setup agenix

flake.lock

@@ -1,5 +1,30 @@
 {
   "nodes": {
+    "agenix": {
+      "inputs": {
+        "darwin": "darwin",
+        "home-manager": [
+          "home-manager"
+        ],
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1770165109,
+        "narHash": "sha256-9VnK6Oqai65puVJ4WYtCTvlJeXxMzAp/69HhQuTdl/I=",
+        "owner": "ryantm",
+        "repo": "agenix",
+        "rev": "b027ee29d959fda4b60b57566d64c98a202e0feb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ryantm",
+        "repo": "agenix",
+        "type": "github"
+      }
+    },
     "caelestia-cli": {
       "inputs": {
         "caelestia-shell": [
@@ -47,6 +72,28 @@
         "type": "github"
       }
     },
+    "darwin": {
+      "inputs": {
+        "nixpkgs": [
+          "agenix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1744478979,
+        "narHash": "sha256-dyN+teG9G82G+m+PX/aSAagkC+vUv0SgUw3XkPhQodQ=",
+        "owner": "lnl7",
+        "repo": "nix-darwin",
+        "rev": "43975d782b418ebf4969e9ccba82466728c2851b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "lnl7",
+        "ref": "master",
+        "repo": "nix-darwin",
+        "type": "github"
+      }
+    },
     "disko": {
       "inputs": {
         "nixpkgs": [
@@ -86,7 +133,7 @@
     },
     "flake-utils": {
       "inputs": {
-        "systems": "systems"
+        "systems": "systems_2"
       },
       "locked": {
         "lastModified": 1731533236,
@@ -317,6 +364,7 @@
     },
     "root": {
       "inputs": {
+        "agenix": "agenix",
         "caelestia-shell": "caelestia-shell",
         "disko": "disko",
         "flake-parts": "flake-parts",
@@ -369,6 +417,21 @@
         "repo": "default",
         "type": "github"
       }
+    },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -47,6 +47,11 @@
       url = "github:nix-community/disko";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    agenix = {
+      url = "github:ryantm/agenix";
+      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.home-manager.follows = "home-manager";
+    };
     /*
       microPlugins-vivify = {
       url = "git+https://codeberg.org/gibbert/micro-vivify";

modules/hosts/desktop.nix

@@ -132,7 +132,7 @@
     home.homeDirectory = "/home/tomasr";
 
     home.sessionVariables = {
-      EDITOR = "neovim";
+      EDITOR = "nvim";
       TERMINAL = "kitty";
     };
 

modules/hosts/laptop.nix

@@ -9,6 +9,8 @@
       inherit (self) pkgs-unstable pkgs-local pkgs-master;
     };
     modules = with self.nixosModules; [
+      inputs.agenix.nixosModules.default
+      agenix
       # important do not remove
       home-manager-laptop
       laptop
@@ -129,7 +131,7 @@
     home.homeDirectory = "/home/tomasr";
 
     home.sessionVariables = {
-      EDITOR = "neovim";
+      EDITOR = "nvim";
       TERMINAL = "kitty";
     };
 

modules/utilities/agenix.nix

@@ -0,0 +1,13 @@
+{inputs, ...}: {
+  flake.nixosModules.agenix = {pkgs, ...}: {
+    environment.systemPackages = [
+      inputs.agenix.packages.${pkgs.system}.default
+    ];
+  age.identityPaths = [
+    "/home/tomasr/.ssh/id_ed25519"
+  ];
+    age.secrets.my-secret = {
+      file = ../../secrets/my-secret.age;
+    };
+  };
+}

secrets/my-secret.age

@@ -0,0 +1,5 @@
+age-encryption.org/v1
+-> ssh-ed25519 pcPqbA GG04OY1WKDS1Rc1aRhODZShiWZfdw0cDHN+s/8XqDzA
+9/SS7ZOQDh1H+27JT7fTi3GV5C19CjIPR9i4jjKjM9E
+--- Irxkq9bamw6q0qsEZHlym6pC0gDxpty+bbg14OAgkxQ
+ëĶ‘²ó<…¥ɨ
¬!†K!þ‘L;Ú~´]¶Fñ»Ak‰õwÐy62ϽK<B‚{P=,@q-WÑUUh|c]ZÝœsR‰²›¨3%[â´¾eC WË2M`Ú#ìõ3ìSÇ␍pû˜³tZEtbK4{×Ñ¡bÄ3QuhzȘ(òË ¬%¹ZÒ»@ÇI[£_².˜ð

secrets/secrets.nix

@@ -0,0 +1,8 @@
+let
+  myKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC6WNm4YAQO85j0aNQkKSH7QnmhgzKA4hA2ggi6cDyKk tomasr@nixos";
+in
+{
+  "my-secret.age".publicKeys = [
+    myKey
+  ];
+}