Client machines: remove sops

5 files changed, 0 insertions, 30 deletions

diff --git a/hosts/underworld/default.nix b/hosts/underworld/default.nix
index a271765..360ae96 100644
--- a/hosts/underworld/default.nix
+++ b/hosts/underworld/default.nix
@@ -12,7 +12,6 @@
 
     ./home.nix
     (flakeRoot + /share/system/client-common.nix)
-    #(flakeRoot + /share/system/spotifyd.nix)
     {
       _module.args = {
         inherit inputs;
diff --git a/hosts/underworld/home.nix b/hosts/underworld/home.nix
index f43148b..d240194 100644
--- a/hosts/underworld/home.nix
+++ b/hosts/underworld/home.nix
@@ -1,7 +1,6 @@
 {
   flakeRoot,
   inputs,
-  config,
   ...
 }:
 {
@@ -11,7 +10,6 @@
     sharedModules = [ { programs.fish.enable = true; } ];
     extraSpecialArgs = {
       inherit inputs;
-      inherit (config) sops;
     };
   };
 
diff --git a/hosts/wonderland/default.nix b/hosts/wonderland/default.nix
index f252bb3..3b024c0 100644
--- a/hosts/wonderland/default.nix
+++ b/hosts/wonderland/default.nix
@@ -9,9 +9,7 @@
     # Include the results of the hardware scan.
     ./hardware.nix
     ./home.nix
-    ./sops.nix
     (flakeRoot + /share/system/client-common.nix)
-    #(flakeRoot + /share/system/spotifyd.nix)
     {
       _module.args = {
         inherit inputs;
diff --git a/hosts/wonderland/home.nix b/hosts/wonderland/home.nix
index 1a6dc7c..2cd6dd2 100644
--- a/hosts/wonderland/home.nix
+++ b/hosts/wonderland/home.nix
@@ -1,7 +1,6 @@
 {
   flakeRoot,
   inputs,
-  config,
   ...
 }:
 {
@@ -18,7 +17,6 @@
     ];
     extraSpecialArgs = {
       inherit inputs;
-      inherit (config) sops;
     };
   };
 
diff --git a/hosts/wonderland/sops.nix b/hosts/wonderland/sops.nix
deleted file mode 100644
index 9b76b24..0000000
--- a/hosts/wonderland/sops.nix
+++ /dev/null
@@ -1,23 +0,0 @@
-{ config, ... }:
-{
-  sops = {
-    age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
-    defaultSopsFile = ../../secrets/credentials.json;
-    secrets = {
-      # FIXME: using mode 444 here is a hack so that spotifyd can cat the
-      # values out, but it obviously exposes the secrets to anyone that knows
-      # they are there. A better solution would be to override the spotifyd
-      # module to make the systemd service run the program with a group, and
-      # then give read priviledges to only that group.
-      #      "spotify/password" = {
-      #        mode = "444";
-      #      };
-      #      "spotify/username" = {
-      #        mode = "444";
-      #      };
-      "irc/libera-password" = {
-        owner = config.users.users.alice.name;
-      };
-    };
-  }; # end of sops
-}