secrets

.sops.yaml

@@ -0,0 +1,7 @@
+keys:
+  - &user_roy age13ldedhh6ymava0d5dn54860a3f799gufknre9lfegegjt9ytes2qq5qgmr
+creation_rules:
+  - path_regex: secrets/[^/]+\.(yaml|json|env|ini)$
+    key_groups:
+    - age:
+      - *user_roy

home.nix

@@ -43,20 +43,20 @@
       "rp"
       ".mozilla/firefox/roy/storage/default"
       ".cache/mozilla/firefox/roy"
+      "age"
     ];
     files = [
       ".bash_history"
       ".mozilla/firefox/roy/places.sqlite"
       ".mozilla/firefox/roy/cookies.sqlite"
+      ".config/sops/age/keys.txt"
     ];
     allowOther = true;
   };
 
   # SOPS config
   sops = {
-    age.sshKeyPaths = [ "/home/roy/.ssh/id_ed25519" ];
-    age.keyFile = "/persist/home/roy/age-key.txt";
-    age.generateKey = true;
+    age.keyFile = "/persist/home/roy/age/.age-key.txt";
     defaultSopsFormat = "json";
     defaultSopsFile = ./secrets/roy.json;
     # secrets.test = {

secrets/roy.json

@@ -0,0 +1,15 @@
+{
+	"testKey": "ENC[AES256_GCM,data:ajwGOMBfWMpnZxY=,iv:dEH/rvFRPjz11s9dxMUZ7+8PRgGEHdCHgd8f3mTct8w=,tag:ttLv52lYX/zmjNe/e9Ijww==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age13ldedhh6ymava0d5dn54860a3f799gufknre9lfegegjt9ytes2qq5qgmr",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByQjhlbmFna3dxalhsZlUr\nYjZ4aGVQNzZtc1NSc0dQYzA3N2JOVXN2V1hNCjcvbWxpSFVJbW14ODczcFFxTE1W\nOGd2SFo3RG1oZ1VIUTRFYmZPRzhjWjAKLS0tIEwvb3FaMHVFZmdmalhjMmt0N01z\nbHNVVDRTbi84Um4rc3lSQmRmUmc4bzgKbbrWh0AYZKgGMeiHwJnushI7wfSYJbrM\nmsHhOSC6It92ldORp10OXhknLzOpUf1vGPI//R7VB84j0cY1qt36cw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-06-10T15:34:46Z",
+		"mac": "ENC[AES256_GCM,data:8l/XINJNCEX2aTXhFTOpS4BpBRYNAhqQdJMBixj9XNNKLZ9mGTkLMRTuJELfW1bxHcChCln3kmhdAzcU3ZWRCjKfyFj9H/AnmPIhbVu8BbGIEffTqcxUn0m+W8SsMfRkHtWA/mK2gBjg8oczBcEAfW3IVB5JAPwjfa2Q6EOQO+E=,iv:3hFOEyyReYHZv0uQ5sqaGkjcuIWQpOx48zm/AyBG1Us=,tag:TIIfwqjJuaYXkpYKw2NIMA==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.10.2"
+	}
+}