Add secrets and cleanup

modules/secrets/default.nix

@@ -0,0 +1,26 @@
+{ pkgs, ... }:
+
+let
+  thisDir = ./.;
+
+  unlocker = pkgs.writeScriptBin "unlocker" ''
+    #!${pkgs.bash}/bin/bash
+    set -euo pipefail
+    if [[ -f "${thisDir}/secrets.age" && -f "${config.users.users."me".home}/.ssh/id_ed25519" ]]; then
+      ${pkgs.age}/bin/age -d -i "${config.users.users."me".home}/.ssh/id_ed25519" "${thisDir}/secrets.age"
+    end
+  '';
+in
+{
+  environment.systemPackages = [ unlocker ];
+
+  systemd.services.unlocker = {
+    description = "Secrets manager";
+    serviceConfig = {
+      Type = "oneshot";
+      StandardOutput = "file:/run/secrets.env";
+      RemainAfterExit = true;
+    };
+    script = "${unlocker}/bin/unlocker";
+  };
+}

modules/secrets/locker.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+AGE_PRIVATE_KEY="$HOME/.ssh/id_ed25519"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+RECIPIENTS_FILE="$SCRIPT_DIR/recipients.txt"
+ENCRYPTED_FILE="$SCRIPT_DIR/secrets.age"
+
+TMP_FILE=$(mktemp)
+
+cleanup() {
+  rm -f "$TMP_FILE"
+}
+trap cleanup EXIT
+
+if [[ -f "$ENCRYPTED_FILE" ]]; then
+  age -d -i "$AGE_PRIVATE_KEY" -o "$TMP_FILE" "$ENCRYPTED_FILE"
+fi
+
+"${EDITOR:-vi}" "$TMP_FILE"
+
+age -R "$RECIPIENTS_FILE" -o "$ENCRYPTED_FILE" "$TMP_FILE"
+
+echo "Updated $ENCRYPTED_FILE"

modules/secrets/recipients.txt

@@ -0,0 +1,2 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMPFh01e9doyInt0980V8T4xaakcSaOyXaxxYE4+oSwM me@syedm
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJFUwk54CNtSLUyXSTLsIs5KXgEsjOgE4HGlA4FacKjV me@tardis

modules/secrets/secrets.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 ZK0gQw 9LrC4V6ibhKKKoE8Dtm+caoI2z6tT6oBnfNAl5qlcQ8
+NWqFWrj49jp2e8our9rpYpHZZny8t4mKGogeRNMFCkk
+-> ssh-ed25519 CjJArg bxVL+Is1oNN4QLRW24hPOpFFAhGmGyF611o3oASaJFk
+K8a5oDyvQ4k0YeDBseS2/SmvPhu39LWyRuFkWi0gm2s
+--- wjAuZMd2h4fvKfKtIdHmEYPO1sEC64tmU4uZarAK4io
+Ô@àˆó,RîžÐÙ$øôG—8Š‘WÇì×®µ–žñ[