refactor: transition secrets to sops-nix instead of relying on hard-coded paths

.sops.yaml

@@ -0,0 +1,8 @@
+keys:
+  - &personal_age_key age1s6zlweaxqu6sldlhaxg24tqqwhcp7kvc3rr6h6895chk2ndaas6qdyj5gl
+
+creation_rules:
+  - path_regex: "secrets/.*\\.yaml$"
+    key_groups:
+      - age:
+        - *personal_age_key

features/sops.nix

@@ -1,5 +1,56 @@
-{ pkgs, ... }:
+{ pkgs, config, ... }:
 {
+  sops = {
+    defaultSopsFile = ../.sops.yaml;
+
+    age = {
+      sshKeyPaths = [ ];
+      keyFile = "/persist/sops/age/keys.txt";
+    };
+
+    secrets = {
+      "password_hash" = {
+        sopsFile = ../secrets/password-hash.yaml;
+        owner = "root";
+        group = "root";
+        mode = "0400";
+        neededForUsers = true;
+      };
+
+      "personal_ssh_key_ed25519" = {
+        sopsFile = ../secrets/personal-ssh-key.yaml;
+        key = "personal_ssh_key_ed25519";
+        owner = config.users.users.frank.name;
+        group = config.users.users.frank.group;
+        mode = "0400";
+      };
+
+      "personal_ssh_key_ed25519.pub" = {
+        sopsFile = ../secrets/personal-ssh-key.yaml;
+        key = "personal_ssh_key_ed25519_pub";
+        owner = config.users.users.frank.name;
+        group = config.users.users.frank.group;
+        mode = "0644";
+      };
+
+      "work_ssh_key_rsa" = {
+        sopsFile = ../secrets/work-ssh-key.yaml;
+        key = "work_ssh_key_rsa";
+        owner = config.users.users.frank.name;
+        group = config.users.users.frank.group;
+        mode = "0400";
+      };
+
+      "work_ssh_key_rsa.pub" = {
+        sopsFile = ../secrets/work-ssh-key.yaml;
+        key = "work_ssh_key_rsa_pub";
+        owner = config.users.users.frank.name;
+        group = config.users.users.frank.group;
+        mode = "0644";
+      };
+    };
+  };
+
   environment.systemPackages = with pkgs; [
     sops
     age

home/frank.nix

@@ -1,7 +1,9 @@
-{ inputs, pkgs, ... }:
+{
-let
+  inputs,
-  sshSigningKey = builtins.readFile ./ssh-signing-key.pub;
+  osConfig,
-in
+  pkgs,
+  ...
+}:
 {
   imports = [
     inputs.lazyvim.homeManagerModules.default
@@ -51,17 +53,12 @@ in
     bash = {
       enable = true;
 
-      # Import SSH identities and
-      # display fastfetch on shell open.
       initExtra = ''
         eval "$(devenv hook bash)"
-        [ -f $HOME/.ssh/id_floturcocantsee@daguerro.net ] && ssh-add $HOME/.ssh/id_floturcocantsee@daguerro.net
-        [ -f $HOME/.ssh/id_rsa ] && ssh-add $HOME/.ssh/id_rsa
         clear;fastfetch
       '';
     };
 
-    # Configure ZSH if using darwin (macOS).
     zsh =
       if pkgs.stdenv.hostPlatform.isDarwin then
         {
@@ -69,8 +66,6 @@ in
 
           initContent = ''
             eval "$(devenv hook zsh)"
-            [ -f $HOME/.ssh/id_floturcocantsee@daguerro.net ] && ssh-add --apple-use-keychain $HOME/.ssh/id_floturcocantsee@daguerro.net
-            [ -f $HOME/.ssh/id_rsa ] && --apple-use-keychain ssh-add $HOME/.ssh/id_rsa
             clear;fastfetch
           '';
         }
@@ -111,7 +106,10 @@ in
       enableDefaultConfig = false;
 
       settings."*" = {
-        AddKeysToAgent = "yes";
+        IdentityFile = [
+          osConfig.sops.secrets."personal_ssh_key_ed25519".path
+          osConfig.sops.secrets."work_ssh_key_rsa".path
+        ];
       };
     };
 
