cleanup

modules/nixos/boot/default.nix

@@ -1,9 +1,24 @@
-{ ... }:
+{ pkgs, system, lib, ... }:
+let
+  isArm = ("aarch64-linux" == system);
+in
 {
   boot = {
     kernelParams = [
       "quiet"
     ];
+
+    binfmt = lib.mkIf isArm {
+      registrations."x86_64-linux" = {
+        magicOrExtension = ''\x7fELF\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x3e\x00'';
+        mask = ''\xff\xff\xff\xff\xff\xfe\xfe\x00\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff'';
+        openBinary = true;
+        interpreter = "${pkgs.box64}/bin/box64";
+        preserveArgvZero = true; 
+        matchCredentials = true;
+        fixBinary = false;
+      };
+    };
   };
 
   zramSwap.enable = true;

modules/nixos/boot/lanzaboote/default.nix

@@ -1,4 +1,4 @@
-{ config, lib, namespace, inputs, ... }:
+{ config, lib, namespace, ... }:
 with lib;
 let
   cfg = config.${namespace}.bootloader.lanzaboote;

modules/nixos/sops/default.nix

@@ -0,0 +1,65 @@
+{ config, lib, ... }:
+{
+  # Permission modes are in octal representation (same as chmod),
+  # the digits represent: user|group|others
+  # 7 - full (rwx)
+  # 6 - read and write (rw-)
+  # 5 - read and execute (r-x)
+  # 4 - read only (r--)
+  # 3 - write and execute (-wx)
+  # 2 - write only (-w-)
+  # 1 - execute only (--x)
+  # 0 - none (---)
+  # Either a user id or group name representation of the secret owner
+  # It is recommended to get the user name from `config.users.users.<?name>.name` to avoid misconfiguration
+  # Either the group id or group name representation of the secret group
+  # It is recommended to get the group name from `config.users.users.<?name>.group` to avoid misconfiguration
+  sops = {
+    defaultSopsFile = (lib.snowfall.fs.get-file "secrets/secrets.yaml");
+    age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+
+    # ------------------------------
+    # Secrets
+    # ------------------------------
+    secrets = {
+      "wifi" = { };
+
+      # ------------------------------
+      # SSH keys
+      # ------------------------------
+      # "ssh-keys-public/desktop-nixos" = {
+      #   sopsFile = ../../secrets/secrets.yaml;
+      #   mode = "0644";
+      #   owner = config.users.users."${user}".name;
+      #   group = config.users.users."${user}".group;
+      #   restartUnits = [ "sshd.service" ];
+      # };
+      # "ssh-keys-private/desktop-nixos" = {
+      #   sopsFile = ../../secrets/secrets.yaml;
+      #   mode = "0600";
+      #   owner = config.users.users."${user}".name;
+      #   group = config.users.users."${user}".group;
+      #   restartUnits = [ "sshd.service" ];
+      # };
+      # "ssh-keys-public/desktop-nixos-root" = {
+      #   sopsFile = ../../secrets/secrets.yaml;
+      #   path = "/root/.ssh/id_ed25519.pub";
+      #   mode = "0600";
+      #   restartUnits = [ "sshd.service" ];
+      # };
+      # "ssh-keys-private/desktop-nixos-root" = {
+      #   sopsFile = ../../secrets/secrets.yaml;
+      #   path = "/root/.ssh/id_ed25519";
+      #   mode = "0600";
+      #   restartUnits = [ "sshd.service" ];
+      # };
+    };
+
+    # ------------------------------
+    # Templates
+    # ------------------------------
+    templates = {
+      # ...
+    };
+  };
+}