From 546203dc53a8dd0c887d198c2f44145129728caf Mon Sep 17 00:00:00 2001
From: 0xrsydn <rafayrussani@gmail.com>
Date: Fri, 18 Sep 2026 19:04:28 +0700
Subject: [PATCH] fix(zsh): load sops secrets through symlinks

sops-nix links each decrypted secret into
$XDG_CONFIG_HOME/secrets/global-env. The loader used the zsh glob
qualifier (N.), which matches plain files only, so it skipped every
symlink and exported no secret. Use (N-.) to match symlinks to plain
files as well.
---
 modules/home/shell/zsh.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/modules/home/shell/zsh.nix b/modules/home/shell/zsh.nix
index 833831e..be92e26 100644
--- a/modules/home/shell/zsh.nix
+++ b/modules/home/shell/zsh.nix
@@ -41,7 +41,9 @@
 
         [[ -d "$secret_dir" ]] || return 0
 
-        for secret_file in "$secret_dir"/*(N.); do
+        # `-.` matches plain files and symlinks to plain files.
+        # sops-nix links each runtime secret into this directory.
+        for secret_file in "$secret_dir"/*(N-.); do
           name="''${secret_file:t}"
           [[ "$name" =~ '^[A-Za-z_][A-Za-z0-9_]*$' ]] || continue
           value="$(<"$secret_file")"