assertions

modules/nixos/sops/default.nix

@@ -14,6 +14,13 @@ in
   imports = [ ./options.nix ];
 
   config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.sshKeyPaths != [ ];
+        message = "mjallen.sops.sshKeyPaths must contain at least one SSH key path for age decryption.";
+      }
+    ];
+
     sops = {
       defaultSopsFile = if cfg.defaultSopsFile != null then cfg.defaultSopsFile else defaultSops;
       age.sshKeyPaths = cfg.sshKeyPaths;