From 7071992ee60e65ac156ce75c904e9f36bc36e530 Mon Sep 17 00:00:00 2001
From: Tobias Ostner <tobias.ostner@gmail.com>
Date: Thu, 18 Jun 2026 13:25:00 +0200
Subject: [PATCH] Manage secrets with sops

---
 .sops.yaml              |  8 ++++++++
 flake.lock              | 23 ++++++++++++++++++++++-
 flake.nix               |  6 ++++++
 module/home-manager.nix | 10 +++++++++-
 secrets/secrets.yaml    | 16 ++++++++++++++++
 5 files changed, 61 insertions(+), 2 deletions(-)
 create mode 100644 .sops.yaml
 create mode 100644 secrets/secrets.yaml

diff --git a/.sops.yaml b/.sops.yaml
new file mode 100644
index 0000000..99c9a30
--- /dev/null
+++ b/.sops.yaml
@@ -0,0 +1,8 @@
+keys:
+  - &tobbook age106xkhmfrzqum2zkuxxfwjddesuwu6m99tqtt7s3pre4d4wejlp7qkhyfee
+
+creation_rules:
+  - path_regex: secrets/[^/]+\.(yaml|json|env|ini)$
+    key_groups:
+      - age:
+          - *tobbook
diff --git a/flake.lock b/flake.lock
index 0b17766..b39802d 100644
--- a/flake.lock
+++ b/flake.lock
@@ -153,7 +153,28 @@
         "emacsConfig": "emacsConfig",
         "home-manager": "home-manager",
         "nixpkgs": "nixpkgs",
-        "pi": "pi"
+        "pi": "pi",
+        "sops-nix": "sops-nix"
+      }
+    },
+    "sops-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1780547341,
+        "narHash": "sha256-Gq8KNx5A7hBB3uGJaj6eQfLDIz5YdLu92gqBcvHvoUo=",
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "rev": "9ed65852b6257fbeae4355bc24ecfea307ca759a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "type": "github"
       }
     },
     "systems": {
diff --git a/flake.nix b/flake.nix
index d572e91..962d910 100644
--- a/flake.nix
+++ b/flake.nix
@@ -17,6 +17,11 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    sops-nix = {
+      url = "github:Mic92/sops-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     emacsConfig = {
       url = "path:./flakes/emacs";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -38,6 +43,7 @@
           extraHomeManagerModules = [
             inputs.emacsConfig.homeManagerModules.aarch64-darwin
             inputs.pi.homeManagerModules.default
+            inputs.sops-nix.homeManagerModules.sops
             ({ lib, pkgs, ... }: {
               programs.pi.coding-agent.package =
                 lib.lowPrio inputs.pi.packages.${pkgs.system}.coding-agent;
diff --git a/module/home-manager.nix b/module/home-manager.nix
index f5b868d..470330f 100644
--- a/module/home-manager.nix
+++ b/module/home-manager.nix
@@ -1,6 +1,13 @@
-{ email }: { pkgs, ... }: {
+{ email }: { config, pkgs, ... }: {
   home.file.".clojure/deps.edn".source = ../config/clojure/deps.edn;
 
+  sops = {
+    age.keyFile = "${config.home.homeDirectory}/Library/Application Support/sops/age/keys.txt";
+    defaultSopsFile = ../secrets/secrets.yaml;
+
+    secrets.firecrawl_api_key = { };
+  };
+
   targets.darwin.defaults = {
     NSGlobalDomain = {
       AppleLanguages = [ "en" "de" ];
@@ -42,6 +49,7 @@
     pass
     pinentry_mac
     ripgrep
+    sops
     tree
     typescript
     wget
diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml
new file mode 100644
index 0000000..6751570
--- /dev/null
+++ b/secrets/secrets.yaml
@@ -0,0 +1,16 @@
+firecrawl_api_key: ENC[AES256_GCM,data:T5o3SaZmteTq+c6Qw3pvYrW7+Yicio3EbfI3c+d1ZxbsHEU=,iv:bg+q7TZDdsyWI+nvDzX/LpMf2FTKEKBKgMXOhUMCAho=,tag:fmRHmgWfFfL4ckQcTKdshQ==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnOEwxcjhkeStmaTZlQkNO
+            REtQeUp5d2xVT1ZIaXc0U1NVcmVtZzFMT2tFCjNhRWc4Q25Fd3NTVjl6RGVZMU9Y
+            M3d2ckhmUksyQTdaY2VDNWMyczYrNWcKLS0tIGhENTBrYnF6OEx2SGNiUFRUUnF4
+            ZmFOcGRhYzRHZ2QxbGFIMlNaMjBZMFUKZB628QIMzjJHErz1hwkqG2CYpuMPzK9o
+            ptUomL2W/we4iRbe1LnPHB1JqBuYZSEaXGgdFbGGf2iYw/jtEE5gTQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age106xkhmfrzqum2zkuxxfwjddesuwu6m99tqtt7s3pre4d4wejlp7qkhyfee
+    lastmodified: "2026-06-18T11:22:43Z"
+    mac: ENC[AES256_GCM,data:ygfrXMTTmKkY32r9kygw0zskyJ5uqBOU7l1xk6SHCGh2tJavWzJlVoltq+b4oyftSj6+QT6JWarcPNrNeG2Yc7AnQVnC3U3IBhTWbuUIcFiHj4X6O7ya6uT0o2qPb7jJnur0wUdXEL4iYy/6890vkCMkkSkxY4SQiDGCnINNjd8=,iv:xfh9f/e5xPaD7As06KDKM/IhS5g0zLfhUG7eD5HJKic=,tag:BhP71tZ2dOjs6g7OKPI+9A==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.1