1 files changed, 23 insertions, 0 deletions
diff --git a/hosts/wonderland/sops.nix b/hosts/wonderland/sops.nix
new file mode 100644
index 0000000..0ac9d3d
--- /dev/null
+++ b/hosts/wonderland/sops.nix
@@ -0,0 +1,23 @@
+{ ... }: {
+  sops = {
+    age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+    defaultSopsFile = ../../secrets/credentials.json;
+    secrets = {
+      # FIXME: using mode 444 here is a hack so that spotifyd can cat the
+      # values out, but it obviously exposes the secrets to anyone that knows
+      # they are there. A better solution would be to override the spotifyd
+      # module to make the systemd service run the program with a group, and
+      # then give read priviledges to only that group.
+      #      "spotify/password" = {
+      #        mode = "444";
+      #      };
+      #      "spotify/username" = {
+      #        mode = "444";
+      #      };
+      "wireless.env" = {
+        sopsFile = ../../secrets/wireless.env;
+        format = "dotenv";
+      };
+    };
+  }; # end of sops
+}