cleanup

modules/nixos/sops/default.nix

@@ -0,0 +1,65 @@
+{ config, lib, ... }:
+{
+  # Permission modes are in octal representation (same as chmod),
+  # the digits represent: user|group|others
+  # 7 - full (rwx)
+  # 6 - read and write (rw-)
+  # 5 - read and execute (r-x)
+  # 4 - read only (r--)
+  # 3 - write and execute (-wx)
+  # 2 - write only (-w-)
+  # 1 - execute only (--x)
+  # 0 - none (---)
+  # Either a user id or group name representation of the secret owner
+  # It is recommended to get the user name from `config.users.users.<?name>.name` to avoid misconfiguration
+  # Either the group id or group name representation of the secret group
+  # It is recommended to get the group name from `config.users.users.<?name>.group` to avoid misconfiguration
+  sops = {
+    defaultSopsFile = (lib.snowfall.fs.get-file "secrets/secrets.yaml");
+    age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+
+    # ------------------------------
+    # Secrets
+    # ------------------------------
+    secrets = {
+      "wifi" = { };
+
+      # ------------------------------
+      # SSH keys
+      # ------------------------------
+      # "ssh-keys-public/desktop-nixos" = {
+      #   sopsFile = ../../secrets/secrets.yaml;
+      #   mode = "0644";
+      #   owner = config.users.users."${user}".name;
+      #   group = config.users.users."${user}".group;
+      #   restartUnits = [ "sshd.service" ];
+      # };
+      # "ssh-keys-private/desktop-nixos" = {
+      #   sopsFile = ../../secrets/secrets.yaml;
+      #   mode = "0600";
+      #   owner = config.users.users."${user}".name;
+      #   group = config.users.users."${user}".group;
+      #   restartUnits = [ "sshd.service" ];
+      # };
+      # "ssh-keys-public/desktop-nixos-root" = {
+      #   sopsFile = ../../secrets/secrets.yaml;
+      #   path = "/root/.ssh/id_ed25519.pub";
+      #   mode = "0600";
+      #   restartUnits = [ "sshd.service" ];
+      # };
+      # "ssh-keys-private/desktop-nixos-root" = {
+      #   sopsFile = ../../secrets/secrets.yaml;
+      #   path = "/root/.ssh/id_ed25519";
+      #   mode = "0600";
+      #   restartUnits = [ "sshd.service" ];
+      # };
+    };
+
+    # ------------------------------
+    # Templates
+    # ------------------------------
+    templates = {
+      # ...
+    };
+  };
+}