZQU5M5PTXrJQA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-03-29T02:19:51Z"
+    mac: ENC[AES256_GCM,data:45JZvffUcsXQK3XQ5Ds1dEv/OE4I26pkIplaxJMHoi01DldPWi644pfIcQ5zX04ada37vL9nrXTQb3c2d+Par4zqqjjdNwJ9A4VManYLWnB7dq0ZUtE7rsKg9ndg5JNTlgiiBva0buZJ6rUFqzdMTGw8OfoUteGkSQ1r7LHlUE0=,iv:RJ0N2TgWVsUwRQoUvoSzrSqxqekX6QDSHNmJKJSWWkU=,tag:T7X74wTacJxp2HmQJg2Bjg==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.12.1