nix fmt, sops encrypted

modules/home/rsydn/base.nix

@@ -47,5 +47,54 @@
 
   rsydn.languages.enable = lib.mkDefault true;
 
-  rsydn.secrets.enable = lib.mkDefault true;
+  rsydn.secrets = {
+    enable = lib.mkDefault true;
+    defaultSopsFile = ../../../secrets/local-ai-tokens.sops.yaml;
+    secrets = {
+      "openai-api-key" = {
+        format = "yaml";
+        key = "OPENAI_API_KEY";
+      };
+
+      "openrouter-api-key" = {
+        format = "yaml";
+        key = "OPENROUTER_API_KEY";
+      };
+
+      "zai-api-key" = {
+        format = "yaml";
+        key = "ZAI_API_KEY";
+      };
+
+      "moonshot-api-key" = {
+        format = "yaml";
+        key = "MOONSHOT_API_KEY";
+      };
+
+      "anthropic-api-key" = {
+        format = "yaml";
+        key = "ANTHROPIC_API_KEY";
+      };
+
+      "exa-api-key" = {
+        format = "yaml";
+        key = "EXA_API_KEY";
+      };
+
+      "fal-api-key" = {
+        format = "yaml";
+        key = "FAL_API_KEY";
+      };
+
+      "groq-api-key" = {
+        format = "yaml";
+        key = "GROQ_API_KEY";
+      };
+
+      "firecrawl-api-key" = {
+        format = "yaml";
+        key = "FIRECRAWL_API_KEY";
+      };
+    };
+  };
 }

modules/home/rsydn/devtools/ai-tools.nix

@@ -1,14 +1,7 @@
 { config, lib, pkgs, inputs, ... }:
 let
   inherit (lib)
-    mkEnableOption
-    mkOption
-    types
-    mkIf
-    concatMap
-    unique
-    warn
-    escapeShellArg;
+    mkEnableOption mkOption types mkIf concatMap unique warn escapeShellArg;
   cfg = config.rsydn.aiTools;
 
   nodePackages = if builtins.hasAttr "nodePackages_latest" pkgs then
@@ -51,13 +44,8 @@ let
   claudeDefault =
     choosePackage [ (getNodePackage "@anthropic-ai/claude-code") ];
 
-  toolOption =
-    { name
-    , description
-    , defaultPackage
-    , extraOptions ? { }
-    , extraDefaults ? { }
-    }:
+  toolOption = { name, description, defaultPackage, extraOptions ? { }
+    , extraDefaults ? { } }:
     mkOption {
       type = types.submodule {
         options = {
@@ -113,8 +101,7 @@ let
     }
   ];
 
-  zaiWrapperPackages =
-    let
+  zaiWrapperPackages = let
     claudeCfg = cfg.claude;
     zaiCfg = claudeCfg.zai or { enable = false; };
   in if claudeCfg.enable && zaiCfg.enable then
@@ -143,7 +130,8 @@ let
         })
       ]
     else
-        warn "rsydn.aiTools.claude: Z.AI wrapper requested but package is null" [ ]
+      warn "rsydn.aiTools.claude: Z.AI wrapper requested but package is null"
+      [ ]
   else
     [ ];
 
@@ -225,6 +213,7 @@ in {
   };
 
   config = mkIf cfg.enable {
-    home.packages = unique (toolPackages ++ zaiWrapperPackages ++ cfg.extraPackages);
+    home.packages =
+      unique (toolPackages ++ zaiWrapperPackages ++ cfg.extraPackages);
   };
 }

