Use sops-nix for encrypting secrets

.sops.yaml

@@ -0,0 +1,7 @@
+keys:
+  - &primary age1sqssntfzzlhcgp0wuf9wmeavg0hmwmq349npsq8vaxj9sxey5s9ssc82sw
+creation_rules:
+  - path_regex: secrets/secrets.yaml$
+    key_groups:
+      - age:
+        - *primary

flake.nix

@@ -9,27 +9,41 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    sops-nix = {
+      url = "github:Mic92/sops-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     disko = {
       url = "github:nix-community/disko/latest";
       inputs.nixpkgs.follows = "nixpkgs";
     };
   };
 
-  outputs = { nixpkgs, home-manager, disko, ... }: {
-    nixosConfigurations = {
-      plexy = nixpkgs.lib.nixosSystem {
-        system = "x86_64-linux";
-        modules = [
-          ./hosts/plexy
-          home-manager.nixosModules.home-manager
-          {
-            home-manager.useGlobalPkgs = true;
-            home-manager.useUserPackages = true;
-            home-manager.users.wekuz = import ./hosts/plexy/home.nix;
-          }
-          disko.nixosModules.disko
-        ];
+  outputs =
+    {
+      nixpkgs,
+      home-manager,
+      sops-nix,
+      disko,
+      ...
+    }:
+    {
+      nixosConfigurations = {
+        plexy = nixpkgs.lib.nixosSystem {
+          system = "x86_64-linux";
+          modules = [
+            ./hosts/plexy
+            home-manager.nixosModules.home-manager
+            {
+              home-manager.useGlobalPkgs = true;
+              home-manager.useUserPackages = true;
+              home-manager.users.wekuz = import ./hosts/plexy/home.nix;
+            }
+            sops-nix.nixosModules.sops
+            disko.nixosModules.disko
+          ];
+        };
       };
     };
-  };
 }

hosts/plexy/default.nix

@@ -1,7 +1,15 @@
-{ config, lib, pkgs, ... }:
+{
+  inputs,
+  pkgs,
+  ...
+}:
 
 {
-  imports = [ ./hardware-configuration.nix ./disko-config.nix ];
+  imports = [
+    ./hardware-configuration.nix
+    inputs.sops-nix.nixosModules.sops
+    ./disko-config.nix
+  ];
 
   nix = {
     package = pkgs.nixVersions.stable;
@@ -12,7 +20,10 @@
       dates = "weekly";
       options = "--delete-older-than 2w";
     };
-    settings.experimental-features = [ "nix-command" "flakes" ];
+    settings.experimental-features = [
+      "nix-command"
+      "flakes"
+    ];
 
     extraOptions = ''
       min-free = 512000000
@@ -30,7 +41,10 @@
 
   hardware.graphics = {
     enable = true;
-    extraPackages = with pkgs; [ intel-media-driver intel-vaapi-driver ];
+    extraPackages = with pkgs; [
+      intel-media-driver
+      intel-vaapi-driver
+    ];
   };
 
   time.timeZone = "Europe/Tallinn";
@@ -39,7 +53,21 @@
     hostName = "plexy";
     networkmanager.enable = true;
     nftables.enable = true;
-    firewall.allowedTCPPorts = [ 22 80 443 ];
+    firewall.allowedTCPPorts = [
+      22
+      80
+      443
+    ];
+  };
+
+  sops = {
+    defaultSopsFile = ./secrets/secrets.yaml;
+    defaultSopsFormat = "yaml";
+    age.keyFile = /var/lib/sops-nix/key.txt;
+
+    secrets = {
+      super_secret_api = { };
+    };
   };
 
   services = {
@@ -50,23 +78,15 @@
     };
   };
 
