srid · srid · Jun 21, 2024 · Jun 21, 2024 · Jun 21, 2024 · Jun 21, 2024
diff --git a/flake.lock b/flake.lock
diff --git a/flake.nix b/flake.nix
@@ -14,6 +14,7 @@
     disko.url = "github:nix-community/disko";
     disko.inputs.nixpkgs.follows = "nixpkgs";
     colmena-flake.url = "github:juspay/colmena-flake";
+    ragenix.url = "github:yaxitech/ragenix";
 
     # Software inputs
     nixos-vscode-server.flake = false;
@@ -98,7 +99,7 @@
             ./systems/ax41.nix;
       };
 
-      perSystem = { self', pkgs, system, config, ... }: {
+      perSystem = { self', inputs', pkgs, system, config, ... }: {
         # Flake inputs we want to update periodically
         # Run: `nix run .#update`.
         nixos-flake = {
@@ -126,6 +127,7 @@
             just
             colmena
             nixd
+            inputs'.ragenix.packages.default
           ];
         };
         # Make our overlay available to the devShell

diff --git a/nix-darwin/default.nix b/nix-darwin/default.nix
@@ -1,4 +1,4 @@
-{ self, config, ... }:
+{ self, inputs, config, ... }:
 {
   # Configuration common to all macOS systems
   flake = {
@@ -15,6 +15,7 @@
         self.darwinModules_.home-manager
         self.darwinModules.my-home
         self.nixosModules.common
+        inputs.ragenix.darwinModules.default
       ];
     };
   };

diff --git a/nixos/default.nix b/nixos/default.nix
@@ -1,4 +1,4 @@
-{ self, config, ... }:
+{ self, inputs, config, ... }:
 
 {
   # Configuration common to all Linux systems
@@ -24,6 +24,7 @@
         self.nixosModules.home-manager
         self.nixosModules.my-home
         self.nixosModules.common
+        inputs.ragenix.nixosModules.default
         ./self/self-ide.nix
         ./current-location.nix
       ];

diff --git a/nixos/hedgedoc.nix b/nixos/hedgedoc.nix
@@ -1,13 +1,18 @@
+{ config, ... }:
+
 let
   domain = "pad.srid.ca";
   port = 9112;
 in
 {
+  age.secrets."hedgedoc.env" = {
+    file = ../secrets/hedgedoc.env.age;
+    owner = "hedgedoc";
+  };
   services.hedgedoc = {
     enable = true;
 
-    # GitHub secrets set in colmena (see flake.nix)
-    environmentFile = "/run/keys/hedgedoc.env";
+    environmentFile = config.age.secrets."hedgedoc.env".path;
 
     settings = {
       # URL config

diff --git a/secrets/hedgedoc.env.age b/secrets/hedgedoc.env.age
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
@@ -0,0 +1,11 @@
+let
+  config = import ../users/config.nix;
+  users = [ config.users.srid.sshKey ];
+
+  appreciate = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICra+ZidiwrHGjcGnyqPvHcZDvnGivbLMayDyecPYDh0";
+  immediacy = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKZALEiJIrH1Kj10u+WshkQXr5NHmszza8wNLqW+2fB0";
+  systems = [ appreciate immediacy ];
+in
+{
+  "hedgedoc.env.age".publicKeys = users ++ systems;
+}