From 867ecf6308390acf8188880c34e0312e75619fae Mon Sep 17 00:00:00 2001
From: beeb5k <bee@4d2.org>
Date: Sat, 7 Mar 2026 03:11:25 +0530
Subject: Add secrets with sops

---
 .sops.yaml            |  8 ++++++++
 flake.nix             |  4 ++++
 hosts/common.nix      | 40 ++++++++++++++++++++++++++++++++++++++++
 secrets/secrets.yaml  | 16 ++++++++++++++++
 users/bee/default.nix |  6 ++++++
 users/common.nix      |  5 ++++-
 6 files changed, 78 insertions(+), 1 deletion(-)
 create mode 100644 .sops.yaml
 create mode 100644 secrets/secrets.yaml

diff --git a/.sops.yaml b/.sops.yaml
new file mode 100644
index 0000000..bc68f85
--- /dev/null
+++ b/.sops.yaml
@@ -0,0 +1,8 @@
+keys:
+  - &nixios age1qfldnsnu2nmklke34uq9fpuf33677a6mlwmnszma7vkn75etrcrq6rxdpg
+
+creation_rules:
+  - path_regex: secrets/secrets.yaml$
+    key_groups:
+      - age:
+          - *nixios
diff --git a/flake.nix b/flake.nix
index 6912b65..9a13fba 100644
--- a/flake.nix
+++ b/flake.nix
@@ -17,6 +17,10 @@
       url = "github:DreamMaoMao/mango";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    sops-nix = {
+      url = "github:Mic92/sops-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs =
diff --git a/hosts/common.nix b/hosts/common.nix
index e6bc71d..65302b1 100644
--- a/hosts/common.nix
+++ b/hosts/common.nix
@@ -7,6 +7,10 @@
   ...
 }:
 {
+  imports = [
+    inputs.sops-nix.nixosModules.sops
+  ];
+
   nix.settings = {
     trusted-users = [ "@wheel" ];
     experimental-features = [
@@ -163,6 +167,42 @@
   programs.gnupg.agent = {
     enable = true;
     enableSSHSupport = true;
+    pinentryPackage = pkgs.pinentry-gnome3;
+  };
+
+  sops = {
+    defaultSopsFile = ../secrets/secrets.yaml;
+    age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+    secrets.gpg_private_key = {
+      owner = user;
+      mode = "0400";
+    };
+  };
+
+  systemd.services.import-gpg-key = {
+    description = "Import GPG key from sops secret";
+    wantedBy = [ "multi-user.target" ];
+    after = [ "sops-nix.service" ];
+    wants = [ "sops-nix.service" ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      User = user;
+    };
+    path = [
+      pkgs.gnupg
+      pkgs.gawk
+    ];
+    script = ''
+      GPG_KEY="/run/secrets/gpg_private_key"
+      if [ -f "$GPG_KEY" ]; then
+        gpg --batch --import "$GPG_KEY" || true
+        KEY_FP=$(gpg --batch --with-colons --list-secret-keys | awk -F: '/^fpr:/{print $10; exit}')
+        if [ -n "$KEY_FP" ]; then
+          echo "$KEY_FP:6:" | gpg --batch --import-ownertrust || true
+        fi
+      fi
+    '';
   };
 
