cleanup names

systems/x86_64-linux/matt-nixos/sops.nix

@@ -0,0 +1,91 @@
+{
+  config,
+  lib,
+  namespace,
+  ...
+}:
+let
+  user = config.${namespace}.user.name;
+  desktopSopsFile = (lib.snowfall.fs.get-file "secrets/desktop-secrets.yaml");
+in
+{
+  # Permission modes are in octal representation (same as chmod),
+  # the digits represent: user|group|others
+  # 7 - full (rwx)
+  # 6 - read and write (rw-)
+  # 5 - read and execute (r-x)
+  # 4 - read only (r--)
+  # 3 - write and execute (-wx)
+  # 2 - write only (-w-)
+  # 1 - execute only (--x)
+  # 0 - none (---)
+  # Either a user id or group name representation of the secret owner
+  # It is recommended to get the user name from `config.users.users.<?name>.name` to avoid misconfiguration
+  # Either the group id or group name representation of the secret group
+  # It is recommended to get the group name from `config.users.users.<?name>.group` to avoid misconfiguration
+  sops = {
+    # ------------------------------
+    # Secrets
+    # ------------------------------
+    secrets = {
+      "desktop/hass_token" = {
+        sopsFile = desktopSopsFile;
+        mode = "0777";
+      };
+      "desktop/restic/user" = {
+        sopsFile = desktopSopsFile;
+        mode = "0644";
+      };
+      "desktop/restic/password" = {
+        sopsFile = desktopSopsFile;
+        mode = "0600";
+      };
+      "desktop/restic/repo" = {
+        sopsFile = desktopSopsFile;
+        mode = "0600";
+      };
+      # ------------------------------
+      # SSH keys
+      # ------------------------------
+      "ssh-keys-public/desktop-nixos" = {
+        mode = "0644";
+        owner = config.users.users."${user}".name;
+        group = config.users.users."${user}".group;
+        restartUnits = [ "sshd.service" ];
+      };
+      "ssh-keys-private/desktop-nixos" = {
+        mode = "0600";
+        owner = config.users.users."${user}".name;
+        group = config.users.users."${user}".group;
+        restartUnits = [ "sshd.service" ];
+      };
+      "ssh-keys-public/desktop-nixos-root" = {
+        path = "/root/.ssh/id_ed25519.pub";
+        mode = "0600";
+        restartUnits = [ "sshd.service" ];
+      };
+      "ssh-keys-private/desktop-nixos-root" = {
+        path = "/root/.ssh/id_ed25519";
+        mode = "0600";
+        restartUnits = [ "sshd.service" ];
+      };
+    };
+
+    # ------------------------------
+    # Templates
+    # ------------------------------
+    templates = {
+      "restic.env" = {
+        mode = "0600";
+        content = ''
+          RESTIC_REST_USER=${config.sops.placeholder."desktop/restic/user"}
+          RESTIC_REST_PASSWORD=${config.sops.placeholder."desktop/restic/password"}
+        '';
+        restartUnits = [
+          "restic-backups-jallen-nas.service"
+          "restic-backups-proton-drive.service"
+        ];
+      };
+    };
+  };
+}