nixos: gen 220 @ nix-pad — 2026-08-03 07:16

26.05.20260724.597283a (Yarara)

.sops.yaml

@@ -1,7 +1,7 @@
 keys:
-  - &server_key age1zvuvrnh9fymw06e83n8y98ymg7jx6qn337893mejylcy948d4aesh7fufv
+  - &thinkpad age1cd40qmufxzvw8dkml9340czqfq6ta3kxpjfj47jpavwn2t7ghywsxhqz79
 creation_rules:
   - path_regex: secrets/[^/]+\.yaml$
     key_groups:
       - age:
-          - *server_key
+          - *thinkpad

flake.lock

@@ -228,9 +228,30 @@
         "niri": "niri",
         "nixpkgs": "nixpkgs_2",
         "nixpkgs-unstable": "nixpkgs-unstable",
+        "sops-nix": "sops-nix",
         "wvkbd-src": "wvkbd-src"
       }
     },
+    "sops-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1783174389,
+        "narHash": "sha256-aCWC8ngycU7OdJrU2+Je3qf+1a2ykuBvpPhZT/9tXMc=",
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "rev": "f1406619a3884cd5c47992a70b8b35c9c0fcb4c9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "type": "github"
+      }
+    },
     "wvkbd-src": {
       "flake": false,
       "locked": {

flake.nix

@@ -9,6 +9,11 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    sops-nix = {
+      url = "github:Mic92/sops-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     # Desktop/Shell/UI
     niri.url = "github:sodiboo/niri-flake";
 
@@ -33,7 +38,7 @@
     };
   };
   
-  outputs = { nixpkgs, home-manager, niri, dms, dms-plugin-registry, danksearch, wvkbd-src, ... }@inputs: {
+  outputs = { nixpkgs, home-manager, sops-nix, niri, dms, dms-plugin-registry, danksearch, wvkbd-src, ... }@inputs: {
     nixosConfigurations = {
       thinkpad = nixpkgs.lib.nixosSystem {
         system = "x86_64-linux";
@@ -44,6 +49,7 @@
 
           niri.nixosModules.niri
           dms-plugin-registry.nixosModules.default
+          sops-nix.nixosModules.sops
 
           home-manager.nixosModules.home-manager
           {

home/programs/default.nix

@@ -5,5 +5,6 @@
     ./alacritty.nix
     ./git.nix
     ./nvim.nix
+    ./zsh.nix
   ];
 }

home/programs/zsh.nix

@@ -0,0 +1,15 @@
+{ config, pkgs, ... }:
+
+{
+  programs.zsh = {
+    initExtra = ''
+      if [ -f "/run/secrets/vaultwarden_clientid" ]; then
+        export BW_CLIENTID=$(cat /run/secrets/vaultwarden_clientid)
+      fi
+
+      if [ -f "/run/secrets/vaultwarden_clientsecret" ]; then
+        export BW_CLIENTSECRET=$(cat /run/secrets/vaultwarden_clientsecret)
+      fi
+    '';
+  };
+}

secrets/secrets.yaml

@@ -0,0 +1,17 @@
+vaultwarden_clientid: ENC[AES256_GCM,data:MpSoam3ioiN0EaXjReSOjbKTSUwDfw2UoYldGd4GuU3+Mj3ZakzsQlw=,iv:VlgZg67Bia2IkuKtf8gPEx0rodZZ/3l9PKGEt26ihoA=,tag:yoC7AQoAa7TMJTaPObtN8A==,type:str]
+vaultwarden_clientsecret: ENC[AES256_GCM,data:RXxgt4N2bv74quQgLQ1hQsk03DwpZ9MNMZVyL3n8,iv:jBSREKIY9CraTLtwEltN2Cj2otwwWwpu4aanymWNYJA=,tag:6+z/PmGaf088urBq3TPgWg==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzUzZKTk1jSmpjYjhhQVJt
+            RVo3WCtqem5HWk5XdlF6YSt2czNoRVZ5VWhFCkV5ZExYVHNsZUpkcjlqQWg3K2Zx
+            dnpRYUFDdUtzd3Y5bHFFOVM4WmJRancKLS0tIEhuc0dyTFFGdThmQlozL0JYeWt0
+            Q0FvNkQwZGV2TmlQK1dTRXF4cWRZVW8K+QYGO6qJjzQKsaogR7OkUPLFVvKNMOc9
+            +KnFObbq/Axz3wfRBqFKWFnSeJ+L4j1UWpzAuwXqaPFoBrLlcRWNbw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1cd40qmufxzvw8dkml9340czqfq6ta3kxpjfj47jpavwn2t7ghywsxhqz79
+    lastmodified: "2026-08-03T13:12:18Z"
+    mac: ENC[AES256_GCM,data:Rn5ihTmZg2nc7kBXUcaKg5Tlv0OgxadxL1Xh2FGI+FjZEBlhxBIPGGAXL8AlPZRoTIWofl3uUaeiP79p1TrAzaOxssM53cL39wpF2Zmk5YtdMM0Qks1Vtk7S+0QW97JoKESMFuzlBi7xmuhGKgCb8RHmleVa5WSvP2bcjOHpy8M=,iv:jKwVkaRwppHYoHSmeU8jE4NanNsirRqE1FWoCn+hLEE=,tag:L8aRqgkv56T4qA0h/JEjKg==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.2

system/security/default.nix

@@ -2,6 +2,7 @@
 
 {
   imports = [
+    ./sops.nix
     ./sudo.nix
     ./systemd.nix
     ./users.nix

system/security/sops.nix

@@ -0,0 +1,10 @@
+{ config, pkgs, ... }:
+
+{
+  sops.defaultSopsFile = ../../secrets/secrets.yaml;
+
+  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+
+  sops.secrets."vaultwarden_clientid".owner = config.users.users.jashton.name;
+  sops.secrets."vaultwarden_clientsecret".owner = config.users.users.jashton.name;
+}