   services.upower.enable = true;
diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml
new file mode 100644
index 0000000..bdbd1bf
--- /dev/null
+++ b/secrets/secrets.yaml
@@ -0,0 +1,16 @@
+gpg_private_key: ENC[AES256_GCM,data:w33fn+jpHrjiZLMI3ZBuxvltop8g6WXS3sWI70FNlCjF3Cf2VY9qCiRem4B/F647+LvaIKdtzchA3UMadDG1nTXjOdNOp6btBQUPKgw3zsaGJYravvWx/86qX13AHykcROaohlrNSmJGG8NwpADplSZ9i9/YfMU1ZZKrdrPw3669P9SuNmqKybQWzPYpHbfrH0jzRt3inGC77BFDAEXyFNtvBUfJdgTtMFGU/Aa87Nqil1PEw/Dg1SGzv8HxDcDw4FGPi6vrbEm0Ozq5gCbTuAf1LeEcjjEZ5sb8VTbiILRXFaznAuKAOTJODMhFU//CIOCholQ/pqaAQobBLETvizcOC7X7+wHMEvB9Nl4t2nwSS4nvNi1HfnWtq9jfw/OyovnbnTazAqY0LvfKSQvbhO65VEPgGpzdTtsMeLdey5c6DvFi8V7JcE/d9w20+g7jG59psZonA/S/3+bfoYjTotoY73iAmcU8Dn/gwsRkPPrh9TF7TcJ7wnbGtXac/TEe2vW5uLdadbxdirGlbgNmKgoLd8g/mLZbEmzZC8pacWlh8uGXDwMzPpBTayXJfWe8RcGzs8zB5NKKvnQQzEH5wM6vbrwL8v0b7hNvEdeJNInULS8ctqFlhYw8sHbnckrn/TrXYGLrF+gXuwL1P19EhYWQkaCLGGyvj1Eoc3qMkaE/AJNMxfNg0hrKm3TDiHHm6UeVcF1X1fyRAJUlnQkkEQ48+vfsaC9+C67XU2TUbhgnHX2xnWQ3dSE4/MIoupi1D5VqVJ4tev4PM5jYIAHA54wYtVDtlgVVNFvlMjoskwcXf1kaUdzZLINxfYLR/TtLhLCEfLgUYxblKtlQyGPwGnLi0k3025v43o1CVJAaVJMippCl4x5QOkedyGY89YBGyKrUsXyY72erxMTLZUhPajswE/ce/Uf+EmDob/uS2vViNd98F5FCrmD0peKYDeDp8Vnf66xbGsZ88RmDqwrsTjkdfItAzKqovGl2hD/yPMAWwKYUzrcVUI2ZPmnjKqSDeZeeGh4Sf81A/mP/FnJHkPv+R+GcxCGokL/Cg4P5c7EYYdxODH5mq4O/DaXqgPMMLmeps9OApl03fDJVH1ITmt/0censNCgPdP90Mob2UX0d3sjjUBrWZw68yflGsSvciTSKplUDY4KLxA==,iv:fsGogJ7kQt20A4PZNDUinbh3mvBqIT+N/KMWzOMpziI=,tag:jB5yrUJrXG2RbbWUf7jCVA==,type:str]
+sops:
+    age:
+        - recipient: age1qfldnsnu2nmklke34uq9fpuf33677a6mlwmnszma7vkn75etrcrq6rxdpg
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6U2paUWZRSGUxaElMQXI2
+            RmdDUE9SZzZxWlVFK2lUV1d1S1kxMEdJNmlFCnBhVSt1SGpiWk1ZNE1kOERGMGxH
+            TENYSHIrQmFGK3k2RW1WR2pWSk9sQ0UKLS0tIEpSWEw3TlF1bFZjZUgwUStKNW1S
+            U0JiMFV2L1B4dnpsNnhmYUNtVVNqU3cKZotGMk7AuFlp8mwnZ1/P5GqmR5IC9xBr
+            uwrsOyWrplA/Z251qda+CH41vKIVHvOV+AM5reu9G4K1/Bu/huF3/A==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-03-06T21:30:21Z"
+    mac: ENC[AES256_GCM,data:0aFsXxZPEqL3BBIpm4qNAGqwsJqhM+/kC/kJE2yEs107Q+iu4akW3BstzQ8VCuc3Rg7alNOKmkuVEhJwLPvYc8zpWlb+7eIqLUX11Yrtz0UCzgApLCshRxIRPAxksqQy3ueRD0g+KmKx/Nui3NWIov6ycr3UoqxCjBthqHCKkyk=,iv:gzABDgrzjwTQ9EYcmT9IzF+PXc2hhKImSA55OyRV/G8=,tag:CYp0BeENvWkh9pEnWkCHdQ==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.12.1
diff --git a/users/bee/default.nix b/users/bee/default.nix
index 577ad09..064ff78 100644
--- a/users/bee/default.nix
+++ b/users/bee/default.nix
@@ -33,6 +33,12 @@
     TERM = config.beeMods.terminal.default;
   };
 
+  home.packages = with pkgs; [
+    vim
+    sops
+  ];
+
   programs.home-manager.enable = true;
+
   home.stateVersion = systemState; # check flake.nix
 }
diff --git a/users/common.nix b/users/common.nix
index c55187e..6c95959 100644
--- a/users/common.nix
+++ b/users/common.nix
@@ -10,10 +10,13 @@
     settings = {
       user = {
         name = "beeb5k";
-        email = "beebeeb5k@gmail.com";
+        email = "bee@4d2.org";
+        signingkey = "42177A22EA630575";
       };
       init.defaultBranch = "main";
       credential.helper = "libsecret";
+      commit.gpgsign = true;
+      tag.gpgsign = true;
     };
   };
 
-- 
cgit v1.3.1