map sops decrypt

virtual-machines/vm-test/flake.nix

@@ -15,10 +15,23 @@
       nixpkgs,
       postgresql-db,
     }@inputs:
+    let
+      credentialMap = builtins.listToAttrs (
+        map (filename: {
+          name = builtins.replaceStrings [ ".env" ] [ "-env" ] filename;
+          value = nixpkgs.runCommand "sops-decrypt-${filename}" { } ''
+            ${nixpkgs.sops}/bin/sops -d ${./secrets}/${filename} > $out
+          '';
+        }) (builtins.attrNames (builtins.readDir ./secrets))
+      );
+    in
     {
       nixosConfigurations = {
         vm = nixpkgs.lib.nixosSystem {
           system = "x86_64-linux";
+          specialArgs = {
+            credentials = credentialMap;
+          };
           modules = [
             ./virtual.nix
             postgresql-db.nixosModules.postgresql-db

virtual-machines/vm-test/secrets/psql.env

@@ -0,0 +1,13 @@
+PSQL_TEST_PASSWORD=ENC[AES256_GCM,data:23yfH/WahP629zM=,iv:d7MCyz1OD/Ns1D4KMMtOhMMnG3WVXG406sUA5Xv0eFw=,tag:QTa5Akrd/co03MZn5C2VPA==,type:str]
+sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqajEzaWhqYlNSSEhxbjRs\nMEREcERmYkJGdmUvbzZtMlNCMWJUT2tRUVVRCkVPN2FqZG1mZTNDOWJVZHh6NXdF\neFYvKzYxUHBGUXNjaHdKWTc5MGd3Yk0KLS0tIHBGS1VqalV4Tm5CVFlxOUNib3V1\nMzRvdm5qMWd2OVNiWWtrUkdCWFFQMUEKLh+tvS3KUpHeIiAPBx7po/bbQ942gyy/\nZMTiPiHVkQCr7RLWpuih66FeLgKmHpISKndif1mCFH/kwkTKJhQOtg==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_0__map_recipient=age1zad0qu648dhjav4pzjhkc6vswnqtacuv9230xcgle8wmv56r8ykqn0ud7y
+sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyMmRqSW9SbUZsVm5zU0xY\na0lHVnpNZ0pveVVWUnpEWEtaMVhRQ3VTTFNzCjJzL3lHRnJ0eHpmQWxvR2Z1RDdV\nc2hJZzV2a1JNSWh1c0VuYU5tQlRhZkUKLS0tIGZpeHdvdlAzczIxbW5vNXRLOXpF\naUxhdWlDZzBMNWUyeTM4VVdwQmtYeU0KA0UZzBozm413H/YE77FHuoodtekulfLB\nj2bFxv98zsAFQXsD6+HIMdszWn83LoyV/SMPleZO9DgC4crQ/j8G8A==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_1__map_recipient=age1rwugh86469664fwhgrj9xuhjxs9vpflx3r0ftuvd0glphf2gecfs8thxsj
+sops_age__list_2__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1SmQ1TG04R0tHSkd1Ylhu\ndlY1SCtYV1Y5UWlaVUI0SHUvc2oxWTBQMXhJCkF4REtzOVlqR1p4QldueDZzOEpt\nNWNHUGJQajVNUUExM2dIVXFyV3NyNHcKLS0tIFpZQXphQ3JSSmlhMklXNlE0V1lY\nYzZ3OGtqcWcrWFJhYU5FWWdmZ0RHaWMKDheQK5USDzIbnCivqfCIOkRY083qMOIr\nN4paOFd7jej/esvnItFjr8mZWWihYNeozz2Nym0ves5WtkCV+bX3Kg==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_2__map_recipient=age16ht8xkm70pmhl28m6g5fr3gl7xtsec37y57wauee6jqu06678ctqfw87ml
+sops_age__list_3__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjcUMwcWwvZGxTZkNwQmsx\nb005SW5TQXAxQ1AwbEYwZEZWaEduY2FJMkJrClF5RkZ6SU43aDl4RE5RVkdnSm42\ncEd0UTNNL3c4SGM1ZnlMcncwV3QxQUkKLS0tIHZPTWt1a2dsMVJDcEpBUjM3YUNi\nb2p4WmFUZlpCYllYQWVxM2dxVHFjbUUKPxUS7/fNKIKr/11p0Do77jmyGnJmc8p7\ntL2MOZW3eZB9GrxcUkjbGGKktPrKf03kIia2fHUgB1X6kSFPfRTYDQ==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_3__map_recipient=age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7
+sops_lastmodified=2026-09-26T06:04:51Z
+sops_mac=ENC[AES256_GCM,data:Q4AhgLZLR6hSSiwextwm53DHKKeSN+YSLKyQGNfZG/sb/c+4QOQxYXZD2YXShbOei1Og+IqcVCkJy+CaYAE6roz04AxnQgis3anVOSOAMAcezFndXU/f80pqkikj/o14O6ueOi/2gQMJND9HHEZSJBAwpJbsX1CLru16Uv2gkaY=,iv:nItKXHq2sgw8ijA5d/DxeTAafkwIUuxJXyXOP8gDuL0=,tag:oNYfflLLKhhQN8H1DRBVUQ==,type:str]
+sops_unencrypted_suffix=_unencrypted
+sops_version=3.13.3

