added sops secrets

flake.lock

@@ -1189,7 +1189,8 @@
         "flake-parts": "flake-parts",
         "import-tree": "import-tree",
         "nix-config": "nix-config",
-        "nixpkgs": "nixpkgs_12"
+        "nixpkgs": "nixpkgs_12",
+        "sops-nix": "sops-nix"
       }
     },
     "rust-overlay": {
@@ -1228,6 +1229,26 @@
         "type": "github"
       }
     },
+    "sops-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1783174389,
+        "narHash": "sha256-aCWC8ngycU7OdJrU2+Je3qf+1a2ykuBvpPhZT/9tXMc=",
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "rev": "f1406619a3884cd5c47992a70b8b35c9c0fcb4c9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "type": "github"
+      }
+    },
     "systems": {
       "locked": {
         "lastModified": 1681028828,

flake.nix

@@ -8,6 +8,12 @@
     # flake parts
     flake-parts.url = "github:hercules-ci/flake-parts";
     import-tree.url = "github:vic/import-tree";
+
+    # secret management
+    sops-nix = {
+      url = "github:Mic92/sops-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs = inputs: inputs.flake-parts.lib.mkFlake {inherit inputs;} (inputs.import-tree ./modules);

modules/secrets/default.nix

@@ -0,0 +1,49 @@
+{
+  self,
+  inputs,
+  ...
+}: {
+  flake.nixosModules.secrets = {
+    config,
+    lib,
+    pkgs,
+    ...
+  }: {
+    imports = [inputs.sops-nix.nixosModules.sops];
+
+    sops = {
+      age.keyFile = "/etc/sops/age/keys.txt";
+      defaultSopsFile = ../../secrets/secrets.yaml;
+
+      secrets = {
+        lidarr-api-key = {};
+        gitea-db-passwd = {};
+        immich-api-key = {};
+        immich-db-passwd = {};
+        immich-postgres-passwd = {};
+        mail-relay-user = {};
+        mail-relay-passwd = {};
+        silverbullet-user = {};
+      };
+      templates = {
+        "gitea.env".content = ''
+          GITEA__database__PASSWD=${config.sops.placeholder.gitea-db-passwd}
+          MYSQL_PASSWORD=${config.sops.placeholder.gitea-db-passwd}
+          MYSQL_ROOT_PASSWORD=${config.sops.placeholder.gitea-db-passwd}
+        '';
+        "immich.env".content = ''
+          DB_PASSWORD=${config.sops.placeholder.immich-db-passwd}
+          IMMICH_API_KEY=${config.sops.placeholder.immich-api-key}
+          POSTGRES_PASSWORD=${config.sops.placeholder.immich-postgres-passwd}
+        '';
+        "mail.env".content = ''
+          RELAY_USER=${config.sops.placeholder.mail-relay-user}
+          RELAY_PASSWORD=${config.sops.placeholder.mail-relay-passwd}
+        '';
+        "silverbullet.env".content = ''
+          SB_USER=${config.sops.placeholder.silverbullet-user}
+        '';
+      };
+    };
+  };
+}

