sops secret setup

nixos/.sops.yaml

@@ -0,0 +1,8 @@
+
+keys:
+  - &homelab age1ldgnl53dmvl4fjz6hgdj0cvensagddn3ltpmxfm72m8q273w75fsk42p8v
+creation_rules:
+  - path_regex: secrets/[^/]+\.(yaml|json|env|ini)$
+    key_groups:
+    - age:
+      - *homelab

nixos/configuration.nix

@@ -6,6 +6,8 @@
   nix.settings.experimental-features = [ "nix-command" "flakes" ];
   nixpkgs.config.allowUnfree = true;
 
+  systemd.user.services.mbsync.unitConfig.After = [ "sops-nix.service" ];
+
   # Use the systemd-boot EFI boot loader.
   # boot.loader.systemd-boot.enable = true;
   # boot.loader.efi.canTouchEfiVariables = true;

nixos/flake.nix

@@ -40,6 +40,9 @@
           home-manager.nixosModules.home-manager {
             home-manager.useGlobalPkgs = true;
             home-manager.useUserPackages = true;
+            home-manager.sharedModules = [
+              sops-nix.homeManagerModules.sops
+            ];
             home-manager.users.sysAdmin = ./home.nix;
           }
         ];

nixos/home.nix

@@ -1,10 +1,23 @@
-{ config, pkgs, ... }:
+{ config, pkgs, sops, ... }:
 
 {
 
   home.username = "sysAdmin";
   home.homeDirectory = "/home/sysAdmin";
 
+  # Secret Management
+  sops = {
+    age.keyFile = "/home/sysAdmin/.config/sops/age/keys.txt"; # No password!
+
+    defaultSopsFile = ./secrets/build.json;
+    defaultSymlinkPath = "/run/user/1000/secrets";
+    defaultSecretsMountPoint = "/run/user/1000/secrets.d";
+
+    secrets.homelabBuild = {
+      path = "${config.sops.defaultSymlinkPath}/homelabBuild";
+    };
+  };
+
   home.packages = with pkgs; [
     git
     tree

nixos/secrets/build.json

@@ -0,0 +1,20 @@
+{
+	"homelabBuild": "ENC[AES256_GCM,data:iW92f20svmfstA==,iv:dhyRn6z7jkDW+coxjEGOFBugbAn1bksAxV4AZG1wOvw=,tag:zNnogVY4wUk7xobqFqbfOA==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age1ldgnl53dmvl4fjz6hgdj0cvensagddn3ltpmxfm72m8q273w75fsk42p8v",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGZUs1ajViZTM4Smg3a1BU\nU05taWxTUGRzald0cnE3MWt1VzVtMGE0cHlvCnhWbVN0cFNSZDZMcVdXUXVtZUtM\nRzhmK1QvS1R6enNKRnRUdlRLdWhQZjQKLS0tIGJRWElaTWhCbm50Wk1ZRjBUbU5R\nZU9tUjhlR0xwQlU0WnNvQ1FBZGlRQWcK/+Vj6QoktFQ78CxJ8dSQGGqE72fxagA+\n10f60BNlWjWtkIZ2CmcjsDi1zLHny10MaKj9fyRvmBta6Inzra/maA==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-04-16T01:52:40Z",
+		"mac": "ENC[AES256_GCM,data:cPctHLUzwdYaqagP4iZWGCuxyrFjMFgZK+2YcKo243xJGs8itYOJRKBphQtxEA+47vAAid7WL0R/iPLyK7UQB+y6MH1X96QfSOi/D4ASxGtPGifAbWbhVWCol+WuiwJa2uPjwE7Jj20j2PpXx1G1+r1HpIr8CKM/WQTRiSuOhKY=,iv:GhPyhvudNcvGfn6fZvjVQusZYj6AuESJmnHCaXqxZZA=,tag:th1hQueNoca6or2aukLEZQ==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.9.4"
+	}
+}