hosts/wonderland/sops.nix


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

{ ... }: {
  sops = {
    age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
    defaultSopsFile = ../../secrets/credentials.json;
    secrets = {
      # FIXME: using mode 444 here is a hack so that spotifyd can cat the
      # values out, but it obviously exposes the secrets to anyone that knows
      # they are there. A better solution would be to override the spotifyd
      # module to make the systemd service run the program with a group, and
      # then give read priviledges to only that group.
      #      "spotify/password" = {
      #        mode = "444";
      #      };
      #      "spotify/username" = {
      #        mode = "444";
      #      };
      "wireless.env" = {
        sopsFile = ../../secrets/wireless.env;
        format = "dotenv";
      };
    };
  }; # end of sops
}