Setup sops

.gitignore

@@ -1 +1,2 @@
 /result
+tramp*

configuration.nix

@@ -71,6 +71,7 @@
   boot.loader.grub.device = "/dev/nvme0n1";
 
   environment.systemPackages = with pkgs; [
+    age
     btop
     ffmpeg
     gnupg
@@ -106,4 +107,10 @@
     dockerCompat = true;
     defaultNetwork.settings.dns_enabled = true;
   };
+
+  sops = {
+    defaultSopsFile = ./secrets/tobserver.yaml;
+    defaultSopsFormat = "yaml";
+    age.keyFile = "/var/lib/sops-nix/key.txt";
+  };
 }

flake.lock

@@ -18,7 +18,28 @@
     },
     "root": {
       "inputs": {
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": "nixpkgs",
+        "sops-nix": "sops-nix"
+      }
+    },
+    "sops-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1775682595,
+        "narHash": "sha256-0E9PohY/VuESLq0LR4doaH7hTag513sDDW5n5qmHd1Q=",
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "rev": "d2e8438d5886e92bc5e7c40c035ab6cae0c41f76",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "type": "github"
       }
     }
   },

flake.nix

@@ -1,15 +1,18 @@
 {
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
+    sops-nix.url = "github:Mic92/sops-nix";
+    sops-nix.inputs.nixpkgs.follows = "nixpkgs";
   };
 
-  outputs = { self, nixpkgs, ... }:
+  outputs = { self, nixpkgs, sops-nix, ... }:
     let
       system = "x86_64-linux";
     in {
       nixosConfigurations.tobserver = nixpkgs.lib.nixosSystem {
         inherit system;
         modules = [
+          sops-nix.nixosModules.sops
           ./hardware-configuration.nix
           ./configuration.nix
           ./modules/bitcoin.nix
@@ -21,4 +24,3 @@
       };
     };
 }
-

modules/mempool.nix

@@ -1,5 +1,58 @@
 { config, pkgs, lib, ...}:
 {
+  sops.secrets."mempool/mariadb-password" = {
+    owner = "root";
+    group = "root";
+    mode = "0400";
+  };
+
+  sops.secrets."mempool/mariadb-root-password" = {
+    owner = "root";
+    group = "root";
+    mode = "0400";
+  };
+
+  sops.templates."mempool-db.env" = {
+    owner = "root";
+    group = "root";
+    mode = "0400";
+    content = ''
+      MARIADB_DATABASE=mempool
+      MARIADB_USER=mempool
+      MARIADB_PASSWORD=${config.sops.placeholder."mempool/mariadb-password"}
+      MARIADB_ROOT_PASSWORD=${config.sops.placeholder."mempool/mariadb-root-password"}
+    '';
+  };
+
+  sops.templates."mempool-backend.env" = {
+    owner = "root";
+    group = "root";
+    mode = "0400";
+    content = ''
+      MEMPOOL_NETWORK=mainnet
+      MEMPOOL_BACKEND=electrum
+      MEMPOOL_HTTP_PORT=8999
+
+      ELECTRUM_HOST=host.containers.internal
+      ELECTRUM_PORT=50001
+      ELECTRUM_TLS_ENABLED=false
+
+      CORE_RPC_HOST=host.containers.internal
+      CORE_RPC_PORT=8332
+      CORE_RPC_COOKIE=true
+      CORE_RPC_COOKIE_PATH=/bitcoin/.cookie
+
+      DATABASE_ENABLED=true
+      DATABASE_HOST=mempool-db
+      DATABASE_PORT=3306
+      DATABASE_DATABASE=mempool
+      DATABASE_USERNAME=mempool
+      DATABASE_PASSWORD=${config.sops.placeholder."mempool/mariadb-password"}
+
+      STATISTICS_ENABLED=true
+    '';
+  };
+
   virtualisation.oci-containers = {
     backend = "podman";
 
@@ -7,12 +60,9 @@
       mempool-db = {
         image = "mariadb:11";
         autoStart = true;
-        environment = {
+        environmentFiles = [
-          MARIADB_DATABASE = "mempool";
+          config.sops.templates."mempool-db.env".path
-          MARIADB_USER = "mempool";
+        ];
-          MARIADB_PASSWORD = "mempool";
-          MARIADB_ROOT_PASSWORD = "root";
-        };
         volumes = [
           "/srv/mempool/mysql:/var/lib/mysql"
         ];
@@ -26,30 +76,9 @@
         extraOptions = [
           "--add-host=host.containers.internal:host-gateway"
         ];
-        environment = {
+        environmentFiles = [
-          MEMPOOL_NETWORK = "mainnet";
+          config.sops.templates."mempool-backend.env".path
-          MEMPOOL_BACKEND = "electrum";
+        ];
-          MEMPOOL_HTTP_PORT = "8999";
-
-          ELECTRUM_HOST = "host.containers.internal";
-          ELECTRUM_PORT = "50001";
-          ELECTRUM_TLS_ENABLED = "false";
-
-          CORE_RPC_HOST = "host.containers.internal";
-          CORE_RPC_PORT = "8332";
-
-          CORE_RPC_COOKIE = "true";
-          CORE_RPC_COOKIE_PATH = "/bitcoin/.cookie";
-
-          DATABASE_ENABLED = "true";
-          DATABASE_HOST = "mempool-db";
-          DATABASE_PORT = "3306";
-          DATABASE_DATABASE = "mempool";
-          DATABASE_USERNAME = "mempool";
-          DATABASE_PASSWORD = "mempool";
-
-          STATISTICS_ENABLED = "true";
-        };
        volumes = [
          "/run/mempool/bitcoind.cookie:/bitcoin/.cookie:ro"
        ];

modules/nextcloud.nix

@@ -1,6 +1,15 @@
 { config, pkgs, lib, ... }:
 
