added sops secrets

2026-07-31 18:12:30 +01:00
parent 7c11147a3b
commit bc3a31f845
4 changed files with 103 additions and 1 deletions
--- a/modules/secrets/default.nix
+++ b/modules/secrets/default.nix
@@ -0,0 +1,49 @@
+{
+  self,
+  inputs,
+  ...
+}: {
+  flake.nixosModules.secrets = {
+    config,
+    lib,
+    pkgs,
+    ...
+  }: {
+    imports = [inputs.sops-nix.nixosModules.sops];
+
+    sops = {
+      age.keyFile = "/etc/sops/age/keys.txt";
+      defaultSopsFile = ../../secrets/secrets.yaml;
+
+      secrets = {
+        lidarr-api-key = {};
+        gitea-db-passwd = {};
+        immich-api-key = {};
+        immich-db-passwd = {};
+        immich-postgres-passwd = {};
+        mail-relay-user = {};
+        mail-relay-passwd = {};
+        silverbullet-user = {};
+      };
+      templates = {
+        "gitea.env".content = ''
+          GITEA__database__PASSWD=${config.sops.placeholder.gitea-db-passwd}
+          MYSQL_PASSWORD=${config.sops.placeholder.gitea-db-passwd}
+          MYSQL_ROOT_PASSWORD=${config.sops.placeholder.gitea-db-passwd}
+        '';
+        "immich.env".content = ''
+          DB_PASSWORD=${config.sops.placeholder.immich-db-passwd}
+          IMMICH_API_KEY=${config.sops.placeholder.immich-api-key}
+          POSTGRES_PASSWORD=${config.sops.placeholder.immich-postgres-passwd}
+        '';
+        "mail.env".content = ''
+          RELAY_USER=${config.sops.placeholder.mail-relay-user}
+          RELAY_PASSWORD=${config.sops.placeholder.mail-relay-passwd}
+        '';
+        "silverbullet.env".content = ''
+          SB_USER=${config.sops.placeholder.silverbullet-user}
+        '';
+      };
+    };
+  };
+}