@@ -167,7 +165,7 @@ in
       lfs.enable = true;
 
       signing = {
-        key = sshSigningKey;
+        key = osConfig.sops.secrets."personal_ssh_key_ed25519.pub".path;
         signByDefault = true;
       };
 

home/ssh-signing-key.pub

@@ -1 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ5+RJOhvamBpEptCRv90E+8bVWKn6Mep61wDpPYgKP3 floturcocantsee@daguerro.net

hosts/shared/nixos-pc.nix

@@ -1,4 +1,5 @@
 {
+  config,
   pkgs,
   lib,
   inputs,
@@ -151,7 +152,6 @@
   security.rtkit.enable = true;
 
   programs = {
-    ssh.startAgent = true;
     firefox.enable = true;
 
     gnupg.agent = {
@@ -168,6 +168,7 @@
   users.users.frank = {
     isNormalUser = true;
     description = "Frank LoTurco";
+    hashedPassword = config.sops.secrets.password_hash.path;
 
     extraGroups = [
       "networkmanager"

hosts/shared/nixos-server.nix

@@ -1,4 +1,5 @@
 {
+  config,
   pkgs,
   ...
 }:
@@ -72,11 +73,10 @@
     };
   };
 
-  programs.ssh.startAgent = true;
-
   users.users.frank = {
     isNormalUser = true;
     description = "Frank LoTurco";
+    hashedPassword = config.sops.secrets.password_hash.path;
 
     extraGroups = [
       "wheel"

secrets/password-hash.yaml

@@ -0,0 +1,16 @@
+password_hash: ENC[AES256_GCM,data:ErID6NBUyznC7N+OMWWoArHPjcnZtphTkuDIfz4zI69TVJ7vudBoR8hz8lMq0jNzOq+rxkourkk3xm5J3mFyVUxOMJe0Vz2tlA==,iv:tCGHD8n6Y0lmvnpmQkf952VNQ42BkWjsiDhgzcls2ig=,tag:7tfLXfhFF9/qCzaDT1BEXA==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwazNKVjhNQjdVRVY5RG5p
+            cG5ETWwvbXZHZENpYWRORG1JZi9lclQvVmxnClByNjZtUFBkWjFCbDZ3TnJnWnVD
+            Yjc1Rkk4RWRZenhNS1dzcGlkNnFDV0UKLS0tIHEvSmgrMlBMb2tyK2hzeUVIQzZx
+            VTFua05vZFFQV0dzSjczKytBdHl0dDAKS9D3rRLy6F9rvUhOr0KYDhvNvRvn3W82
+            lCwkwtsXd2L2sPXKEfVd1r+dUaKDkXcLUXVbada7ma6UDLOmAq7Kqw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1s6zlweaxqu6sldlhaxg24tqqwhcp7kvc3rr6h6895chk2ndaas6qdyj5gl
+    lastmodified: "2026-10-21T14:34:25Z"
+    mac: ENC[AES256_GCM,data:QuRO9S3rK6dDIGUsgTHzNcypCMeR1AkATwVARv7Na1p6/n2S+5HLuGLkoSDWMnB15r+9GYrYaxDs9b4ppApCfbENrH1ffO7ZyhbY+NfbCgNTq/KgxZvbtAoQiwYalD97MNiZ2OBhmmVEe4ne5Fy1WY7g5uYnwYd7hIK+Vr/iCNE=,iv:rSho67a/+rZjb7iw47IXwKnqONc4tk5lbJBZDmrj9U8=,tag:tYWB4Xiv+oCKadn0IIIy1A==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.3