 {
+  sops.secrets."nextcloud/mail-json" = {
+    sopsFile = ../secrets/nextcloud-mail.json;
+    format = "json";
+    key = "";
+    owner = "root";
+    group = "root";
+    mode = "0400";
+  };
+
   services = {
 
     nextcloud = {
@@ -64,7 +73,7 @@
         "opcache.max_accelerated_files" = "30000";
       };
 
-      secretFile = "/run/secrets/nextcloud-mail.json";
+      secretFile = config.sops.secrets."nextcloud/mail-json".path;
     };
 
     restic.backups.nextcloud = {

secrets/.sops.yaml

@@ -0,0 +1,5 @@
+creation_rules:
+  - path_regex: .*\.(ya?ml|json)$
+    age:
+      - age1qnudtkywppsdk6zn6jh9gra093w4mnf63m333hxsms9ys7elkpps3y008z
+      - age1swfrmmxyfllp33tah7nskpvcmepqymhl7ax33zwtnf4lrkdp2srqrpzf3w

secrets/nextcloud-mail.json

@@ -0,0 +1,28 @@
+{
+	"mail_from_address": "ENC[AES256_GCM,data:wkWN0cIQ,iv:aDmxjmR/9mghuQ/06ATVr274CW6hveECnHrJg26s6Lg=,tag:XorO3I8E36WAFLwIxiXYpQ==,type:str]",
+	"mail_domain": "ENC[AES256_GCM,data:d68tlQAx8zR87Lo=,iv:LQbhImweznHXCxQnQp1EC/yRin5kmGW5CpK6q5jXcYk=,tag:hAWOJDhozGPjU/zNleL5NQ==,type:str]",
+	"mail_smtpmode": "ENC[AES256_GCM,data:eJbZGg==,iv:yGj1aAjWgiFQDjVR9y8lO1MDPctpN+39aZt40/B8UF0=,tag:KJ6bdw5D7R4lc7mDzO6TkQ==,type:str]",
+	"mail_sendmailmode": "ENC[AES256_GCM,data:BUq83A==,iv:9UJVLgvkZDbdpWpEG0pFzqaKgBAW826wku9ZxPJNWdM=,tag:4MrswUzNK2Li9IRQts545g==,type:str]",
+	"mail_smtphost": "ENC[AES256_GCM,data:br1wM+lxOPn7QuAna47A4PfA,iv:uyZVMLRurAXTr5hTF25NoS8tE7Afj0QedWyZCiG+HzU=,tag:D7E571gligJBkIsBbIvmIA==,type:str]",
+	"mail_smtpport": "ENC[AES256_GCM,data:WiCb,iv:i4H8AlPn2An82QYToP26UkboRQ/nOXT8buphx801Bog=,tag:j/ky3g/EWEN3fAm1sR2mCQ==,type:str]",
+	"mail_smtpsecure": "ENC[AES256_GCM,data:0Nhu,iv:IYiTIKbNRnEzMfGCvK+PB5gFtt7F+1435vjgvFQh+S4=,tag:mt9nsH629tryaax2nuK7Pw==,type:str]",
+	"mail_smtpauth": "ENC[AES256_GCM,data:vA==,iv:P1zWkwLrQg/690X0Xd5wdA/LZ24uhR6Q/VZXwVZ+yzA=,tag:GY90C7ljljQDD3uwMrRWkQ==,type:float]",
+	"mail_smtpname": "ENC[AES256_GCM,data:yoUiA0rFw1aOtAWp5Rdbgv4a,iv:CH5E/gb6AUC087q7DO2eozDCVG943dqmYPIZdQDQv8Y=,tag:6jg8OvtEzm15IDNxxphOnQ==,type:str]",
+	"mail_smtppassword": "ENC[AES256_GCM,data:3TFl/4rCu9M6SM71kDeYAg==,iv:rf3wTdxtM79jk6wXfGpaNMTQmj9q/7U5Pz9eTQ/PT2A=,tag:XxclWFZFw/iuh6EaIPMlJw==,type:str]",
+	"sops": {
+		"age": [
+			{
+				"recipient": "age1qnudtkywppsdk6zn6jh9gra093w4mnf63m333hxsms9ys7elkpps3y008z",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1a2ZUaVJQVDBIOTByL011\ndWdKbkV1REtBZ0JnS3AvNUZIT1JWcExNNFhvCkhPNG5KTjhvMG5ZTzlwdllwUEZV\nMDdncjVUbHQ5bjJHcVJFcUFJV1cvaFUKLS0tIEx2elNGUDdyZGZxaVRLcjBob0Rz\ndExBZEkvd0x1SWNreXgwOEM0TWVuTzgKRpKZM7g5OklsuuA6chQA+BiZTnpEFThw\nKvhzsWd2YQszyLSOvCyjJ+g24lym+IZ6y5Lc2iukx+Du+CXJOGT4IA==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1swfrmmxyfllp33tah7nskpvcmepqymhl7ax33zwtnf4lrkdp2srqrpzf3w",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBQzBBMGtSUVFIT2IzSHk1\nZWFhcTduVHJmRGVNaDIxaittVy9xa2ZFaEJVCkdoeHpSaUxKUWFvSmxhU3BpekFj\nOThsM1NUaVptT1ZiWTVpVEczRGszZWcKLS0tIDJoVE9jNFcvRjFnSzNKOVl6djc5\nSGEyN25EcjY5bDdVbEpiQWRtR1RqS1EKet3MvHgYNGfRwKmf0dsTcM4RP/ZgtwSd\nKg133l9Y4S9th1yB81c+wE0egS5P5VJOWgKpd7otAT66v/mZNbDIRw==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2026-04-11T16:41:06Z",
+		"mac": "ENC[AES256_GCM,data:G9bYGeRCEd7f5igAIYOxSOlyA+Du6j1iyygR6rS838HIUr/cucqo2wyVn95itHxsMJZDQtI8L4uRP3TE/p+PaPT3XG3hGrPwkC74MudJJlRCjSrsnaUrEr9KWZPg4diAvTWuC5szxN7Uxuh85V7EPSMhBSuVyI9OhQy1nf+Qbls=,iv:gDI9JQ+p0OhLgypjwHGNYIYi5c7BEN9IoQbRS0d0SpE=,tag:PP1ajrQI5es61ez7NmtCkQ==,type:str]",
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.11.0"
+	}
+}

