secrets

flake.nix

@@ -7,9 +7,10 @@
       url = "github:nix-community/home-manager/release-25.11";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    agenix.url = "github:ryantm/agenix";
   };
 
-  outputs = { self, nixpkgs, home-manager, ... }:
+  outputs = { self, nixpkgs, home-manager, agenix, ... }:
     let
       system = "x86_64-linux";
     in {
@@ -17,6 +18,7 @@
         inherit system;
         modules = [
           ./nixos/configuration.nix
+          agenix.nixosModules.default
           home-manager.nixosModules.home-manager
           {
             home-manager.useGlobalPkgs = true;

home/ltadeu6.nix

@@ -82,6 +82,12 @@
   ];
 
   home.file = {
+    ".config/fish/conf.d/agenix-openai.fish".text = ''
+      if test -r /run/agenix/openai_api_key
+        set -gx OPENAI_API_KEY (cat /run/agenix/openai_api_key)
+      end
+    '';
+
     ".config/hypr/hyprland.conf".source = ../hypr/hyprland.conf;
     ".config/hypr/hyprpaper.conf".source = ../hypr/hyprpaper.conf;
 

nixos/configuration.nix

@@ -2,15 +2,32 @@
 # your system.  Help is available in the configuration.nix(5) man page
 # and in the NixOS manual (accessible by running ‘nixos-help’).
 
-{ pkgs, ... }:
+{ config, pkgs, lib, ... }:
 
-let secrets = import ./secrets.nix;
-in {
+{
   imports = [
     # Include the results of the hardware scan.
     ./hardware-configuration.nix
   ];
 
+  age = {
+    identityPaths = [ "/home/ltadeu6/.ssh/id_ed25519" ];
+    secrets =
+      { }
+      // lib.optionalAttrs (builtins.pathExists ../secrets/openai_api_key.age) {
+        openai_api_key.file = ../secrets/openai_api_key.age;
+      }
+      // lib.optionalAttrs (builtins.pathExists ../secrets/minecraft_rcon_password.age) {
+        minecraft_rcon_password.file = ../secrets/minecraft_rcon_password.age;
+      }
+      // lib.optionalAttrs (builtins.pathExists ../secrets/syncthing_pixel_id.age) {
+        syncthing_pixel_id.file = ../secrets/syncthing_pixel_id.age;
+      }
+      // lib.optionalAttrs (builtins.pathExists ../secrets/syncthing_tv_id.age) {
+        syncthing_tv_id.file = ../secrets/syncthing_tv_id.age;
+      };
+  };
+
   powerManagement.cpuFreqGovernor = "performance";
 
   # Bootloader.
@@ -58,11 +75,11 @@ in {
     #   wg0 = {
     #     ips = [ "10.0.0.2/24" ];
     #     listenPort = 51820;
-    #     privateKey = secrets.wireguard.privateKey;
+    #     privateKey = builtins.readFile config.age.secrets.wireguard_private_key.path;
     #     peers = [{
-    #       publicKey = secrets.wireguard.peerPublicKey;
+    #       publicKey = (import ../secrets/secrets.nix).wireguard.peerPublicKey;
     #       allowedIPs = [ "10.0.0.1" ];
-    #       endpoint = secrets.wireguard.endpoint;
+    #       endpoint = (import ../secrets/secrets.nix).wireguard.endpoint;
     #       persistentKeepalive = 25;
     #     }];
     #   };
@@ -88,9 +105,7 @@ in {
 
   console.keyMap = "br-abnt2";
 
-  environment.sessionVariables = {
-    OPENAI_API_KEY = secrets.openaiApiKey;
-  };
+  environment.sessionVariables = { };
 
   programs = {
     cdemu.enable = true;
@@ -196,9 +211,12 @@ in {
         max-players = 20;
         white-list = false;
         enable-rcon = true;
-        "rcon.password" = secrets.minecraft.rconPassword;
         online-mode = false;
-      };
+      } // lib.optionalAttrs (config.services.minecraft-server.enable
+        && config.age.secrets ? minecraft_rcon_password) {
+          "rcon.password" =
+            builtins.readFile config.age.secrets.minecraft_rcon_password.path;
+        };
     };
 
     xserver = {
@@ -344,10 +362,20 @@ in {
       dataDir = "/home/ltadeu6"; # Default folder for new synced folders
       configDir = "/home/ltadeu6/.config/syncthing";
       settings = {
-        devices = {
-          "Pixel" = { id = secrets.syncthing.devices.pixelId; };
-          "TV" = { id = secrets.syncthing.devices.tvId; };
-        };
+        devices =
+          { }
+          // lib.optionalAttrs (config.services.syncthing.enable
+            && config.age.secrets ? syncthing_pixel_id) {
+              "Pixel" = {
+                id = builtins.readFile config.age.secrets.syncthing_pixel_id.path;
+              };
+            }
+          // lib.optionalAttrs (config.services.syncthing.enable
+            && config.age.secrets ? syncthing_tv_id) {
+              "TV" = {
+                id = builtins.readFile config.age.secrets.syncthing_tv_id.path;
+              };
+            };
         folders = {
           "RetroArch" = { # Name of folder in Syncthing, also the folder ID
             path =
@@ -408,6 +436,7 @@ in {
 