secrets/personal-ssh-key.yaml

@@ -0,0 +1,17 @@
+personal_ssh_key_ed25519: ENC[AES256_GCM,data:57BaRc+Tkc/kdpLA8U/Qcydpo69FSP5kqAaqAsa7WaFGhPvrwiU4wrChP82nJb4Ilu4QLBphKRmKOFl7wlG3asvyyLhQ19JIeqdTq/lmByfdnGxv5Bugn58Oqj+f1uY5TQrLLf2QsVXwfgc2LgDGaMXzZdaobYOcgNwaRy6W0CWpGJRjUZgtwZRRnm6RApUaUsWjaN5n5NKcT1NlQNVVItRJiO86UUnv4PJcvZYw9ll5RrWEVgPXkljOq1BaKNhdwD1DEPJT0qYDK1N+Wypl/CGXL/Q1F/zKjwKf7VnGdHpXcef/BCG2fWI7fY0RQDEu5oKgVt4wtcPVRp4jbPpbW7OEUWW0BlcPqpteWXVmcl9U6s6E6RnbnSO/Gw4TppFXGnFvT/LsmlyLUeIFAtRb/278QgWzMfcjFeo+l6GK4i/8m4VU9pHQufsnEiF5KKESFQTk/r7waCBs3qe3PAkAg3M8tRkO1Q5E/8RLXwqZMD7LqAvuwraViJGYwWvlWVRsArBnv1n8sEKBlRlbpE6GShrgt3bAIKqoW3U/fxDdL3NCBYQ=,iv:/oeGYRtBWjD3pq/X/Sab+UVzIAVxE8QvvkTmb/45UO8=,tag:3kIbuY2UPbw1L7EH2++kaA==,type:str]
+personal_ssh_key_ed25519_pub: ENC[AES256_GCM,data:zz/LBq5KI2t/z3YgP3gHK3B/c2O/jq6sQ8mT5qgoUGsL5VTvREUGnDaDxtaOcbez59srqmlQHwXbQ7Dax6iWEtWx4gtMhJ9piVzH/3skB0dMZ3W+7bNtCev1SkHchbWLUPD/ryXZ4LCAipMoJA==,iv:qD07xcOdZDokhKIVqS5ibWsEKG66eYy1JnBUzzlPoS4=,tag:732RVmwKJL2PlcJih+2PGQ==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1SFRTZFU3bzM5UE82Uk5p
+            UENKUFd5R1lIOW43YnBTcXlSWHBFUHlRYURRCkFGZTM5MFlnd2hKRUpRM2hRdy9o
+            dHlzbU9Xbm9YVENuSVR5Qi9JdEFIZk0KLS0tIDJ4SDNKZE41eGtPa2UrVDBTZFVv
+            VWsvQkc1bU1ObHBBUVd3ZXJBQjB1UE0KRgd4k0kRo15tsDOvv/VRTXUJ1afp8DKs
+            EumIPk0zTyes/2WgrDOD4/j0wGfhkallIv/fdE3X5XD113nX5tPx4g==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1s6zlweaxqu6sldlhaxg24tqqwhcp7kvc3rr6h6895chk2ndaas6qdyj5gl
+    lastmodified: "2026-10-21T15:36:21Z"
+    mac: ENC[AES256_GCM,data:6X3jGfrWA1jZexwmABzYiM1zayYeY+SvLXABVTHpoxxS+nMlIk63f+kG9WawcUJlXe1OoUau5PTNTDgOHAqx0ADqS2hImr74SXR/6HOoisB3l3R/jEUOLUYAW+AsgPeMba0h/3I7KkHVxbJjNkWt4znm2M1kmCF4r30sUm1FL8w=,iv:RTtObsxYvBZpY2UgSgk3X+Y3m17hG1qQzsrucmO0azo=,tag:oc33OTwCqknLAmlBYBktOw==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.3

