sops-nix

.sops.yaml

@@ -0,0 +1,7 @@
+keys:
+  - &age age18uvtlgx442kkufwp6g42lfxk2ft3e4ksjhumdugjcc7uclyzj9vqk9f8fw
+creation_rules:
+  - path_regex: secrets/[^/]+\.(yaml|json|env|ini)$
+    key_groups:
+    - age:
+      - *age

common.nix

@@ -50,6 +50,7 @@
     amneziawg-go
     amneziawg-tools
     sbctl
+    sops
   ];
   services = {
     logind.settings.Login.HandleLidSwitch = "ignore";

home/common.nix

@@ -39,13 +39,9 @@
       extraConfig = ''
         unbind C-b
         set -g mouse on
-        set -g prefix M-d
-        set -g prefix M-f
         set-option -g focus-events on
         set -s set-clipboard external
         set-option -a terminal-features "xterm-256color:RGB"
-        bind f send-prefix
-        bind d send-prefix
         bind h select-pane -L
         bind j select-pane -D
         bind k select-pane -U

home/server/bogale.nix

@@ -1,4 +1,4 @@
 { config, pkgs, ... }:
 {
-  imports = [ ../bogale.nix ];
+  imports = [ ./common.nix ../bogale.nix ];
 }

home/server/common.nix

@@ -0,0 +1,7 @@
+{ config, pkgs, ... }:
+{
+  programs.tmux.extraConfig = ''
+    set -g prefix M-d
+    bind d send-prefix
+  '';
+}

home/server/root.nix

@@ -1,6 +1,6 @@
 { config, pkgs, ... }:
 {
-  imports = [ ../root.nix ];
+  imports = [ ./common.nix ../root.nix ];
   programs.bash = {
     shellAliases = { "nixos-rebuild" = "nixos-rebuild --impure --flake /etc/nixos/server#nixos-server"; };
   };

server/configuration.nix

@@ -2,6 +2,9 @@
 {
   imports = [ ../common.nix ./hardware-configuration.nix ];
   boot.kernelParams = [ "memmap=0x4000%0xbfb76000-4" "memmap=0x4000%0xbfb7a000-4" ];
+  users.users.bogale.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKH8f3tKQQFFCkLS76TcY7oPzmbVrTkMZN7KSDHPX4o1"
+  ];
   networking = {
     hostName = "nixos-server";
     networkmanager.ensureProfiles.profiles.home-wifi = {

server/flake.lock

@@ -40,7 +40,28 @@
     "root": {
       "inputs": {
         "home-manager": "home-manager",
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": "nixpkgs",
+        "sops-nix": "sops-nix"
+      }
+    },
+    "sops-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1788914643,
+        "narHash": "sha256-4GuMPW90JSxXWDPUB9M+1m7fYbe3H0apOd86/zBQ2Kw=",
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "rev": "13616fff713a9f94055c66f15687ebdc17a335df",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "type": "github"
       }
     }
   },

server/flake.nix

@@ -1,15 +1,20 @@
 {
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
+    sops-nix = {
+      url = "github:Mic92/sops-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     home-manager = {
       url = "github:nix-community/home-manager/release-26.05";
       inputs.nixpkgs.follows = "nixpkgs";
     };
   };
-  outputs = inputs@{ self, nixpkgs, home-manager, ... }: {
+  outputs = inputs@{ self, nixpkgs, sops-nix, home-manager, ... }: {
     nixosConfigurations.nixos-server = nixpkgs.lib.nixosSystem {
       modules = [
         ./configuration.nix
+        sops-nix.nixosModules.sops
         home-manager.nixosModules.home-manager
         {
           home-manager.useGlobalPkgs = true;