upRootNutrition/dotfiles
upRootNutrition/dotfiles
1
0
Fork 0
mirror of https://gitlab.com/upRootNutrition/dotfiles.git synced 2025-12-06 21:17:14 -06:00
Code Issues Projects 1 Releases Packages Wiki Activity Actions

chore: refactored sops secrets

Browse source
This commit is contained in:
Nick 2025-11-28 20:35:50 -06:00
parent 60c469ee7f
commit 9df4b8c8a0
13 changed files with 47 additions and 42 deletions
Download patch file Download diff file Expand all files Collapse all files

2
modules/nixos/core/environment/default.nix
View file

@ -31,7 +31,7 @@ in
NIXPKGS_ALLOW_INSECURE = "1";
NIXPKGS_ALLOW_UNFREE = "1";
GTK_THEME = "catppuccin-macchiato-mauve-compact";
# ANTHROPIC_API_KEY = config.sops.secrets.claude-api-key.path;
# ANTHROPIC_API_KEY = config.sops.secrets."claude/key".path;
};
};
}

4
modules/nixos/desktop/network/default.nix
View file

@ -6,13 +6,13 @@ in
networking.wireless = {
networks = {
"TheWeeFeez!" = {
psk = config.sops.secrets."wifi-home".path;
psk = config.sops.secrets."wifi/home".path;
};
};
};
sops = {
secrets = {
"wifi-home" = {
"wifi/home" = {
path = "/var/lib/secrets/wifi-home-pass";
owner = user0;
};

2
modules/nixos/services/glance/config/server.nix
View file

@ -10,7 +10,7 @@ in
host = ceres.wireguard.ip0;
port = configHelpers.service.ports.port0;
# auth = {
# secret-key = config.sops.secrets."${service.name}-key".path;
# secret-key = config.sops.secrets."${service.name}/key".path;
# users.${user0}.password = config.sops.secrets."${service.name}-${user0}-pass".path;
# };
}

2
modules/nixos/services/glance/default.nix
View file

@ -61,7 +61,7 @@ in
secrets = builtins.listToAttrs (
map
(secret: {
name = "${configHelpers.service.name}-${secret}";
name = "${configHelpers.service.name}/${secret}";
value = sopsPath secret;
})
[

14
modules/nixos/services/peertube/default.nix
View file

@ -28,7 +28,7 @@ in
listenWeb = caddy.ports.port1;
listenHttp = service.ports.port0;
localDomain = host;
serviceEnvironmentFile = config.sops.secrets."${service.name}-root".path;
serviceEnvironmentFile = config.sops.secrets."${service.name}/root".path;
user = service.name;
plugins = {
enable = true;
@ -43,7 +43,7 @@ in
};
secrets = {
secretsFile = config.sops.secrets."${service.name}-secret".path;
secretsFile = config.sops.secrets."${service.name}/secret".path;
};
settings = {
instance = {
@ -64,16 +64,16 @@ in
};
database = {
createLocally = true;
passwordFile = config.sops.secrets."${service.name}-database".path;
passwordFile = config.sops.secrets."${service.name}/database".path;
};
redis = {
enableUnixSocket = true;
createLocally = true;
passwordFile = config.sops.secrets."${service.name}-redis".path;
passwordFile = config.sops.secrets."${service.name}/redis".path;
};
smtp = {
createLocally = true;
passwordFile = config.sops.secrets."${service.name}-smtp".path;
passwordFile = config.sops.secrets."${service.name}/smtp".path;
};
};
@ -94,7 +94,7 @@ in
sops =
let
sopsPath = secret: {
path = "${service.sops.path0}/${service.name}-${secret}-pass";
path = "${service.sops.path0}/${service.name}/${secret}";
owner = service.name;
mode = "600";
};
@ -103,7 +103,7 @@ in
secrets = builtins.listToAttrs (
map
(secret: {
name = "${service.name}-${secret}";
name = "${service.name}/${secret}";
value = sopsPath secret;
})
[

1
modules/nixos/services/restic/default.nix
View file

@ -1,7 +1,6 @@
{
config,
flake,
pkgs,
...
}:
let

2
modules/nixos/services/searx/config/server.nix
View file

@ -11,7 +11,7 @@ in
port = configHelpers.service.ports.port0;
bind_address =
if configHelpers.hostname == ceres.name then ceres.wireguard.ip0 else configHelpers.localhost;
secret_key = config.sops.secrets.searx-key.path;
secret_key = config.sops.secrets."searx/key".path;
limiter = false;
public_instance = false;
image_proxy = true;

2
modules/nixos/services/searx/default.nix
View file

@ -82,7 +82,7 @@ in
secrets = builtins.listToAttrs (
map
(secret: {
name = "${configHelpers.service.name}-${secret}";
name = "${configHelpers.service.name}/${secret}";
value = sopsPath secret;
})
[