secrets/work-ssh-key.yaml

@@ -0,0 +1,17 @@
+work_ssh_key_rsa: ENC[AES256_GCM,data:0fs+x0gDnj3rQ68fzQT1npIKTyBRSIbqGWDkzFXI+un/9PKb3HoffpNEPvGnjC+XqG0gnA/0WQbbGyN8xN+eJPmDKYodVh1v5RfumM96FLazgolaY/esi3zlFKHRCEEtJRNcGi7YQKrr5k4vpt1cyMFYrcpPcWnq1P4TIdQXfGyTmlaQfMowAE1FQHfKt/6p2fnTHcgIeLnrSeJVWKc5v1yzWGULHsbUXVP4z/1YPNWeCtUosb5Hf3FGLXy4KHKW+Zt8aX8gGf6KG/CWBhHVxfyqNSP+EkHJjpYzngVQpqP27LniltQn4tIikU0OJsGBhUlRmRJHryy+hmQyXxxP93rh/wD4xlw0x0jQJ8w1r1VMPvgnk7HPGzEYwvgblFDHlfwgQI/FtMtvz/PuXzXHZeLSteCBKphB6JaaOqlMuggrb6rBnaomoSUTbICTefumjH2V4KNOB++xUfOk8h8NJzvGeEznBKcKtuz8kRVwaplaSdgOy2cDRT+UGaTfj3yFK8zQkKAdCsortkgetPhwoB9XeHaOCULh9Iu0GsikxJ/vJA6rhR5S3zVARdNGHV+M4IbKVrbMT1Y+WCykeSZdU+1ONQAONkSctMNmVUDXfuOJ3P6O7ZA997UO/PydDuJtb7IUoDqkme8Rg5Vw0MdhSxHbpzxPfF8aGfO5pzduVQld61qdYQI3H+aj5SIFpijoppCFB9xqq0btKhOOy7yHLOU75TsDkxbaG6mzdeFIrOBC+ynWMmyBYXMIhWoxUWqEfWozSRXLuBHxle0s4bYUcAs078kdrCi5qaYuOV+DmRtSmNgWXuiMxwzHHDq6MQG584sixOijAJIIvDFk4aBkr/8tW+o1rDLmvYgxdZnixbImDy/LOqmmM7HkIUduAHonw0/gYQ4Vpj1wE+ep9EsYiZIp1SJSxVGCREgDxtow1i3oPLjFySHkhZX6BhNQVuRFgNyfmi5HUaU3NxXATsc2g4qT49NfvgGrO81UjYh2AZRlDThI1mZ6+SjOZWYD8d7d14G6kaye0CgOAjbFr1lKzkUsdFF2/2kSoelZ6rJ054j+QjdX2hYLHWj9nzDnYY54Aw74Hhaf0jfUsz/nz/do+gQ56HfkwGY+ClVwz7I87QNWIgYGuF9jflpceEB6O9n+ga0+u+ohrV4MT7LhCnJCmW+t5MHdKnup/DYuXZb+VvigcUrJgKb8fglNkL7dCjnUoz07aBlHAWA0wehgZP0TQG7eSwOs3UdZ0wEG2HL8SiRjB6XtfVaelERiFtdf4+W++txezZfmCwyiTntS/ItF6i6DAB0ZxDMo0d97eHa4tO7V73dD4/Iq1kUKB5cjvbcxPtbp1ROfx6c1wj/XbHEvnOxHCTGzlkRCACR2ZevT1sHzjLTz/92amJd7BJ6x0KHt718NQxezBXgvIQqb29SXqAThZGMp1Jv33CrJRvVMyPTwvMq8+OViDF+cFHJSGJ2CQZ0tjGe3bUP3/LtGFXBN0bYUGF7r8IkFg3vp/YJpu2avuuOY41OuJkZ+XfDtK0NwCUmuBbjNLUjFG+lTkrnd+n1VbYuIUVlgWyXpbX0uppmRurLItpOBvbcQTNL7v6bSElkU+PsTUiOPJhZoR+GiMpZRLnPbSe+MzwI4kKmu+