From 0e2136c3a0b830d6eada766b0097e806d77eefd1 Mon Sep 17 00:00:00 2001
From: aditya <dedomil@tuta.io>
Date: Sat, 9 May 2026 16:19:05 +0530
Subject: [PATCH] add sops

---
 .sops.yaml           |  7 +++++++
 flake.lock           | 23 ++++++++++++++++++++++-
 flake.nix            |  5 +++++
 secrets/secrets.nix  | 14 ++++++++++++++
 secrets/secrets.yaml | 16 ++++++++++++++++
 5 files changed, 64 insertions(+), 1 deletion(-)
 create mode 100644 .sops.yaml
 create mode 100644 secrets/secrets.nix
 create mode 100644 secrets/secrets.yaml

diff --git a/.sops.yaml b/.sops.yaml
new file mode 100644
index 0000000..aeb59e8
--- /dev/null
+++ b/.sops.yaml
@@ -0,0 +1,7 @@
+keys:
+  - &primary age18heg78hxhphvl8nzexvplvdr6x2skd9928zh7lewxj2k7k5m230qz2f2rd
+creation_rules:
+  - path_regex: secrets/secrets.yaml$
+    key_groups:
+      - age:
+          - *primary
diff --git a/flake.lock b/flake.lock
index 1c7f7a1..3453c68 100644
--- a/flake.lock
+++ b/flake.lock
@@ -57,7 +57,28 @@
       "inputs": {
         "home-manager": "home-manager",
         "nixpkgs": "nixpkgs",
-        "nixpkgs-unstable": "nixpkgs-unstable"
+        "nixpkgs-unstable": "nixpkgs-unstable",
+        "sops-nix": "sops-nix"
+      }
+    },
+    "sops-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1777944972,
+        "narHash": "sha256-VfGRo1qTBKOe3s2gOv8LSoA6Fk19PvBlwQ1ECN0Evn8=",
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "rev": "c591bf665727040c6cc5cb409079acb22dcce33c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "type": "github"
       }
     }
   },
diff --git a/flake.nix b/flake.nix
index 5ee9f44..b804113 100644
--- a/flake.nix
+++ b/flake.nix
@@ -8,6 +8,10 @@
       url = "github:nix-community/home-manager/release-25.11";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    sops-nix = {
+      url = "github:Mic92/sops-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs = { self, nixpkgs, home-manager, ... } @ inputs: {
@@ -17,6 +21,7 @@
       modules = [
         ./configuration.nix
         home-manager.nixosModules.home-manager
+        ./secrets/secrets.nix
       ];
     };
   };
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
new file mode 100644
index 0000000..70bb6c7
--- /dev/null
+++ b/secrets/secrets.nix
@@ -0,0 +1,14 @@
+{ inputs, ... }:
+
+{
+  imports = [
+    inputs.sops-nix.nixosModules.sops
+  ];
+
+  sops = {
+    defaultSopsFile = ./secrets.yaml;
+    defaultSopsFormat = "yaml";
+
+    age.keyFile = "/home/aditya/.config/sops/age/keys.txt"; # fix home path
+  };
+}
diff --git a/secrets/secrets.yaml b/secrets/secrets.yaml
new file mode 100644
index 0000000..87a9242
--- /dev/null
+++ b/secrets/secrets.yaml
@@ -0,0 +1,16 @@
+hello: ENC[AES256_GCM,data:Ry0Ekw==,iv:CUnukIgkIpux1wZpILBJYjqgcxfZxPevtaRkbPBFxVg=,tag:hWOpFgv39LzFqbtiyhbosA==,type:str]
+sops:
+    age:
+        - recipient: age18heg78hxhphvl8nzexvplvdr6x2skd9928zh7lewxj2k7k5m230qz2f2rd
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBETG5CR2haRldJL2IvbXdm
+            ekNXa3YvNmFac0V4VzVvTXV0TktQbHIwcEZnCldoMmtjeUhkYWFSUnExbTY4cmRL
+            Yi9iR1ZQUjYyakVVZTNsY3FFc21oUTgKLS0tIHlQcEkrRVR4QW8xL3VBL1kyUGxU
+            Z045MDZuU1R5cEsrZUFBbXBzakYwaVkKSkf09aYYnLSNOH06ghDDg5BEqNprFMnP
+            AcKwfKHz4HLvm6dVbbR1klo78nIIQarWRXFj8wMR3cW+XSXk3AEFmQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-05-09T10:47:40Z"
+    mac: ENC[AES256_GCM,data:Q58RYLYDMyw4Y58q++Uj2vCtM29oIMVDsfCWAuSD9YXiFsbSjbyk5jQyWVWefxI/vAhRGob1KbMYd4UylJIlByHfjRKFNSRWuKd762FEgZajubo1+VVijyaKlIhfkPbVogcnqFvwDRcivhBqyFSDRw3yBThb8P3NIsIglCqenbg=,iv:JEADf8fgFbH4O4tiztPEM39AkvnvLhnHvMwO0T1JPms=,tag:QDpmjf4x8FpcQA4yFNPUrA==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.12.1