From 4c77440f316c7d17ecbd0dc806c2a1fb38797f36 Mon Sep 17 00:00:00 2001
From: Roy Dumblauskas <roydumblauskas@gmail.com>
Date: Thu, 17 Sep 2026 21:40:25 -0500
Subject: [PATCH] move secrets

---
 nixos/configuration.nix                       |  2 +-
 test-vms/.sops.yaml                           |  1 +
 test-vms/{ => vm-test}/flake.lock             |  0
 test-vms/{ => vm-test}/flake.nix              |  2 +-
 .../{ => vm-test}/secrets/psql-example.yaml   |  0
 test-vms/{ => vm-test}/virtual.nix            | 24 +++++++++++++++++++
 6 files changed, 27 insertions(+), 2 deletions(-)
 rename test-vms/{ => vm-test}/flake.lock (100%)
 rename test-vms/{ => vm-test}/flake.nix (90%)
 rename test-vms/{ => vm-test}/secrets/psql-example.yaml (100%)
 rename test-vms/{ => vm-test}/virtual.nix (66%)

diff --git a/nixos/configuration.nix b/nixos/configuration.nix
index c294d42..914acf1 100755
--- a/nixos/configuration.nix
+++ b/nixos/configuration.nix
@@ -22,7 +22,7 @@
       generateKey = true;
     };
 
-    # I prefer to use json format for the secrets
+    # I prefer to use json format for the secrets (no I don't)
     defaultSopsFormat = "json";
 
     # Define file and key for each secret
diff --git a/test-vms/.sops.yaml b/test-vms/.sops.yaml
index ebf052f..6545e53 100644
--- a/test-vms/.sops.yaml
+++ b/test-vms/.sops.yaml
@@ -5,6 +5,7 @@ keys:
     - &nixos-homelab-00 age16ht8xkm70pmhl28m6g5fr3gl7xtsec37y57wauee6jqu06678ctqfw87ml
     - &nixos-homelab-00-user age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7
 creation_rules:
+  - path_regex: '^[^/]+/secrets/[^/]+\.(yaml|json|env|ini)$'
   - path_regex: secrets/[^/]+\.(yaml|json|env|ini)$
     key_groups:
       - age:
diff --git a/test-vms/flake.lock b/test-vms/vm-test/flake.lock
similarity index 100%
rename from test-vms/flake.lock
rename to test-vms/vm-test/flake.lock
diff --git a/test-vms/flake.nix b/test-vms/vm-test/flake.nix
similarity index 90%
rename from test-vms/flake.nix
rename to test-vms/vm-test/flake.nix
index d6e8bb8..3f5ab9a 100644
--- a/test-vms/flake.nix
+++ b/test-vms/vm-test/flake.nix
@@ -3,7 +3,7 @@
 
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
-    postgresql-db.url = "path:../postgresql-db";
+    postgresql-db.url = "path:../homelab-services/postgresql-db";
   };
 
   outputs =
diff --git a/test-vms/secrets/psql-example.yaml b/test-vms/vm-test/secrets/psql-example.yaml
similarity index 100%
rename from test-vms/secrets/psql-example.yaml
rename to test-vms/vm-test/secrets/psql-example.yaml
diff --git a/test-vms/virtual.nix b/test-vms/vm-test/virtual.nix
similarity index 66%
rename from test-vms/virtual.nix
rename to test-vms/vm-test/virtual.nix
index 8f97edf..b9517b5 100644
--- a/test-vms/virtual.nix
+++ b/test-vms/vm-test/virtual.nix
@@ -15,6 +15,30 @@
     ];
   };
 
+  # ================================ #
+  #               SOPS               #
+  # ================================ #
+
+  sops = {
+    # make sure that the age key is generated from the persisted host key
+    age = {
+      sshKeyPaths = [ "/persist/etc/ssh/ssh_host_ed25519_key" ];
+      keyFile = "/persist/var/lib/sops-nix/key.txt";
+      generateKey = true;
+    };
+
+    defaultSopsFormat = "yaml";
+
+    "postgresql-credentials" = {
+      sopsFile = ./secrets/psql.yaml;
+      key = "credentials";
+      format = "yaml";
+      owner = "postgres";
+      group = "postgres";
+    };
+
+  };
+
   # ================================ #
   #            K3S SERVICE           #
   # ================================ #