Add matrix Android project secrets

AGENTS.md

@@ -557,6 +557,9 @@ Estado atual:
 - `secrets/android_release_keystore.age`
 - `secrets/android_release_store_password.age`
 - `secrets/android_release_key_password.age`
+- `secrets/matrix_android_firebase_service_account.age`
+- `secrets/matrix_android_google_services.age`
+- `secrets/matrix_android_commander_credentials.age`
 - `secrets/minecraft_rcon_password.age`
 - `secrets/wireguard_private_key.age`
 
@@ -582,6 +585,12 @@ Estado atual:
 - O alias padrao da chave e `release`.
 - O helper `android-signing-env` exporta `ANDROID_KEYSTORE_PATH`, `ANDROID_KEYSTORE_TYPE`, `ANDROID_KEY_ALIAS`, `ANDROID_KEYSTORE_PASSWORD` e `ANDROID_KEY_PASSWORD` apenas para o comando filho.
 - Use `android-signing-env ./gradlew assembleRelease` ou `android-signing-env ./gradlew bundleRelease`; nao exporte essas senhas globalmente.
+- Secrets locais do projeto `matrix-android` tambem ficam sob agenix:
+  - `matrix_android_firebase_service_account` materializa `.secrets/firebase-service-account.json`.
+  - `matrix_android_google_services` materializa `app/google-services.json`.
+  - `matrix_android_commander_credentials` materializa `.mc/credentials.json`.
+- O helper `matrix-android-secrets [project-dir]` cria symlinks desses tres arquivos para `/run/agenix`; por default usa o diretorio atual.
+- Nao migre `local.properties`, debug keystores, `.gradle`, `.wrangler` ou caches locais do `matrix-android` para este repo sem um motivo explicito.
 
 ## Dependencias implicitas e pontos de atencao
 

hosts/Nixos/configuration.nix

@@ -38,6 +38,44 @@ let
 
     exec "$@"
   '';
+  matrixAndroidSecrets = pkgs.writeShellScriptBin "matrix-android-secrets" ''
+    set -eu
+
+    project_dir=''${1:-"$PWD"}
+    if [ ! -f "$project_dir/app/build.gradle.kts" ]; then
+      echo "Usage: matrix-android-secrets [matrix-android-project-dir]" >&2
+      echo "Could not find app/build.gradle.kts in: $project_dir" >&2
+      exit 1
+    fi
+
+    link_secret() {
+      source_path=$1
+      target_path=$2
+
+      if [ ! -r "$source_path" ]; then
+        echo "Missing readable secret: $source_path" >&2
+        exit 1
+      fi
+
+      target_dir=$(${pkgs.coreutils}/bin/dirname "$target_path")
+      ${pkgs.coreutils}/bin/mkdir -p "$target_dir"
+
+      if [ -e "$target_path" ] || [ -L "$target_path" ]; then
+        current_target=$(${pkgs.coreutils}/bin/readlink "$target_path" || true)
+        if [ "$current_target" = "$source_path" ]; then
+          return
+        fi
+        echo "Refusing to replace existing file: $target_path" >&2
+        exit 1
+      fi
+
+      ${pkgs.coreutils}/bin/ln -s "$source_path" "$target_path"
+    }
+
+    link_secret /run/agenix/matrix_android_firebase_service_account "$project_dir/.secrets/firebase-service-account.json"
+    link_secret /run/agenix/matrix_android_google_services "$project_dir/app/google-services.json"
+    link_secret /run/agenix/matrix_android_commander_credentials "$project_dir/.mc/credentials.json"
+  '';
   haAirConditioner = "climate.ar";
   haLaundryDryingToggle = "input_boolean.secar_roupas";
   haClimateAction = action: data: {
@@ -234,6 +272,30 @@ in {
           mode = "0400";
         };
       } // lib.optionalAttrs
+      (builtins.pathExists ../../secrets/matrix_android_firebase_service_account.age) {
+        matrix_android_firebase_service_account = {
+          file = ../../secrets/matrix_android_firebase_service_account.age;
+          owner = username;
+          group = "users";
+          mode = "0400";
+        };
+      } // lib.optionalAttrs
+      (builtins.pathExists ../../secrets/matrix_android_google_services.age) {
+        matrix_android_google_services = {
+          file = ../../secrets/matrix_android_google_services.age;
+          owner = username;
+          group = "users";
+          mode = "0400";
+        };
+      } // lib.optionalAttrs
+      (builtins.pathExists ../../secrets/matrix_android_commander_credentials.age) {
+        matrix_android_commander_credentials = {
+          file = ../../secrets/matrix_android_commander_credentials.age;
+          owner = username;
+          group = "users";
+          mode = "0400";
+        };
+      } // lib.optionalAttrs
       (builtins.pathExists ../../secrets/minecraft_rcon_password.age) {
         minecraft_rcon_password.file =
           ../../secrets/minecraft_rcon_password.age;
@@ -1435,6 +1497,7 @@ in {
     nodePackages.pnpm
     fishPlugins.z
     androidSigningEnv
+    matrixAndroidSecrets
   ];
 
   # environment.loginShellInit = ''

secrets/secrets.nix

@@ -13,6 +13,9 @@ in {
   "secrets/android_release_keystore.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
   "secrets/android_release_store_password.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
   "secrets/android_release_key_password.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
+  "secrets/matrix_android_firebase_service_account.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
+  "secrets/matrix_android_google_services.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
+  "secrets/matrix_android_commander_credentials.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
   "secrets/minecraft_rcon_password.age".publicKeys = [ users.ltadeu6 systems.Nixos ];
   "secrets/wireguard_private_key.age".publicKeys = [ users.ltadeu6 systems.Nixos ];