initial commit

modules/sops.nix

@@ -0,0 +1,22 @@
+{ inputs, ... }:
+{
+  imports = [ inputs.sops-nix.nixosModules.sops ];
+
+  sops = {
+    defaultSopsFile = ../secrets.yaml;
+    validateSopsFiles = false;
+
+    # Derive the age key from the systems ssh key. I didn't know this before but
+    # it seems like all systems have ssh keys already generated.
+    age = {
+      sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+      keyFile = "/var/lib/sops-nix/key.txt";
+      generateKey = true;
+    };
+
+    secrets = {
+      "mail/me" = {};
+      "jellyfin/zachary" = {};
+    };
+  };
+}