From 44ba137c4e4360eedc24767c872a0122162070df Mon Sep 17 00:00:00 2001
From: voidarc <admin@voidarc.co.uk>
Date: Thu, 2 Jul 2026 08:55:10 +0100
Subject: [PATCH] added secrets management and rolled keys

Can't just have my keys out in the open air anymore :(
Rolled and encrypted my gotify keys so that you cant see my
notifications anymore
---
 .config/gotify-desktop/config.toml |   2 +-
 .gitignore                         |   3 +++
 .gitsecret/keys/pubring.kbx        | Bin 0 -> 646 bytes
 .gitsecret/keys/pubring.kbx~       | Bin 0 -> 32 bytes
 .gitsecret/keys/trustdb.gpg        | Bin 0 -> 1200 bytes
 .gitsecret/paths/mapping.cfg       |   1 +
 .nixos                             |   2 +-
 .secret-gotify.secret              |   2 ++
 doot/config.toml                   |   4 ++++
 9 files changed, 12 insertions(+), 2 deletions(-)
 create mode 100644 .gitsecret/keys/pubring.kbx
 create mode 100644 .gitsecret/keys/pubring.kbx~
 create mode 100644 .gitsecret/keys/trustdb.gpg
 create mode 100644 .gitsecret/paths/mapping.cfg
 create mode 100644 .secret-gotify.secret

diff --git a/.config/gotify-desktop/config.toml b/.config/gotify-desktop/config.toml
index c002779f..ddd5a5a6 100644
--- a/.config/gotify-desktop/config.toml
+++ b/.config/gotify-desktop/config.toml
@@ -3,7 +3,7 @@
 url = "wss://ntfy.voidarc.co.uk:443"
 
 # secret gotify token
-token = "C5YKvW5h3NfJJIB"
+token = { command = "cat /home/user01/.dotfiles/.secret-gotify"}
 # if you want to get the token from a password manager, or other external command,
 # you can also use for example:
 # token = { command = "secret-tool lookup Title 'Gotify token'" }
diff --git a/.gitignore b/.gitignore
index 1f8011aa..6e4b9ec3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,4 @@
 .session
+.gitsecret/keys/random_seed
+!*.secret
+.secret-gotify
diff --git a/.gitsecret/keys/pubring.kbx b/.gitsecret/keys/pubring.kbx
new file mode 100644
index 0000000000000000000000000000000000000000..f28bf7d4e320f18224f696d48d9cf1ad30a150d1
GIT binary patch
literal 646
zcmZQzU{GLWWMJ}kib!Jsf-E=Dy&w!?LjY466C;>a$H2gNg@K7dCjHb~mnAP&Zd16?
zxasKa`qIaS+<`z93LsUV&dr>;W^?e)MJ>t#e?Pr?$NFPk7Ess*BnJeH3_L*cFc52l
zxIoibz%&{GbiqE5&<tZ1Aaj`*r#2fS3*#+!env)ihh*8Wj+I&RE_!*Hue}mBwJQGF
zRncAOee;M(*zNFTQuj9itw=9Ohd7#Hi*{LlW=djFvVsPbk&~EItf^p=n39{B=KvMc
zOU~CT&9;MTWr8@TV*-n?7#D+um?8@{FS9a%+{Pr$%*xHl!Op}c%EigS&BP+c#LUPf
z$H*k!z`(^R01Kau%NhP~{Xg4LG2J}fNmE5({#nocAFbm<MCZN<|EYLZp-AP*B1VSO
zB6)ZA^2)adJ#c@JYOU+LC*gzqMdlmE3%vD>_jVYvY+z$x26~NQhXpuXgt)-rGCh=$
z6%;TJukO{Ku*Edww#HNz4ymTLd)KP|E_##qO7@;s{O)TezRZjq>>U*>5<ovG5bzTZ
zvfFRmW@PA4<NX!0(NKXsyZ9#GQ*rN)f&%_O&WrzMo}kk0|0Kzq;lE>f%G;VCa}T36
z+@faJLRN4cowNM+#@9|p2b`}wO1#embGzmI*M_T`e9xt<Sp4E*f&9*={7G*C+vU?P

literal 0
HcmV?d00001

diff --git a/.gitsecret/keys/pubring.kbx~ b/.gitsecret/keys/pubring.kbx~
new file mode 100644
index 0000000000000000000000000000000000000000..525e23fb4de3e459ac3fd52dc832f4cdac9f1baa
GIT binary patch
literal 32
ecmZQzU{GLWWMJ}kib!Jsf-E=Dy&w!?g8%?U_XKnR

literal 0
HcmV?d00001

diff --git a/.gitsecret/keys/trustdb.gpg b/.gitsecret/keys/trustdb.gpg
new file mode 100644
index 0000000000000000000000000000000000000000..0abf130043f302ec6f6e1d80a1226c0dc0ee5188
GIT binary patch
literal 1200
zcmZQfFGy!*W@Ke#VqnN}6Wz;z9WZiX7sn7CRfiEIV1dza84VXu2#lr!%F+P<$uR@;

literal 0
HcmV?d00001

diff --git a/.gitsecret/paths/mapping.cfg b/.gitsecret/paths/mapping.cfg
new file mode 100644
index 00000000..00b71037
--- /dev/null
+++ b/.gitsecret/paths/mapping.cfg
@@ -0,0 +1 @@
+.secret-gotify:f6129ad401b60d5a491d582169088600bb58a537d232b93c22923aede129d5cc
diff --git a/.nixos b/.nixos
index f0855529..90c612bb 160000
--- a/.nixos
+++ b/.nixos
@@ -1 +1 @@
-Subproject commit f08555296caa407b4de1d9f87ee6af6eac0fcbef
+Subproject commit 90c612bb57f1486dcf4afd9541bc4689c82d1478
diff --git a/.secret-gotify.secret b/.secret-gotify.secret
new file mode 100644
index 00000000..2db103fd
--- /dev/null
+++ b/.secret-gotify.secret
@@ -0,0 +1,2 @@
+�^������j
@:p�X�a=�m�A��9�
Q��t$)C�~�'s0�f�JA@:I�
���o��_�z>�*�����C�kߋ�))=�eBx�Y
�O�
+R�fM�n�1�Ys�Y�c�a|o\���&:x��Ngu����q)�e�t�1RO���VՔu��=�}㺴{�YM6Fʟٮj&�
\ No newline at end of file
diff --git a/doot/config.toml b/doot/config.toml
index 33ce4606..49f78a14 100644
--- a/doot/config.toml
+++ b/doot/config.toml
@@ -11,6 +11,10 @@ exclude_files = [
 	".gitignore",
 	".session",
 	".gitmodules",
+	".gitsecret",
+	"*.secret",
+	"**/.devenv",
+	".secret*"
 ]
 
 # Files and directories that are always symlinked, overriding `exclude_files`. Each entry is a glob pattern relative to the dotfiles directory.