move secrets

nixos/configuration.nix

@@ -22,7 +22,7 @@
       generateKey = true;
     };
 
-    # I prefer to use json format for the secrets
+    # I prefer to use json format for the secrets (no I don't)
     defaultSopsFormat = "json";
 
     # Define file and key for each secret

test-vms/.sops.yaml

@@ -5,6 +5,7 @@ keys:
     - &nixos-homelab-00 age16ht8xkm70pmhl28m6g5fr3gl7xtsec37y57wauee6jqu06678ctqfw87ml
     - &nixos-homelab-00-user age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7
 creation_rules:
+  - path_regex: '^[^/]+/secrets/[^/]+\.(yaml|json|env|ini)$'
   - path_regex: secrets/[^/]+\.(yaml|json|env|ini)$
     key_groups:
       - age:

test-vms/vm-test/flake.nix

@@ -3,7 +3,7 @@
 
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
-    postgresql-db.url = "path:../postgresql-db";
+    postgresql-db.url = "path:../homelab-services/postgresql-db";
   };
 
   outputs =

test-vms/vm-test/virtual.nix

@@ -15,6 +15,30 @@
     ];
   };
 
+  # ================================ #
+  #               SOPS               #
+  # ================================ #
+
+  sops = {
+    # make sure that the age key is generated from the persisted host key
+    age = {
+      sshKeyPaths = [ "/persist/etc/ssh/ssh_host_ed25519_key" ];
+      keyFile = "/persist/var/lib/sops-nix/key.txt";
+      generateKey = true;
+    };
+
+    defaultSopsFormat = "yaml";
+
+    "postgresql-credentials" = {
+      sopsFile = ./secrets/psql.yaml;
+      key = "credentials";
+      format = "yaml";
+      owner = "postgres";
+      group = "postgres";
+    };
+
+  };
+
   # ================================ #
   #            K3S SERVICE           #
   # ================================ #