HSdLIYLyv1AXKyGcb3GMG7FZr1pSY3vm73R7UvEgv4jmT8RnKF8lidelv1g4LapcTrrtHimbInD5DGJnygKLYU0coQ0woz73xy/GsDp6emKKolpvZyOBjApovpMEmdWvEz73TeACDh8VB4Vra72VjuNPGF39pcO7yZ0I11eCCDk145CCfmRxVxfZTIIOHl6whPC1Lz+CCsK7h/2dE5bdPkc86f28AEeAVL5zFYz1KqyhyOM7lx+EAAnUVXOpUBMyCHbSbKbUUzmr7cZ56xB47fgphaKrFYRqNvID+25WCxUa/n5PTj95LoMc9QYd4BrY7cQMZBDANmzBLYN23j7qA3TFVzOasQa8iRce4s1v4KcKiKTwpQ3317T1Z26+vcluEPXKHoKXJw341EbwkrWxSIX90fbYBhYTTU1Wc5/lpmME+9WMILy6OKgK41xhIu6+hGvHGLIOn7uL34smGKuSu+6z1MYT+c6/+GrbwKo5Wiw4YZeJ1uHAxYbyGr5qOP6zzkTG/aKiZJTrS6sAMipomyj//ty+YuSp0frRQ2MACNIeXQK3qSHlZQgHPeEfS3X4OINqB1IvmY7CiprtJj5P69gux0PgnCnXqkP5Hm4QmlirDbtZRMaVhllgWKxVmZf+7V4Lakuw9q//QIhQZ5Uhu+PtTcAfckPrFZKxoDXlnfbF+oxr4MSWZNK0UFZSvlvLPN08nu85W7gPyqKGSRekbkloJZ0PQi0Z0VzsH5SlMKbUaqftenh6UN+vVSZUDVqu11wXtl+fFqbr6jQWiIteXf23CNwCtSBcHwvq07izwxmzHJS8OCyZZNTA6RVg8oaZNmcGp+K+8K6nRibgHCvmP0p4A54p9jNdypmL3EbtjGMTivmtlfoffaq6z3cYOhyMqKeAaoTOxKM7bVYK+CoaFfIpCqzP+2B2tMX1AZnEqe6S7hdAHqndfgpY23KwVPqxTEK7Xe4m2HLt5fTvNs50zilBbkrpP62OyH0K7MDcA18ECltKWu+w2SqI4Z4jxULcawmeO3XxT1ocowJNK4LgejTqjFUkjsc0Eds4wF21UDRIHR2scMfP+5wZZhZTMJl4aeOT0HECKLfLi1mqwbo3TVviGjxjNSMIVJ18d79Gvupi4f3BpdrQcXR+VIdR9+mYbK4zR68S2ka/lN5+m6g7N06oh+xRAPSruRdfolqgI9EfPRvV1y2m9J6u3koWTN1q8EzIxAoT8z9I3qEV1x2YCAziXnaZ/cHcO83hoGsjwCrw7C9vcftLhpebJPH94oddTE9+S4DLL80XFRFaeudGSxOXzysv+eILp6xR61Riqx9o7FzmKtLFRnZWckJXn51zfJvHyZlMiJyqAS/4POT5acQq5SVzg+0PhHSRjx+XFaqBIvouTMwUyHPVGyOowrQcWUtMd6MPg1WHigdVT0JtzGTbUtqYfxQa7kWbvlxW/UsUuHfS5ZR7FSpVlsyRxCzrow+a7R9n3z6DUo+obtl0p5ya4ujIu9oCwuk/iAth11orES19WRdh3t9pgRlhrM12nCgRjimAhDkxtXqBtiBxOjJEOxCeS0MXqp/+65xf09pUxiSt2Lpp5SPSAp8JqUJcmYy+d/DXSEqLxetVhk1KolA2ItH33a3gw==,iv:THOxkQwaN/kdzH0CclqsImu7L1pFE4zSp/tMmenaAdw=,tag:qhGNi++VEEW7X5axFvpVVg==,type:str]