   environment.systemPackages = with pkgs; [
     most
+    agenix
     # mangohud
     hyfetch
     cacert

secrets/openai_api_key.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 PLsDCw QHiCDmpxviQE+8K5GTzoEROGdG3sMM7vI3hxPHs/sXo
+k3icGb22p6Em8LSsaJF/xnU28P17kXDwl4D2erNbvKQ
+-> ssh-ed25519 PLsDCw Hyntb19GeC7jG2NTle9WNna1X4e8judraY6vhoux8Qg
+xHO7Vh9OD8Yf9YfNf0n0jF2ZISd05M4d/r5+9NQRGiU
+--- H0bQF7/xRCAP100Y3VbPQoDzDC3tmF9YyrChk0Iwlng
+5YäQ¦¿Û¦h/|ä·]<5D>к·žò‘•y"oªy
Îùtà·hg–<67>z¾EÿrÇx¶/bMÇiÄÚ—|Ÿ?ôD
GÔ*å‚:¢{Ø@ì25Ó-•Úû'—´!ùƒFÉ
&6±ÿ@Ç‚ºq_ã<5F>:ª–®cbÝ–"*ã“èrpz°²±‚ª#EðÛh‘&· ¯ËpDy²#MºùˆË×Ò6<¤Œw÷<77>\Z‚O¹aBÈHæ;`´Y¦,ƒøçM;õ̓Úﬦ*™V

secrets/secrets.nix

@@ -0,0 +1,20 @@
+let
+  users = {
+    ltadeu6 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBitXAExTzEy48juhqlKANx/oYqnxpR7J6BCKsBXt8iH ltadeu6@nixos";
+  };
+
+  systems = {
+    Nixos = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBitXAExTzEy48juhqlKANx/oYqnxpR7J6BCKsBXt8iH ltadeu6@nixos";
+  };
+in {
+  "secrets/openai_api_key.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
+  "secrets/minecraft_rcon_password.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
+  "secrets/syncthing_pixel_id.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
+  "secrets/syncthing_tv_id.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
+  "secrets/wireguard_private_key.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
+
+  wireguard = {
+    peerPublicKey = "SZa3sH9QzjuhAzSFDybLbOxr3UxwPzV3SaiNLaJIjz0=";
+    endpoint = "vps32536.publiccloud.com.br:51820";
+  };
+}

secrets/syncthing_pixel_id.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 PLsDCw jeIeeJWcN+xV5azLkyMK2YdaZXlav1ehnv5kzmcURzE
+o6DUO2AoYX8OeIHlPM8dK21tGoG54Gnvr/CjlBGTLj4
+-> ssh-ed25519 PLsDCw SHKfV63stmxfaRZ/ZAWRsIDLRHpdjI5+IACMW1zv7Uc
+grXmEGA58z/XxNIWuhWlyUEPo4l3t6UGwnQbKiEs/50
+--- Sd2JFl0CaniOP+PynBOtGT+OJc3I/PFRMNZi0L9Ants
+¤ÌÇf+RsÍr#ì3W(¢•¿Îv!¸žv+‡
+ŽÕQã>“JÉEw–»SÍ[¸LQt|r7ñ].¥/a&‚B<0C>èׂô
šï*úê¢Ø’ctƒÑ	
+•<EFBFBD>Z+Y

secrets/syncthing_tv_id.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 PLsDCw wlxQ0eW0pF5TUUZH9/4eCc7fx5hJZ98mi0CHcRvUVFQ
+tGbNvthS41qp+SfzRsKZkBsQocuQxTpYE0u/0i23RdQ
+-> ssh-ed25519 PLsDCw Xz4F9+s7tS9r+qVf62ALAqqmbGfR719SdloCBmjZZ3U
+2Fdp5L0rVXH1U7GOWX07cxpkGfEVTuTFvTKGwFb+ueI
+--- G/eTc6dYfIhisIYxaWfhR3K52ruwAgtWpTj5V9nBs5Q
+d1Y<31>ÒÌF…<46>
ÈxÁk²îM>„<>g@$3Ïöuä‚ØàOWðÐÂã¡ÐJ}îR`Ô¢²ÊbÕž¤Öˆk¬Fv•‘l¸††<E280A0>—ó¼c”8ZÎȇ±Â<C2B1>QÄeüËw