NixOS/secrets/default.nix

{ agenix ? true, lib ? import ../lib { } }:
let
  masterKeys = [
    "age1yubikey1qfnj0k4mkzrn8ef5llwh2sv6hd7ckr0qml3n9hzdpz9c59ypvryhyst87k0"
    "age1ur2lr3z6d2eftgxcalc6s5x9840ew9x43upl9k23wg0ugacrn5as4zl6sj"
  ];
  hosts = {
    luna = let secrets = "luna";
    in {
      users-root-pw = "${secrets}/users-root-pw.age";
      users-price-pw = "${secrets}/users-price-pw.age";
      gitea-db-pass = "${secrets}/gitea-db-pass.age";
      gitea-runner-token = "${secrets}/gitea-runner-token.age";
    };
    orion = let secrets = "orion";
    in {
      users-root-pw = "${secrets}/users-root-pw.age";
      users-price-pw = "${secrets}/users-price-pw.age";
    };
  };
in if agenix then
  (builtins.listToAttrs (builtins.concatMap (host:
    let hostSecrets = (builtins.getAttr host hosts);
    in (builtins.map (hostSecretName:
      let secret = (builtins.getAttr hostSecretName hostSecrets);
      in {
        name = builtins.toString secret;
        value = {
          publicKeys = [ (import ./../hosts/${host}/pubkey.nix) ] ++ masterKeys;
        };
      }) (builtins.attrNames hostSecrets))) (builtins.attrNames hosts)))
else
  (builtins.mapAttrs (host: secrets:
    (lib.recursiveMerge (builtins.map (secretName: {
      age.secrets.${secretName}.file = ./${secrets.${secretName}};
    }) (builtins.attrNames hosts.${host})))) hosts)