+work_ssh_key_rsa_pub: ENC[AES256_GCM,data:/WkultfyCTL8un1/AbCZvJDqhnsYqir0CN1NNRt3IX+o7xEBWJPdElysSW1Y6EC6GQZym0apgRVE/uiaG6Sjhczcgan5VN6TUk8s3aJZCwICtE7npRKV11q7D/HukzpAj8a2BnB0O0SLjGeIAfhOjSBfVmpWScoIGpHhU7XgAMvm5x8lcaX/Gi0F8lHlF+zigW/R4oR8q7XuGGrFXUZmHraK713IpJBDsUAiYRh34wu0T3Z8PqMAJUPRUvGYHMa3ouEBc5RoVxuK4z2hFS5tWMZBgCQCMt4eVQcIwgc3FROw66iDFYkRnhXXUm2YBoULMHiLFU2LoULiI6i7RK3Aqr+dyL//FCPjxZLluP7ujlqX+GEaiHVZNAg+OvM8Je8XuUufyVYw5nbUvklU4lQd8m9U3yYdMK1GExQ0cgS2CGTGf364bWOLb+dPkeuh93kE+dfsW8r3FcQOwcN/X4F3alFt+dD1eiW7cndD7Pd/RQ7907MarzZ9H2AyAJhq8xcP8MqK7p8CLM5+cvgeb+XACWoCh12NuV8eBkWniK412b0yddj2DBIgCgJTvZXsUk8tb6vOuIdvh4qoVTd7ROyfr86eTjKFtiZTFtt7vUMU81N2ywyn4Iq9DYBqEijuYCqo/vBxMGSEHU1Rawh064ApyznUV16obHzx6DnydNQewGGEUeWC6ad/USlEMXUR7pm9Ou/ulY0TyB9Jvb8oNxCOcqjM/QK9r6dgfA==,iv:BTpI5ez+Xppmfe/FwXupyaOWpi2Xbg/DXl6KBP9cQVc=,tag:hwfWHZs817tEfpNgx8fBSw==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArS1lHNXg0RXZtUDNqVVFN
+            eUQ2R3hQZHpualNvR0szdWw3ZE1EOE5ERlFZCkIzdnhrdWpVelBvQU9ZKytqZU83
+            SUpVbzZqRklJUW5vMmRVSml4WFF6SVUKLS0tIGY5Vnh6aUV0cm5Gc3ZzclU5M21W
+            U1MxUksxNExCanVIdFg1TWM2VjF2RkkKhAAaUkUU8yibX/IWsHEqUpj8YXF5788o
+            BnICIf71oGouFzEUOFvUk1kRrnGvtzLCk5yb63Cta6wwRsF2svnWcw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1s6zlweaxqu6sldlhaxg24tqqwhcp7kvc3rr6h6895chk2ndaas6qdyj5gl
+    lastmodified: "2026-10-21T16:12:16Z"
+    mac: ENC[AES256_GCM,data:7voI9O3u5v1z4u24NOPjKfS5RYhZFG80rL5NJ/ynr/5k9EZpWI1bhfLT61ZVJFXZnPij6WZGRn+LZl4/ReS7bKTp15gicrUGgjnNAEe/iRYbPUUsCpSi/tbGNebPr1P/Z/D78gzTnPZdx7ulbgRtGfByVWRL3Nx4yXaIrDd9T4s=,iv:CQaoW0J8XdCzSgjV6iRlxtE0mwhl/zIebWUNs3OouSQ=,tag:HOfuYMT1tfQYKJj+m34lKw==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.3