sops: Rename secrets option to secretsData

hosts/homeserver/default.nix

@@ -29,14 +29,14 @@
           gui.domain = "syncthing.${privateDomain}";
           doBackups = true;
         };
+      };
 
+      web-services = {
         atuin = {
           enable = true;
           domain = "atuin.${privateDomain}";
         };
-      };
 
-      web-services = {
         filebrowser = {
           enable = true;
           domain = "files.${privateDomain}";

modules/home/programs/git.nix

@@ -4,7 +4,7 @@
 
   config = lib.mkIf config.custom.programs.git.enable {
     sops.secrets =
-      config.custom.sops.secrets.ssh-key
+      config.custom.sops.secretsData.ssh-key
       |> lib.mapAttrs' (
         name: _: lib.nameValuePair "ssh-key/${name}" { path = "${config.home.homeDirectory}/.ssh/${name}"; }
       );
@@ -42,7 +42,7 @@
       lazygit.enable = true;
 
       ssh.matchBlocks =
-        config.custom.sops.secrets.ssh-key
+        config.custom.sops.secretsData.ssh-key
         |> lib.mapAttrs (name: _: { identityFile = config.sops.secrets."ssh-key/${name}".path; });
     };
   };

modules/home/sops.nix

@@ -25,7 +25,7 @@ in
       type = self.lib.types.existingPath;
       default = "${self}/users/${config.home.username}/@${osConfig.networking.hostName}/secrets.json";
     };
-    secrets = lib.mkOption {
+    secretsData = lib.mkOption {
       type = lib.types.anything;
       default = cfg.secretsFile |> lib.readFile |> lib.strings.fromJSON;
     };
@@ -38,11 +38,21 @@ in
     };
 
     assertions =
-      config.sops.secrets
+      (
-      |> lib.attrNames
+        config.sops.secrets
-      |> lib.map (secretPath: {
+        |> lib.attrNames
-        assertion = cfg.secrets |> lib.hasAttrByPath (secretPath |> lib.splitString "/");
+        |> lib.map (secretPath: {
-        message = "Sops secret `${secretPath}` must be defined in secrets.json";
+          assertion = cfg.secretsData |> lib.hasAttrByPath (secretPath |> lib.splitString "/");
-      });
+          message = "Sops secret `${secretPath}` is used in a module but not defined in secrets.json";
+        })
+      )
+      ++ (
+        lib.removeAttrs cfg.secretsData [ "sops" ]
+        |> lib.mapAttrsToListRecursive (path: _: path |> lib.concatStringsSep "/")
+        |> lib.map (secretPath: {
+          assertion = config.sops.secrets |> lib.hasAttr secretPath;
+          message = "Sops secret `${secretPath}` is defined in secrets.json but not used in any module";
+        })
+      );
   };
 }

modules/nixos/networking/underlay.nix

@@ -33,7 +33,7 @@ in
       enable = lib.mkEnableOption "";
       networks = lib.mkOption {
         type = lib.types.listOf lib.types.nonEmptyStr;
-        default = config.custom.sops.secrets.iwd |> lib.attrNames;
+        default = config.custom.sops.secretsData.iwd |> lib.attrNames;
       };
     };
   };

modules/nixos/services/syncthing.nix

@@ -11,7 +11,7 @@ let
 
   inherit (config.services.syncthing) dataDir;
 
-  useSopsSecrets = config.custom.sops.secrets |> lib.hasAttr "syncthing";
+  useSopsSecrets = config.custom.sops.secretsData |> lib.hasAttr "syncthing";
 in
 {
   options.custom.services.syncthing = {

modules/nixos/sops.nix

@@ -21,7 +21,7 @@ in
       type = self.lib.types.existingPath;
       default = "${self}/hosts/${config.networking.hostName}/secrets.json";
     };
-    secrets = lib.mkOption {
+    secretsData = lib.mkOption {
       type = lib.types.anything;
       default = cfg.secretsFile |> lib.readFile |> lib.strings.fromJSON;
     };
@@ -36,11 +36,21 @@ in
     };
 
     assertions =
-      config.sops.secrets
+      (
-      |> lib.attrNames
+        config.sops.secrets
-      |> lib.map (secretPath: {
+        |> lib.attrNames
-        assertion = cfg.secrets |> lib.hasAttrByPath (secretPath |> lib.splitString "/");
+        |> lib.map (secretPath: {
-        message = "Sops secret `${secretPath}` must be defined in secrets.json";
+          assertion = cfg.secretsData |> lib.hasAttrByPath (secretPath |> lib.splitString "/");
-      });
+          message = "Sops secret `${secretPath}` is used in a module but not defined in secrets.json";
+        })
+      )
+      ++ (
+        lib.removeAttrs cfg.secretsData [ "sops" ]
+        |> lib.mapAttrsToListRecursive (path: _: path |> lib.concatStringsSep "/")
+        |> lib.map (secretPath: {
+          assertion = config.sops.secrets |> lib.hasAttr secretPath;
+          message = "Sops secret `${secretPath}` is defined in secrets.json but not used in any module";
+        })
+      );
   };
 }

modules/nixos/web-services/atuin.nix

@@ -1,10 +1,10 @@
 { config, lib, ... }:
 let
-  cfg = config.custom.services.atuin;
+  cfg = config.custom.web-services.atuin;
   dataDir = "/var/lib/atuin";
 in
 {
-  options.custom.services.atuin = {
+  options.custom.web-services.atuin = {
     enable = lib.mkEnableOption "";
     domain = lib.mkOption {
       type = lib.types.nonEmptyStr;