sops: generate the config with nix

.sops.yaml

@@ -1,53 +0,0 @@
-keys:
-  - &admin age1mpq8m4p7dnxh5ze3fh7etd2k6sp85zdnmp9te3e9chcw4pw07pcq960zh5
-
-  # Hosts
-  - &alto age1qz04yg4h4g22wxqca2pd5k0z574223f6m5c9jy5ny37nlgcd6u4styf06t
-  - &cirrus age1dnpwfwh0h95r63e5qfjc2gvffw2tr2tx4new7sq2h3qs90kx9fmq322mx4
-  - &cumulus age1dnru7l0agvnw3t9kmx60u4vh5u4tyd49xdve53zspxkznnp9f34qtec9dl
-  - &fern age1sywwrwse76x8yskrsfpwk38fu2cmyx5s9qkf2pgc68cta0vj9psql7dp6e
-  - &north age18x6herevmcuhcmeh47ll6p9ck9zk4ga6gfxwlc8yl49rwjxm7qusylwfgc
-
-  # Users
-  - &seb-fern age190mf9wx4ct7qvne3ly9j3cj9740z5wnfhsl6vsc5wtfyc5pueuas9hnjtr
-  - &seb-north age1p32cyzakxtcx346ej82ftln4r2aw2pcuazq3583s85nzsan4ygqsj32hjf
-
-creation_rules:
-  # Hosts
-  - path_regex: hosts/alto/secrets.json$
-    key_groups:
-      - age:
-          - *admin
-          - *alto
-  - path_regex: hosts/cirrus/secrets.json$
-    key_groups:
-      - age:
-          - *admin
-          - *cirrus
-  - path_regex: hosts/cumulus/secrets.json$
-    key_groups:
-      - age:
-          - *admin
-          - *cumulus
-  - path_regex: hosts/fern/secrets.json$
-    key_groups:
-      - age:
-          - *admin
-          - *fern
-  - path_regex: hosts/north/secrets.json$
-    key_groups:
-      - age:
-          - *admin
-          - *north
-
-  # Users
-  - path_regex: users/seb/@fern/secrets.json$
-    key_groups:
-      - age:
-          - *admin
-          - *seb-fern
-  - path_regex: users/seb/@north/secrets.json$
-    key_groups:
-      - age:
-          - *admin
-          - *seb-north

flake.nix

@@ -74,6 +74,7 @@
         ./flake/formatter.nix
         ./flake/hosts.nix
         ./flake/modules.nix
+        ./flake/packages.nix
       ];
     };
 }

flake/packages.nix

@@ -0,0 +1,37 @@
+{ self, ... }:
+{
+  perSystem =
+    { pkgs, lib, ... }:
+    {
+      packages.sops-config =
+        let
+          adminKey = "age1mpq8m4p7dnxh5ze3fh7etd2k6sp85zdnmp9te3e9chcw4pw07pcq960zh5";
+
+          mkCreationRule = sopsCfg: {
+            path_regex = sopsCfg.secretsFile;
+            key_groups = lib.singleton {
+              age = [
+                adminKey
+                sopsCfg.agePublicKey
+              ];
+            };
+          };
+
+          hostCreationRules =
+            self.nixosConfigurations
+            |> lib.filterAttrs (_: value: value.config.custom.sops.enable or false)
+            |> lib.mapAttrsToList (_: value: mkCreationRule value.config.custom.sops);
+
+          userCreationRules =
+            self.nixosConfigurations
+            |> lib.filterAttrs (_: value: value.config.home-manager.users.seb.custom.sops.enable or false)
+            |> lib.mapAttrsToList (_: value: mkCreationRule value.config.home-manager.users.seb.custom.sops);
+
+          jsonConfig = { creation_rules = hostCreationRules ++ userCreationRules; } |> builtins.toJSON;
+        in
+        pkgs.runCommand "sops-config" { buildInputs = [ pkgs.yj ]; } ''
+          mkdir $out
+          echo '${jsonConfig}' | yj -jy > $out/sops.yaml
+        '';
+    };
+}

hosts/alto/default.nix

@@ -8,9 +8,11 @@
   };
 
   custom = {
-    sops.enable = true;
+    sops = {
+      enable = true;
+      agePublicKey = "age1qz04yg4h4g22wxqca2pd5k0z574223f6m5c9jy5ny37nlgcd6u4styf06t";
+    };
     boot.loader.systemdBoot.enable = true;
-
     users.seb.enable = true;
 
     services = {

hosts/cirrus/default.nix

@@ -8,9 +8,11 @@
   };
 
   custom = {
-    sops.enable = true;
+    sops = {
+      enable = true;
+      agePublicKey = "age1dnpwfwh0h95r63e5qfjc2gvffw2tr2tx4new7sq2h3qs90kx9fmq322mx4";
+    };
     boot.loader.grub.enable = true;
-
     users.seb.enable = true;
 
     services = {

hosts/cumulus/default.nix

@@ -13,9 +13,11 @@
   };
 
