Manage secrets with sops

.sops.yaml

@@ -0,0 +1,8 @@
+keys:
+  - &tobbook age106xkhmfrzqum2zkuxxfwjddesuwu6m99tqtt7s3pre4d4wejlp7qkhyfee
+
+creation_rules:
+  - path_regex: secrets/[^/]+\.(yaml|json|env|ini)$
+    key_groups:
+      - age:
+          - *tobbook

flake.lock

@@ -153,7 +153,28 @@
         "emacsConfig": "emacsConfig",
         "home-manager": "home-manager",
         "nixpkgs": "nixpkgs",
-        "pi": "pi"
+        "pi": "pi",
+        "sops-nix": "sops-nix"
+      }
+    },
+    "sops-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1780547341,
+        "narHash": "sha256-Gq8KNx5A7hBB3uGJaj6eQfLDIz5YdLu92gqBcvHvoUo=",
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "rev": "9ed65852b6257fbeae4355bc24ecfea307ca759a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "type": "github"
       }
     },
     "systems": {

flake.nix

@@ -17,6 +17,11 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    sops-nix = {
+      url = "github:Mic92/sops-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     emacsConfig = {
       url = "path:./flakes/emacs";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -38,6 +43,7 @@
           extraHomeManagerModules = [
             inputs.emacsConfig.homeManagerModules.aarch64-darwin
             inputs.pi.homeManagerModules.default
+            inputs.sops-nix.homeManagerModules.sops
             ({ lib, pkgs, ... }: {
               programs.pi.coding-agent.package =
                 lib.lowPrio inputs.pi.packages.${pkgs.system}.coding-agent;

module/home-manager.nix

@@ -1,6 +1,13 @@
-{ email }: { pkgs, ... }: {
+{ email }: { config, pkgs, ... }: {
   home.file.".clojure/deps.edn".source = ../config/clojure/deps.edn;
 
+  sops = {
+    age.keyFile = "${config.home.homeDirectory}/Library/Application Support/sops/age/keys.txt";
+    defaultSopsFile = ../secrets/secrets.yaml;
+
+    secrets.firecrawl_api_key = { };
+  };
+
   targets.darwin.defaults = {
     NSGlobalDomain = {
       AppleLanguages = [ "en" "de" ];
@@ -42,6 +49,7 @@
     pass
     pinentry_mac
     ripgrep
+    sops
     tree
     typescript
     wget

secrets/secrets.yaml

@@ -0,0 +1,16 @@
+firecrawl_api_key: ENC[AES256_GCM,data:T5o3SaZmteTq+c6Qw3pvYrW7+Yicio3EbfI3c+d1ZxbsHEU=,iv:bg+q7TZDdsyWI+nvDzX/LpMf2FTKEKBKgMXOhUMCAho=,tag:fmRHmgWfFfL4ckQcTKdshQ==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnOEwxcjhkeStmaTZlQkNO
+            REtQeUp5d2xVT1ZIaXc0U1NVcmVtZzFMT2tFCjNhRWc4Q25Fd3NTVjl6RGVZMU9Y
+            M3d2ckhmUksyQTdaY2VDNWMyczYrNWcKLS0tIGhENTBrYnF6OEx2SGNiUFRUUnF4
+            ZmFOcGRhYzRHZ2QxbGFIMlNaMjBZMFUKZB628QIMzjJHErz1hwkqG2CYpuMPzK9o
+            ptUomL2W/we4iRbe1LnPHB1JqBuYZSEaXGgdFbGGf2iYw/jtEE5gTQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age106xkhmfrzqum2zkuxxfwjddesuwu6m99tqtt7s3pre4d4wejlp7qkhyfee
+    lastmodified: "2026-06-18T11:22:43Z"
+    mac: ENC[AES256_GCM,data:ygfrXMTTmKkY32r9kygw0zskyJ5uqBOU7l1xk6SHCGh2tJavWzJlVoltq+b4oyftSj6+QT6JWarcPNrNeG2Yc7AnQVnC3U3IBhTWbuUIcFiHj4X6O7ya6uT0o2qPb7jJnur0wUdXEL4iYy/6890vkCMkkSkxY4SQiDGCnINNjd8=,iv:xfh9f/e5xPaD7As06KDKM/IhS5g0zLfhUG7eD5HJKic=,tag:BhP71tZ2dOjs6g7OKPI+9A==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.1