...

1 files changed, 13 insertions, 8 deletions

diff --git a/os/srv/sops.nix b/os/srv/sops.nix
index 3c9f0a9..40f9c74 100644
--- a/os/srv/sops.nix
+++ b/os/srv/sops.nix
@@ -12,26 +12,31 @@ in
 {
   imports = [ inputs.sops-nix.nixosModules.sops ];
 
-  options.os.srv.sops.enable = lib.mkEnableOption "enables sops-nix secret storing";
+  options.os.srv.sops = {
+    enable = lib.mkEnableOption "enables sops-nix";
+    diskEncryption = lib.mkEnableOption "enables initrd decryption key (LUKS)";
+  };
   config = lib.mkIf cfg.enable {
     sops = {
-      defaultSopsFile = ../../secrets/secrets.yaml;
+      defaultSopsFile = ../../secrets/common.yaml;
       defaultSopsFormat = "yaml";
       age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
 
       secrets = {
-        "syncthing/gui_password".owner = username;
+        "syncthing/gui_password" = {
+          owner = username;
+          sopsFile = ../../secrets/oci.yaml;
+        };
         "obs/websocket_password".owner = username;
         root_password.neededForUsers = true;
         user_password.neededForUsers = true;
-#        crypt_key = { };
+        oracler_password = {
+          neededForUsers = true;
+          sopsFile = ../../secrets/oci.yaml;
+        };
       };
     };
 
-#    boot.initrd.secrets = {
-#      "/tmp/crypt.key" = config.sops.secrets.crypt_key.path;
-#    };
-
     environment.systemPackages = with pkgs; [
       sops
       age