   custom = {
-    sops.enable = true;
+    sops = {
+      enable = true;
+      agePublicKey = "age1dnru7l0agvnw3t9kmx60u4vh5u4tyd49xdve53zspxkznnp9f34qtec9dl";
+    };
     boot.loader.grub.enable = true;
-
     users.seb.enable = true;
 
     services = {

hosts/fern/default.nix

@@ -4,12 +4,14 @@
   boot.kernelPackages = pkgs.linuxPackages_latest;
 
   custom = {
-    sops.enable = true;
+    sops = {
+      enable = true;
+      agePublicKey = "age1sywwrwse76x8yskrsfpwk38fu2cmyx5s9qkf2pgc68cta0vj9psql7dp6e";
+    };
     boot = {
       loader.systemdBoot.enable = true;
       silent = true;
     };
-
     users.seb = {
       enable = true;
       zsh.enable = true;

hosts/north/default.nix

@@ -4,12 +4,14 @@
   boot.kernelPackages = pkgs.linuxPackages_latest;
 
   custom = {
-    sops.enable = true;
+    sops = {
+      enable = true;
+      agePublicKey = "age18x6herevmcuhcmeh47ll6p9ck9zk4ga6gfxwlc8yl49rwjxm7qusylwfgc";
+    };
     boot = {
       loader.systemdBoot.enable = true;
       silent = true;
     };
-
     users.seb = {
       enable = true;
       zsh.enable = true;

modules/home/sops.nix

@@ -7,30 +7,36 @@
 }@moduleArgs:
 let
   cfg = config.custom.sops;
+
+  absoluteSecretsPath = "${self}/" + cfg.secretsFile;
 in
 {
   imports = [ inputs.sops-nix.homeManagerModules.sops ];
 
   options.custom.sops = {
     enable = lib.mkEnableOption "";
+    agePublicKey = lib.mkOption {
+      type = lib.types.nonEmptyStr;
+      default = "";
+    };
     hostName = lib.mkOption {
       type = lib.types.nonEmptyStr;
       default = moduleArgs.osConfig.networking.hostName or "";
     };
-    defaultSopsFile = lib.mkOption {
+    secretsFile = lib.mkOption {
-      type = lib.types.path;
+      type = lib.types.nonEmptyStr;
-      default = "${self}/users/${config.home.username}/@${cfg.hostName}/secrets.json";
+      default = "users/${config.home.username}/@${cfg.hostName}/secrets.json";
     };
     secrets = lib.mkOption {
       type = lib.types.anything;
-      default = cfg.defaultSopsFile |> builtins.readFile |> builtins.fromJSON;
+      default = absoluteSecretsPath |> builtins.readFile |> builtins.fromJSON;
     };
   };
 
   config = lib.mkIf cfg.enable {
     sops = {
       age.sshKeyPaths = [ "${config.home.homeDirectory}/.ssh/id_ed25519" ];
-      inherit (cfg) defaultSopsFile;
+      defaultSopsFile = absoluteSecretsPath;
     };
   };
 }

modules/system/sops.nix

@@ -7,26 +7,32 @@
 }:
 let
   cfg = config.custom.sops;
+
+  absoluteSecretsPath = "${self}/" + cfg.secretsFile;
 in
 {
   imports = [ inputs.sops-nix.nixosModules.sops ];
 
   options.custom.sops = {
     enable = lib.mkEnableOption "";
-    defaultSopsFile = lib.mkOption {
+    agePublicKey = lib.mkOption {
-      type = lib.types.path;
+      type = lib.types.nonEmptyStr;
-      default = "${self}/hosts/${config.networking.hostName}/secrets.json";
+      default = "";
+    };
+    secretsFile = lib.mkOption {
+      type = lib.types.nonEmptyStr;
+      default = "hosts/${config.networking.hostName}/secrets.json";
     };
     secrets = lib.mkOption {
       type = lib.types.anything;
-      default = cfg.defaultSopsFile |> builtins.readFile |> builtins.fromJSON;
+      default = absoluteSecretsPath |> builtins.readFile |> builtins.fromJSON;
     };
   };
 
   config = lib.mkIf cfg.enable {
     sops = {
       age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-      inherit (cfg) defaultSopsFile;
+      defaultSopsFile = absoluteSecretsPath;
     };
   };
 }

users/seb/@fern/home.nix

@@ -4,6 +4,7 @@ _: {
   home.stateVersion = "24.11";
 
   custom = {
+    sops.agePublicKey = "age190mf9wx4ct7qvne3ly9j3cj9740z5wnfhsl6vsc5wtfyc5pueuas9hnjtr";
     theme = "light";
     programs.brightnessctl.enable = true;
   };

users/seb/@north/home.nix

@@ -4,7 +4,10 @@
 
   home.stateVersion = "23.11";
 
-  custom.theme = "dark";
+  custom = {
+    sops.agePublicKey = "age1p32cyzakxtcx346ej82ftln4r2aw2pcuazq3583s85nzsan4ygqsj32hjf";
+    theme = "dark";
+  };
 
   home.packages = [
     pkgs.ffmpeg