fix: Fix sops

.sops.yaml

@@ -0,0 +1,7 @@
+keys:
+  - &primkey age199lxhl3xjuf0xxgskxa3kdz89atnt6689g0pqr6kup4kvqe49vmsq63t35
+creation_rules:
+  - path_regex: secrets/[^/]+\.(yaml|json|env|ini)$
+    key_groups:
+    - age:
+      - *primkey

data/id_user.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBSbHYeYqUlBQKZywVto5FqpIEosRvssnAsDKnL8nUa4 greysoh@pine

flake.nix

@@ -13,6 +13,10 @@
       url = "github:viperML/nh";
       inputs.nixpkgs.follows = "nixpkgs-unstable";
     };
+    nix-secrets = {
+      url = "git+https://git.terah.dev/imterah/sops?shallow=1&ref=main";
+      flake = false;
+    };
   };
 
   outputs = {

hosts/andromeda/configuration.nix

@@ -16,14 +16,13 @@
     ../../system/i18n.nix
   ];
 
-  sops.secrets.tera-password.neededForUsers = true;
   users.mutableUsers = false;
 
   users.users.tera = {
     uid = 1000;
     description = "Tera";
     home = "/home/tera";
-    hashedPasswordFile = config.sops.secrets.tera-password.path;
+    hashedPasswordFile = config.sops.secrets.tera_password.path;
     isNormalUser = true;
     createHome = true;
     shell = pkgs.bash;

secrets

@@ -1 +1 @@
-Subproject commit ed485bba5151879e9b598fd18e6970624b0d21e5
+Subproject commit c07d110d71e32ff5fabf0219bc9cadab47d3d2a7

system/impermanence.nix

@@ -1,6 +1,7 @@
 {lib, ...}: {
   fileSystems."/persist".neededForBoot = true;
   fileSystems."/nix".neededForBoot = true;
+
   boot.initrd.postDeviceCommands = lib.mkAfter ''
     mkdir /btrfs_tmp
     mount /dev/root_vg/root /btrfs_tmp
@@ -25,12 +26,14 @@
     btrfs subvolume create /btrfs_tmp/root
     umount /btrfs_tmp
   '';
+
   environment.persistence."/persist" = {
     enable = true;
     hideMounts = true;
     directories = [
       "/var/log"
       "/var/lib/nixos"
+      "/var/lib/docker"
       "/var/lib/systemd/coredump"
       "/etc/nixos"
       "/etc/NetworkManager"
@@ -39,7 +42,7 @@
       "/etc/machine-id"
       "/etc/ssh/ssh_host_ed25519_key"
       "/etc/ssh/ssh_host_ed25519_key.pub"
-      #"/var/lib/sops-nix/key.txt"
+      "/var/lib/sops-nix/key.txt"
     ];
   };
 }

system/sops.nix

@@ -1,12 +1,21 @@
-{inputs, ...}: {
+{inputs, ...}; let
+  secretspath = builtins.toString inputs.nix-secrets;
+in
+{
   imports = [
     inputs.sops-nix.nixosModules.sops
   ];
 
-  sops.defaultSopsFile = "${../secrets/secrets.yaml}";
-  sops.validateSopsFiles = false;
-  sops.defaultSopsFormat = "yaml";
-  sops.age.keyFile = "/persist/var/lib/sops-nix/key.txt";
-  sops.age.sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
-  sops.age.generateKey = true;
+  sops = {
+    defaultSopsFile = "${secretspath}/secrets.yaml";
+    age = {
+      keyFile = "/var/lib/sops-nix/key.txt";
+      generateKey = false;
+    };
+    secrets = {
+      tera_passwd = {
+        neededForUsers = true;
+      };
+    };
+  };
 }