first compilation with secrets

nixos/.sops.yaml

@@ -2,7 +2,7 @@
 keys:
   - &homelab age1ldgnl53dmvl4fjz6hgdj0cvensagddn3ltpmxfm72m8q273w75fsk42p8v
 creation_rules:
-  - path_regex: secrets/[^/]+\.(yaml|json|env|ini)$
+  - path_regex: secrets/build.json$
     key_groups:
     - age:
       - *homelab

nixos/configuration.nix

@@ -6,6 +6,16 @@
   nix.settings.experimental-features = [ "nix-command" "flakes" ];
   nixpkgs.config.allowUnfree = true;
 
+  # Secret Management
+  sops = {
+    age.keyFile = "./age/keys.txt"; # Make sure to gitignore, contains private key.
+
+    defaultSopsFile = ./secrets/build.json;
+    defaultSopsFormat = "json";
+
+    secrets."nixos-homelab-00" = { };
+  };
+
   systemd.user.services.mbsync.unitConfig.After = [ "sops-nix.service" ];
 
   # Use the systemd-boot EFI boot loader.
@@ -25,6 +35,15 @@
 
   networking.hostName = meta.hostname;
 
+  networking.interfaces.eth0.ipv4.addresses = [
+    {
+      address = "${
+        config.sops.secrets."nixos-homelab-00".path
+      }";
+      prefixLength = 24;
+    }
+  ];
+
   # Set your time zone.
   time.timeZone = "America/Chicago";
 

nixos/flake.lock

@@ -188,7 +188,28 @@
         "disko": "disko",
         "home-manager": "home-manager",
         "nixpkgs": "nixpkgs",
-        "nixvim": "nixvim"
+        "nixvim": "nixvim",
+        "sops-nix": "sops-nix"
+      }
+    },
+    "sops-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1744669848,
+        "narHash": "sha256-pXyanHLUzLNd3MX9vsWG+6Z2hTU8niyphWstYEP3/GU=",
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "rev": "61154300d945f0b147b30d24ddcafa159148026a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "type": "github"
       }
     },
     "systems": {

nixos/flake.nix

@@ -36,13 +36,10 @@
           ./hardware-configuration.nix
           ./disk-config.nix
           disko.nixosModules.disko
-          sops-nix.nixosModule.sops
+          sops-nix.nixosModules.sops
           home-manager.nixosModules.home-manager {
             home-manager.useGlobalPkgs = true;
             home-manager.useUserPackages = true;
-            home-manager.sharedModules = [
-              sops-nix.homeManagerModules.sops
-            ];
             home-manager.users.sysAdmin = ./home.nix;
           }
         ];

nixos/hardware-configuration.nix

@@ -1 +1,25 @@
-throw "Have you forgotten to run nixos-anywhere with `--generate-hardware-config nixos-generate-config ./hardware-configuration.nix`?"
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "ehci_pci" "nvme" "usbhid" "sr_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp9s0f0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

nixos/home.nix

@@ -1,23 +1,10 @@
-{ config, pkgs, sops, ... }:
+{ config, pkgs, ... }:
 
 {
 
   home.username = "sysAdmin";
   home.homeDirectory = "/home/sysAdmin";
 
-  # Secret Management
-  sops = {
-    age.keyFile = "./age/keys.txt"; # Make sure to gitignore, contains private key.
-
-    defaultSopsFile = ./secrets/build.json;
-    defaultSymlinkPath = "/run/user/1000/secrets";
-    defaultSecretsMountPoint = "/run/user/1000/secrets.d";
-
-    secrets.homelabBuild = {
-      path = "${config.sops.defaultSymlinkPath}/homelabBuild";
-    };
-  };
-
   home.packages = with pkgs; [
     git
     tree

nixos/secrets/build.json

@@ -1,5 +1,8 @@
 {
-	"homelabBuild": "ENC[AES256_GCM,data:iW92f20svmfstA==,iv:dhyRn6z7jkDW+coxjEGOFBugbAn1bksAxV4AZG1wOvw=,tag:zNnogVY4wUk7xobqFqbfOA==,type:str]",
+	"nixos-homelab-00": "ENC[AES256_GCM,data:n2EGHj/PZz6MjERUjA==,iv:AWuggQHU5uQGl7nB43QC7W15q+hBmqBCx78Fr4ZWfeQ=,tag:qoOSd7/gt9EEZjZXtDQ8KQ==,type:str]",
+	"k8s": {
+		"clusterPass": "ENC[AES256_GCM,data:n2pfdUswKi6SGtPkpTg=,iv:dXeTDGUmgXKZJ7zJonzgz66C1r/T69UsckEu8q9SI7k=,tag:oY+Hkzy7IG/TbdGv5BDpkw==,type:str]"
+	},
 	"sops": {
 		"kms": null,
 		"gcp_kms": null,
@@ -11,8 +14,8 @@
 				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGZUs1ajViZTM4Smg3a1BU\nU05taWxTUGRzald0cnE3MWt1VzVtMGE0cHlvCnhWbVN0cFNSZDZMcVdXUXVtZUtM\nRzhmK1QvS1R6enNKRnRUdlRLdWhQZjQKLS0tIGJRWElaTWhCbm50Wk1ZRjBUbU5R\nZU9tUjhlR0xwQlU0WnNvQ1FBZGlRQWcK/+Vj6QoktFQ78CxJ8dSQGGqE72fxagA+\n10f60BNlWjWtkIZ2CmcjsDi1zLHny10MaKj9fyRvmBta6Inzra/maA==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
-		"lastmodified": "2025-04-16T01:52:40Z",
-		"mac": "ENC[AES256_GCM,data:cPctHLUzwdYaqagP4iZWGCuxyrFjMFgZK+2YcKo243xJGs8itYOJRKBphQtxEA+47vAAid7WL0R/iPLyK7UQB+y6MH1X96QfSOi/D4ASxGtPGifAbWbhVWCol+WuiwJa2uPjwE7Jj20j2PpXx1G1+r1HpIr8CKM/WQTRiSuOhKY=,iv:GhPyhvudNcvGfn6fZvjVQusZYj6AuESJmnHCaXqxZZA=,tag:th1hQueNoca6or2aukLEZQ==,type:str]",
+		"lastmodified": "2025-04-16T05:48:06Z",
+		"mac": "ENC[AES256_GCM,data:3WsNWzpFURYfOW1+Nel2cxq//SsYLOk7UWYlVldysGyiyf+hmwxwhOFRVEWEDD50k732wPO0OTXGGMf5Jp3ZpzwxWg1oROu7nmbVKzAxniqY5X4txzbyJeeVZGaitBwV2R7EBhvFGFgGsTfcY1f8vXxX7j6IX9xIwBCO48sHH4g=,iv:caoaGuVRx5351Ed7o37yYD7UZIo6yi98VV+2hq0ABSs=,tag:B6ZzpWGwG0Dg6TWEthQvCg==,type:str]",
 		"pgp": null,
 		"unencrypted_suffix": "_unencrypted",
 		"version": "3.9.4"