nix format

flake.lock

@@ -366,6 +366,7 @@
         "nix-ai-tools": "nix-ai-tools",
         "nixpkgs": "nixpkgs_2",
         "nvim-bundle": "nvim-bundle",
+        "sops-nix": "sops-nix",
         "zig-overlay": "zig-overlay"
       }
     },
@@ -391,6 +392,26 @@
         "type": "github"
       }
     },
+    "sops-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1759188042,
+        "narHash": "sha256-f9QC2KKiNReZDG2yyKAtDZh0rSK2Xp1wkPzKbHeQVRU=",
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "rev": "9fcfabe085281dd793589bdc770a2e577a3caa5d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "type": "github"
+      }
+    },
     "systems": {
       "locked": {
         "lastModified": 1681028828,

flake.nix

@@ -25,8 +25,8 @@
     zig-overlay.inputs.nixpkgs.follows = "nixpkgs";
   };
 
-  outputs =
+  outputs = inputs@{ self, nixpkgs, darwin, home-manager, ghostty, nix-ai-tools
-    inputs@{ self, nixpkgs, darwin, home-manager, ghostty, nix-ai-tools, sops-nix, ... }:
+    , sops-nix, ... }:
     let
       inherit (nixpkgs.lib) genAttrs;
       lib = nixpkgs.lib;

modules/home/rsydn/secrets.nix

@@ -6,19 +6,19 @@ let
   sanitizeSecret = name: secret:
     let
       sopsFile = secret.sopsFile or cfg.defaultSopsFile;
-      extra = lib.filterAttrs (k: _: !(builtins.elem k [ "path" "mode" "sopsFile" ])) secret;
+      extra =
-    in
+        lib.filterAttrs (k: _: !(builtins.elem k [ "path" "mode" "sopsFile" ]))
-    {
+        secret;
+    in {
       path = secret.path or "${config.xdg.configHome}/secrets/${name}";
       mode = secret.mode or "0400";
-    }
+    } // (lib.optionalAttrs (sopsFile != null) { inherit sopsFile; }) // extra;
-    // (lib.optionalAttrs (sopsFile != null) { inherit sopsFile; })
-    // extra;
 in {
   imports = [ inputs.sops-nix.homeManagerModules.sops ];
 
   options.rsydn.secrets = {
-    enable = mkEnableOption "sops-nix integration for managing decrypted secrets";
+    enable =
+      mkEnableOption "sops-nix integration for managing decrypted secrets";
 
     ageKeyFile = mkOption {
       type = types.str;
@@ -29,13 +29,15 @@ in {
     defaultSopsFile = mkOption {
       type = types.nullOr types.path;
       default = null;
-      description = "Optional default SOPS file used when a secret definition omits `sopsFile`.";
+      description =
+        "Optional default SOPS file used when a secret definition omits `sopsFile`.";
     };
 
     secrets = mkOption {
       type = types.attrsOf types.attrs;
       default = { };
-      description = "Secret entries forwarded to `sops.secrets` with sensible defaults.";
+      description =
+        "Secret entries forwarded to `sops.secrets` with sensible defaults.";
       example = lib.literalExpression ''
         {
           "api-key" = {
@@ -49,20 +51,19 @@ in {
   };
 
   config = mkIf cfg.enable {
-    sops =
+    sops = {
-      {
       age = {
         keyFile = cfg.ageKeyFile;
         generateKey = true;
       };
 
       secrets = lib.mapAttrs sanitizeSecret cfg.secrets;
-      }
+    } // (lib.optionalAttrs (cfg.defaultSopsFile != null) {
-      // (lib.optionalAttrs (cfg.defaultSopsFile != null) {
       defaultSopsFile = cfg.defaultSopsFile;
     });
 
-    home.activation.ensureSecretDir = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
+    home.activation.ensureSecretDir =
+      lib.hm.dag.entryAfter [ "writeBoundary" ] ''
         mkdir -p "${config.xdg.configHome}/secrets"
         chmod 700 "${config.xdg.configHome}/secrets"
       '';