secrets/local-ai-tokens.sops.yaml

@@ -0,0 +1,26 @@
+OPENAI_API_KEY: ENC[AES256_GCM,data:+3NBsL06StOplxhn05jSBGD06bTrJBaKjjBdE7bclTH3RStMTVhs6lXHEqrFMJ1cLpEh+AFR7gE=,iv:hH+ElXuDFfJ2Pr9jr3vZMOpRV0sDKV/CtnVm4dTHNl8=,tag:zTV/2Zhxz15yHJmxhyNXvA==,type:str]
+OPENROUTER_API_KEY: ENC[AES256_GCM,data:ToATfynUhY4df2ax6SywCpUCHl4JsOEi/yMcBhg8/7ulOq6Cqq5U2VKgtpA38Cr6qbJTOtZXVtNU2YUwdz8LQtGOoLqHp2pTaA==,iv:UZta/z68CZkGkzhPRH/EFAVhFO3G9fAE9a0zmBQm1kg=,tag:bkPjdaeSl/Hxed9gdtyhSg==,type:str]
+ZAI_API_KEY: ENC[AES256_GCM,data:/dwCvRmNF9n0c/yKs3ii/pSku6+g03JBXv4AauNvjaU+0plsE3xdWL+B4mGE10HAsQ==,iv:3zUAJnsWigBaqDc6BuOLecSq0S1D9EpBOkMHVifHF6c=,tag:0sW0UcTGiYNWBksiAwHF7A==,type:str]
+MOONSHOT_API_KEY: ENC[AES256_GCM,data:WhPRdFqUcOJctdowxsCAX/2qzMuWJ5P7JnvpNqGg+8mPxIPx5ybnG+6XQ3nYkZONJx8j,iv:v7rh6AHnSb4BLhthDbU4Q3UhV5YzcwO4xe2M9/0nY54=,tag:w1w4Si8aiizsr5r+nQUyUg==,type:str]
+GROQ_API_KEY: ENC[AES256_GCM,data:0UwJWQNxzfMaeBEvhqc5h37xTAoIq3Ld+AenEL16SVVLaogtMSaxHX1B5pn7XiEz/ermPLYq8/c=,iv:2Cb5OLKYDBvcogXHGIK50eKx4uAkfxj27RaLBzPNM9M=,tag:fz+v1NU1nh4Hg/rwvu35oA==,type:str]
+FIRECRAWL_API_KEY: ENC[AES256_GCM,data:W48XK3/SjIuQUANEZ2tCWU+uQK4RKzPZE8hpkHopydUl/dQ=,iv:we/6fCvmXfaTE91/EIO09AryyUh3HGWvSPEaKb8IRSY=,tag:OHP2ryFhww9y8ueaxauuPA==,type:str]
+FAL_API_KEY: ENC[AES256_GCM,data:lyfSFpJYExZBY/gsiPAGJtPUREUMBPWB/wY9A6CG2P+i0vOBuem/8exud2bIIY70UNvGZz0wV+GxSvZvIkkHjVFTahLu,iv:D5ysGAwOKMhBWJ5OSL4djyLTngQqS1K+9jUNWnU6ors=,tag:3ZDED4pAGWl4jrvaxEu9Lw==,type:str]
+EXA_API_KEY: ENC[AES256_GCM,data:rMNonp76DeS1VtZuvs45Fwhj2aIVfoNWENHp3J9OxajK8uYC,iv:FroyalXHrrx+0SYSymVBCsFTuVOMzFQGAwicSxrE7a4=,tag:36MTbKeswrexO7dFe/wR1A==,type:str]
+ANTHROPIC_API_KEY: ENC[AES256_GCM,data:aBgfgHQ8cyJ4TUq4O6y218flTgDWcAXatY0/xbaD3AVvirCaEUXfsPP+0ySlVxlzx8hj9gMizlY2gJkNarsgwHCikOtmh/ZCxbQMbwogByqdV3C4myY7UwMgZdYzZGaQBL0JWR6ZZjf9ZK2T,iv:QB2tYhBtOU45Ho65FwQhD2H6gv7VobDXWgV/S9qu/yc=,tag:TTkEyjiTHYA1ZnMMwHwk4g==,type:str]
+OPENCODE_API_KEY: ENC[AES256_GCM,data:2aPaiODhpFObObRN+/HiEVsvMds1n6MhrmvQUWo2ozRzgRHQ1dGGZYFzOZoSbV4vpjmiqKW7VUFnVU5va1xlS8HrWg==,iv:DgCF9I+wT9xUjmenfUSDrDnKD5Ai4pJGw4qKmePpZOo=,tag:YD7nO4HbDKTa3zNbGtUCOg==,type:str]
+BRAVE_SEARCH_API_KEY: ENC[AES256_GCM,data:7Q+8sa2Xp4amEMkGzgEZzSLDCkstL71lu3sz1iGJdg==,iv:pY4NMgIUEEqwBUonAOAVoqP0EeqgON7h23221Yoa4aM=,tag:foyjDNIMsxrKvgYmu6FJNA==,type:str]
+sops:
+    age:
+        - recipient: age1qfgey5w87dresg99zed3d2yz62hv6c2c7u4gd5e880vjrngmx9ksgfv3sj
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOaFFBQ3RQZEZBelhKdVla
+            cldzbnoxQUxPS3lacE1SZGlTL2t1cXMyRFUwCklXKzlvNVlQZXROM0thS1FDQWNy
+            Um5yRkgvUnlsdVlQRmowYkg4eHp2Y00KLS0tIGJOOERDSE5oQm9xaVg4WUFUa3Nh
+            WHRrVWx2Y3FabWpBdjZ5VkpFY1BGeGsKSc4vxaHSj/6g7clPZDOPqCf3Zo+VGSRy
+            HwLiHEohjk5/R3I5KWhFuO9aNQTNYYnUBwc6nOAcEhw+Mihq2gDtzg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-09-30T16:59:49Z"
+    mac: ENC[AES256_GCM,data:HmA7khtD8oapqPPZ7AxZjxSwkqmhGb0TP6u2S6q20I/B/xittoH3EGs5bq9AaeY9wGAkxper3VlPXsBXs67pOZVJOuB/0h22DlOvrI6eS83y5ZSc+lPQgfK+/93LwbWhSe6l5EKRTGSHZMclr+raMsbjRPP/zl9Lf26fkz79XCI=,iv:73kl7xWE1slcc3YmR7lVsRYvsLW8XQ67qE9GfgBuRRU=,tag:f4LyjoGOgC7tYcFGNgpXlw==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.10.2