virtual-machines/vm-test/secrets/psql.yaml

@@ -1,43 +0,0 @@
-credentials: ENC[AES256_GCM,data:T/Kzi6zxovx5/xFZ9RU5g8qrCs+g7O2CNyRmpHbNLQ==,iv:ZExSJqPOq5u+YCAbFnqkonhMC47LQYFkRYwe6d799e0=,tag:mZ0WQaMMTBnUwlsOs/dS4Q==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4UitrR2Y3WitTK3BNN3l4
-            anBRMnBmNnlsSnFYMzZSTkorTXdhMzMrQlQ4Ck1hbExpcEhUdlNwRkZUcDlQTmYy
-            WG9OaVFQVVhnc25TWkdwYysvd1VOSWcKLS0tIFBDZmlRNjc1VFRXR1JoR09TOWI4
-            R0h3QkNSRDZjNDlSQkZhMjRUcy9CK3cKDW65gGvBAWVfd1ir2ri3Kd+ISESCAZB6
-            B45JhFGzbi0DZ6OY1ehVT7cQZBnz9pBDw7I/mcu5Rx1kvYkxPRgFAg==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1zad0qu648dhjav4pzjhkc6vswnqtacuv9230xcgle8wmv56r8ykqn0ud7y
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaRFJRTkszTnNUbGF6aG5m
-            RW1PTzBzMEdBT1Q2RFpoc1BnNi9MNFVFdFZZCkpKanNaUURSNStxQ3NKQWtjUi9N
-            QlVKeWFacUVXdjRzSHVPazFCODRPbjAKLS0tIDdhN1NSTUJseFNaVTJOZTY5MmhM
-            TGVqa0V6WnprZlhrOC9oS2I3WVBiVjQKTQ/7m3lg5YwcSdyanuqHsPwyoDJdrfRc
-            XX+vVpPChmM5Mne/Bgb6TyLqYuhj0vcd748rnoVmRGBIvGE9xBtCbg==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1rwugh86469664fwhgrj9xuhjxs9vpflx3r0ftuvd0glphf2gecfs8thxsj
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyOVErNmJXRUxZQ0Q3eHd6
-            VitvY0R1clMxenpKUnhYeUt2ekI1YkozWWhRCmppOSs0c1ZUdW5LL1p0WElLRnRz
-            MmFVYW5hRXJya3hyMzFxVzBpUFVJOVUKLS0tIGtPYjliMWpYS1hMYmpaenM1YVRo
-            UDBHS1JPRXNhdlRWU01xNDJuQUk2RlkK8nLganJJZR4OkhtjDuQEIERV+HBrZkso
-            6ikhW5GMtxyMur8Wj9PoF+98EU3qn9qmLeXrLeB/xgLtCp39bi+6Vg==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age16ht8xkm70pmhl28m6g5fr3gl7xtsec37y57wauee6jqu06678ctqfw87ml
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZU0JxUmJBQ1pweWJkVjln
-            OUlsZkhuVjgxQnQ3N3RIcjdUZ1JzblNLS1ZrClozOHZNNlh0clBxSzd5SGpoN1Vj
-            Nm5ydkg4K1RiTWczSDE3SWV0SjEvMDAKLS0tIGNJL3dpMHpsaWl6dnVCRVdMTXg0
-            NFU4QkhrVWFGdlhpVGkzcE9vVGNIc3cKiM41U2ctBiHgrIGPb3ApoAcqgcls0Sjp
-            Wlwsl8I8AwyUYcuLBGTk8WvXRpJI598im/54tZ8sPa7tmokOOilF7w==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7
-    lastmodified: "2026-09-18T02:51:05Z"
-    mac: ENC[AES256_GCM,data:Cz1+2ZKOZPX58lHM+U0JyHiSaOO3hzH4FzyxepksuAZNxFCZt8EtsXx99Afb4VCYid3+BWfmwAfd2XAgD0UR3rBCm6BwPd0wujOvv5YpZaDYKHcqVn8JaTuxQldDCArnf0Duks2iAyw6HCgL9LHABX3JRoQgNvz9Kp6oYW1Fsjk=,iv:HBTNsUL5O1YYqADvJfY4Kz1rCbDHHtuDffM2Y7AAXo4=,tag:CpCSMvCVKHT6FohctSOD/g==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.13.3

virtual-machines/vm-test/virtual.nix

@@ -2,6 +2,7 @@
   config,
   pkgs,
   meta,
+  credentials,
   ...
 }:
 {
@@ -71,7 +72,7 @@
     enable = true;
     dataDir = "/var/lib/postgresql";
     port = 5432;
-    credentialsFile = "";
+    credentialsFile = credentials.psql;
     databases = [
       "test"
     ];