andi242 · October 25, 2025 15:42 · andi242 · Sep 25, 2025
diff --git a/readme.md b/readme.md
diff --git a/configuration.nix b/configuration.nix
 { config, pkgs, inputs, ... }:
 let
  secretspath = builtins.toString inputs.nix-secrets;
  # ...
 in
 {

  imports = [
    inputs.sops-nix.nixosModules.sops
  ];
  
  sops = {
    defaultSopsFormat = "yaml";
    age = {
      sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; # this is the private hostkey for decryption
      keyFile = "/root/.config/sops/age/keys.txt"; # can be something else, but best root-only readable
      generateKey = true;
    };
    secrets = {
      my-secret = {
        sopsFile = "${secretspath}/secrets/mysopsfile.yaml"; # path to the file, relative in the nix-secrets repo
        key = "secret-entry-in-yaml";
        
      };
    };
  };

  nix.settings.trusted-users = [ "yourUser" ]; # allow this user to trigger remote builds. optional, not essential for sops

  some-service-settings = {
    hashedPasswordFile = config.sops.secrets.my-secret.path; # path to the my-secret on the host
  };
 }
diff --git a/flake.nix b/flake.nix
 {
  inputs = {
    nixpkgs.url = "nixpkgs/nixos-25.05";
    sops-nix.url = "github:Mic92/sops-nix";
    sops-nix.inputs.nixpkgs.follows = "nixpkgs";
    nix-secrets = {
      url = "your git repo" # alternative for private repo with ssh: git+ssh://user@git/user/repo.git?shallow=1&ref=main";
      flake = false;
    };
  };
  # ...rest of flake.nix
 }
	{ config, pkgs, inputs, ... }:
	let
	secretspath = builtins.toString inputs.nix-secrets;
	# ...
	in
	{

	imports = [
	inputs.sops-nix.nixosModules.sops
	];

	sops = {
	defaultSopsFormat = "yaml";
	age = {
	sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; # this is the private hostkey for decryption
	keyFile = "/root/.config/sops/age/keys.txt"; # can be something else, but best root-only readable
	generateKey = true;
	};
	secrets = {
	my-secret = {
	sopsFile = "${secretspath}/secrets/mysopsfile.yaml"; # path to the file, relative in the nix-secrets repo
	key = "secret-entry-in-yaml";

	};
	};
	};

	nix.settings.trusted-users = [ "yourUser" ]; # allow this user to trigger remote builds. optional, not essential for sops

	some-service-settings = {
	hashedPasswordFile = config.sops.secrets.my-secret.path; # path to the my-secret on the host
	};
	}
	{
	inputs = {
	nixpkgs.url = "nixpkgs/nixos-25.05";
	sops-nix.url = "github:Mic92/sops-nix";
	sops-nix.inputs.nixpkgs.follows = "nixpkgs";
	nix-secrets = {
	url = "your git repo" # alternative for private repo with ssh: git+ssh://user@git/user/repo.git?shallow=1&ref=main";
	flake = false;
	};
	};
	# ...rest of flake.nix
	}