dotfiles/modules/nixos/sops/default.nix

{ flake, config, ... }:
let
  inherit (flake.config.people)
    user0
    user2
    ;
  inherit (flake.config.machines)
    devices
    ;
  hostname = config.networking.hostName;
  jupiter = devices.jupiter.name;
  ceres = devices.ceres.name;
  saturn = devices.saturn.name;
  callisto = devices.callisto.name;

  userLogic =
    if hostname == jupiter then
      user0
    else if hostname == ceres then
      user0
    else if hostname == saturn then
      user2
    else
      "";
in
{
  sops = {
    defaultSopsFile = ../../../secrets/secrets.yaml;
    validateSopsFiles = false;
    age = {
      keyFile = "/var/lib/sops-nix/key.txt";
      generateKey = false;
    };
    secrets =
      if hostname == callisto then
        { }
      else
        {
          "ssh/private" = {
            path = "/home/${userLogic}/.ssh/id_ed25519";
            owner = userLogic;
          };
          "ssh/public" = {
            path = "/home/${userLogic}/.ssh/id_ed25519.pub";
            owner = userLogic;
          };
          "ssh/hosts" = {
            path = "/home/${userLogic}/.ssh/known_hosts";
            owner = userLogic;
          };
          # "claude-api-key" = {
          #   path = "/home/${user0}/.config/zed/claude-api-key";
          #   owner = user0;
          # };
        };
  };
}