secrets/secrets.yaml

@@ -0,0 +1,26 @@
+#ENC[AES256_GCM,data:khWAeqeHxdTknlnvYe9IQEDwly17IWSQVVLfJEt9wyQDQlJD,iv:7XMH+6P4pYt91TBNB/g+cQGrofoBtWUoAJSV144tWtk=,tag:XKZUFtH8p5RW3ZRQ3RdRAg==,type:comment]
+#ENC[AES256_GCM,data:XWHmXDKdr0zhomE49Fecb6GMC8oYQUJiqj7xOqVebGO6Jx3r,iv:OPNw21pezQ0hunlLwpmHimKAfn16Tj8tlEnZKXV7Obs=,tag:0UfKKWs9VqiU/lVNZg4CkQ==,type:comment]
+_placeholder: ""
+gitea-db-passwd: ENC[AES256_GCM,data:LAR6PEE=,iv:4B6XwOgVpT1SvLrAbwHD4R25Gvq/hCt1AXPPK+N6zSY=,tag:+MopOvN4NGqLjxZvE9gflQ==,type:str]
+lidarr-api-key: ENC[AES256_GCM,data:65L7TFz/JK0faqdcHdZg2x+sr0Ke0o7eJOvtoE+ewgQ=,iv:8LStRO5Ktj51gl6ZxMrrCGIjmbGmc6BHgMX00L9tqCg=,tag:1FvCxPG/90u0tL8JNmhw+w==,type:str]
+immich-db-passwd: ENC[AES256_GCM,data:7DGBgqA6jfc=,iv:D0LGRE/B2HF848dVcZUBJUiZI98s51HPUGdsK2e6rU4=,tag:4q65tp9ylMGnk/867H8/lg==,type:str]
+immich-api-key: ENC[AES256_GCM,data:gMBIqOKVEBuHjusnznp9o4vNwLhBSJovdfLDrwGKX9QDTyWiKfqqnFiA,iv:13VRP2OtjNLuwbhtCJI9y5ds4CKFN3SYfQM0zsFOoMQ=,tag:nI8WpKRiELZ9/6GrxvK8QQ==,type:str]
+immich-postgres-passwd: ENC[AES256_GCM,data:Kv0l+xMwcBA=,iv:SLzp6Qo1YrwAmrhtg11MtIPGqyZ78AYJUlh0/Be2sDA=,tag:lLzndD6/jK/lUy9ijzjkyQ==,type:str]
+mail-relay-user: ENC[AES256_GCM,data:yaqB1uJ9N+9LwSsS4VsCsQxK/IPA8A0m,iv:k8c9GVeU4bdH8G+4SVKYOw4X5ytiPn33rnqx7CVn4hs=,tag:P9l6G87kI2CH301PPUmXzw==,type:str]
+mail-relay-passwd: ENC[AES256_GCM,data:9+2KuS27qukbedmG4fLwyw==,iv:+x5EgbJw/fha98CO58lwTxeF1lfZ5dL8W0zkyOvfF8w=,tag:GnMpinf68b2HdISia0wkrg==,type:str]
+silverbullet-user: ENC[AES256_GCM,data:8eoTT+T1+/khV7A96h3KoA==,iv:5wRlIU8hdRnseI5b3WUUZ0KOYtLdyrcON/P+yxg0LCs=,tag:Xxiae5Yrhv2gzIpUPX3PAw==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqNks4dEM5Vi9RVEhCWUdT
+            VkZ1ODhyR3kvT1JkekZnMnRzQzc4Y0N0ZzBjCld3U0Q4SDA4M0lmeXFway9BaGtP
+            dHBDMFB2YVZteUttc0JFYXZGY0hvRXMKLS0tIEw4Y1RGVmUyazdObXlZTmEwQllP
+            bkpZeHNzbnovYys4VStaUG9oVjRkbnMKjUF6toOclXUYR8lWuzC6X+qMraQNXhTo
+            XS8/g9qFT4nSgM/8nLhx7I4j5/NQU+CuB/iiG5Zs4iY6+vvAe0jIUg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1rg4rsns375z2zj4tv8cyqtjl504fw8tprlmj2w057dz6ztttjstsgjvkvy
+    lastmodified: "2026-07-31T17:10:29Z"
+    mac: ENC[AES256_GCM,data:RzmgeFEKYRzqEnHMtSxpg7GKleAr64F7bI7EM/FHq/aYyHgtYkn22oGz8uz9/RVijLIyHcL1rJSOyO7RhUSInqfJeSOKLyxI/X1B862ZuqYOkAFSMOeNMl719cINmgw9uHUQD62Tk6VReii1L0Yf2t/l29wObIRTKg96aZPEkjA=,iv:jAWIpSq7jx71RQ6agMu7ULG2IV6oG5U7ri9rbTyQ8JU=,tag:ybo7an+/9pN0sBA73WzGjg==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.3