-  virtualisation = {
-    docker = {
-      enable = true;
-      autoPrune = {
-        enable = true;
-        dates = "weekly";
-        randomizedDelaySec = "30min";
-        flags = [ "--all" "--volumes" ];
-      };
-    };
-  };
-
   environment.variables.EDITOR = "nvim";
 
   users.users.wekuz = {
     isNormalUser = true;
-    extraGroups = [ "wheel" "networkmanager" "docker" ];
+    extraGroups = [
+      "wheel"
+      "networkmanager"
+      "docker"
+    ];
     openssh.authorizedKeys.keys = [
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBs3aPxyJpVGytuVSO3va2WybKNFMR241o8DCJQbBEWV"
     ];

hosts/plexy/disko-config.nix

@@ -24,16 +24,25 @@
                 extraArgs = [ "-f" ]; # Override existing partition
                 subvolumes = {
                   "/rootfs" = {
-                    mountOptions = [ "compress=zstd" "noatime" ];
+                    mountOptions = [
+                      "compress=zstd"
+                      "noatime"
+                    ];
                     mountpoint = "/";
                   };
                   "/home" = {
-                    mountOptions = [ "compress=zstd" "noatime" ];
+                    mountOptions = [
+                      "compress=zstd"
+                      "noatime"
+                    ];
                     mountpoint = "/home";
                   };
                   "/home/wekuz" = { };
                   "/nix" = {
-                    mountOptions = [ "compress=zstd" "noatime" ];
+                    mountOptions = [
+                      "compress=zstd"
+                      "noatime"
+                    ];
                     mountpoint = "/nix";
                   };
                   # TODO: /log

hosts/plexy/hardware-configuration.nix

@@ -1,10 +1,22 @@
-{ config, lib, pkgs, modulesPath, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
 
 {
   imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
 
-  boot.initrd.availableKernelModules =
-    [ "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ];
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "ahci"
+    "nvme"
+    "usbhid"
+    "usb_storage"
+    "sd_mod"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];

hosts/plexy/home.nix

@@ -45,7 +45,9 @@
     };
   };
 
-  programs.zsh = { enable = true; };
+  programs.zsh = {
+    enable = true;
+  };
 
   home.stateVersion = "25.11";
 }

secrets/secrets.yaml

@@ -0,0 +1,16 @@
+super_secret_api: ENC[AES256_GCM,data:k0iECBf6Q0eJ,iv:aZ9nNh7IMK4Ge/xgZblaO86ZEABBW/f8PJV+Kgj2Y0g=,tag:p9x7IsZYIfaa6hlzRPceQw==,type:str]
+sops:
+    age:
+        - recipient: age1sqssntfzzlhcgp0wuf9wmeavg0hmwmq349npsq8vaxj9sxey5s9ssc82sw
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXSERvcGNXdDlUb3NBUm40
+            WW1mVlY5YlpxclBxT3htQ1orbHpxTnBUTEJNCkZaZnUzZUZNQmk0RmU2U2RkOUVI
+            ZElUbVZEMjBNd0hKZkU0WjMzajgySVEKLS0tIE9rNkdoeWJzU1h5U0ZVa2YveGE0
+            eDUxR1V0ZEFSYnZTYnYzakFydEliaFUKoa/gHecAy01vTk7I02KMGGPHZBql5K48
+            hkLDjoWK9dkGRX8kqRd028cuMCQRenLpULEECWp6oV+evUdMf7wRtg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-12-30T13:57:31Z"
+    mac: ENC[AES256_GCM,data:OAa6W+v/eeuzSFKbiSzyUoFA40SHYDdhzMzTw35ytBGhfNJRPLNBKnQBnPE1fqkrcc+pQgjrOdhsz+V5EV+ze/7G69HADYxd/G4/zqK3+FyU7CBsNKpoCjXYTcEkBco8t76LEFefmE/BJcUm5JEBZ2Hudnkm50fdyQDIWlips+w=,iv:amKno6v2RUAKOM4Rh126T1RHomxU31MJwmbLkkHc7JU=,tag:/ddTFf1vp7THLK5kh57EzQ==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0