secrets/tobserver.yaml

@@ -0,0 +1,27 @@
+mempool:
+    mariadb-password: ENC[AES256_GCM,data:NmFq8C3stA==,iv:XUvpviqUiS4UFCyZ3eahNY6NNy6/q3kLgWDfMW6I52U=,tag:9i5TO+9KbyM73RldtBw0fw==,type:str]
+    mariadb-root-password: ENC[AES256_GCM,data:CjXQWw==,iv:3amyq9/3Nq7pz8s7wk4UORI1gSgURufGh1u/cITQf/I=,tag:4ulBVRDh0Ws04IqHT5P6tg==,type:str]
+sops:
+    age:
+        - recipient: age1qnudtkywppsdk6zn6jh9gra093w4mnf63m333hxsms9ys7elkpps3y008z
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJVzV1ck0rNjBicGNhZWJR
+            Nm5ZWVphUlhIWmtrcUxkUzczOTlmMXhsdjF3CjM1bzVIUVpXYzJBODZhUXEyRTFs
+            WUtDV09Wb3NSOUJwWDJGanFXTllDeUUKLS0tIGpiandTeFJPdFoyR05DNzhMZTNh
+            ankwQ2I3M2VWR2Y4UC9wYVM4em0zczgK1mGVmNZU/l8Qn4lX/ftMLxdW7m/JgbDq
+            FAGCIW8S3RgORcLYAWrAf5E7jKAFeIM75STGH/MnyXUlncsBIxwKaw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1swfrmmxyfllp33tah7nskpvcmepqymhl7ax33zwtnf4lrkdp2srqrpzf3w
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxa2dIMTJxdGZsSkZtSW1Z
+            aXJ6TFdSOGNmbzZEd3dDbWdKaW9aLzIrTW5VClFJdGZrOEIvMVVWLytOVlowdkdV
+            NnZhajAvWlR6ajR0elMzNkR3SWxISDQKLS0tIEQ4Qm1NU0xPMllGZko4WTJidnpT
+            cVE5VG56cFAzT1dsRFN4cCtnVEJJdU0KSBWm4blGhnVlOJ3k7lh8aJVOEH8NfFOh
+            EwU/4Up6zWYBoe2+GKiQf8imnVLSSxMR7dlNd06ttuFD4B5baqFRcA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-04-11T12:27:40Z"
+    mac: ENC[AES256_GCM,data:Uk6vIxyBzRLa3+IoQ0Tv5T4dwz2EQehuBSEXAzeTeNxf7ob/GRgzdZxVyoq0ycEOz3JS7k6RjhZYe0zDXMnp/9FVsWbItFiFs8OfqkxVbrjXjBCk5CeUENaeND4Hu7L0GvLCJYm7JPeI4+0Jr0DE0bPQs+HGYcwPUwDxqsjqgxU=,iv:zNNnfmlbQdfjzX3hqBEiw98TQUvUGiIbedqurWV/zBw=,tag:f8dfjTtWg48lls/Ah2wvtQ==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0