refactor(modules/secrets): Split into the modules, that need the secrets

Storing the secrets in the module that actually needs them, is a cleaner
solution.

12 files changed, 69 insertions, 90 deletions

diff --git a/flake/nixosConfigurations/common.nix b/flake/nixosConfigurations/common.nix
index 3775d63b..cc191ea9 100644
--- a/flake/nixosConfigurations/common.nix
+++ b/flake/nixosConfigurations/common.nix
@@ -15,7 +15,6 @@
     impermanence.enable = true;
     polkit.enable = true;
     power.enable = true;
-    secrets.enable = true;
 
     services = {
       adb = {
diff --git a/modules/by-name/se/secrets/module.nix b/modules/by-name/se/secrets/module.nix
deleted file mode 100644
index 8b3188b0..00000000
--- a/modules/by-name/se/secrets/module.nix
+++ /dev/null
@@ -1,73 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}: let
-  # mkFakeSecret = secretName: {
-  #   name = secretName;
-  #   value = {
-  #     path = "/dev/null";
-  #   };
-  # };
-  # fakeSecrets =
-  #   builtins.listToAttrs (lib.debug.traceValSeqN 2 (builtins.map mkFakeSecret
-  #       (lib.debug.traceValSeqN 2 (builtins.attrNames secrets))));
-  cfg = config.soispha.secrets;
-in {
-  options.soispha.secrets = {
-    enable = lib.mkEnableOption "secrets through agenix";
-  };
-
-  config = lib.mkIf cfg.enable {
-    age = {
-      secrets = {
-        lf_cd_paths = {
-          file = ./lf/cd_paths.age;
-          mode = "700";
-          owner = "soispha";
-          group = "users";
-        };
-
-        # FIXME: Reactive when serverphone is merged in tree again <2024-05-11>
-        #
-        # serverphoneCa = {
-        #   file = ./serverphone/ca.key;
-        #   mode = "700";
-        #   owner = "serverphone";
-        #   group = "serverphone";
-        # };
-        # serverphoneServer = {
-        #   file = ./serverphone/server.key;
-        #   mode = "700";
-        #   owner = "serverphone";
-        #   group = "serverphone";
-        # };
-
-        taskserverPrivate = {
-          file = ./taskserver/private.key;
-          mode = "700";
-          owner = "soispha";
-          group = "users";
-        };
-        taskserverPublic = {
-          file = ./taskserver/public.cert;
-          mode = "700";
-          owner = "soispha";
-          group = "users";
-        };
-        taskserverCA = {
-          file = ./taskserver/ca.cert;
-          mode = "700";
-          owner = "soispha";
-          group = "users";
-        };
-        taskserverCredentials = {
-          file = ./taskserver/credentials;
-          mode = "700";
-          owner = "soispha";
-          group = "users";
-        };
-      };
-    };
-  };
-}
diff --git a/modules/by-name/se/secrets/secrets.nix b/modules/by-name/se/secrets/secrets.nix
deleted file mode 100644
index ff97c0fd..00000000
--- a/modules/by-name/se/secrets/secrets.nix
+++ /dev/null
@@ -1,16 +0,0 @@
-let
-  soispha = "age1mshh4ynzhhzhff25tqwkg4j054g3xwrfznh98ycchludj9wjj48qn2uffn";
-
-  tiamat = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMD87QQIUXdEv3TaNRrI9clD9VgpsuVLFg2CrNGa5lVB";
-  apzu = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBivF5b6PyxsR/t+4Qg4IEDXHVXrjmZpslTUNXpvcVbO";
-in {
-  "lf/cd_paths.age".publicKeys = [soispha tiamat apzu];
-
-  "serverphone/ca.key".publicKeys = [soispha tiamat apzu];
-  "serverphone/server.key".publicKeys = [soispha tiamat apzu];
-
-  "taskserver/private.key".publicKeys = [soispha tiamat apzu];
-  "taskserver/public.cert".publicKeys = [soispha tiamat apzu];
-  "taskserver/ca.cert".publicKeys = [soispha tiamat apzu];
-  "taskserver/credentials".publicKeys = [soispha tiamat apzu];
-}
diff --git a/modules/by-name/se/serverphone/module.currently_ignored.nix b/modules/by-name/se/serverphone/module.currently_ignored.nix
index 20125a75..2ffb062b 100644
--- a/modules/by-name/se/serverphone/module.currently_ignored.nix
+++ b/modules/by-name/se/serverphone/module.currently_ignored.nix
@@ -5,7 +5,25 @@
   lib,
   ...
 }: {
+# FIXME: Reactive this module, when serverphone is working again <2024-05-11>
+
   config = lib.mkIf config.soispha.secrets.enable {
+    age.secrets = {
+        serverphoneCa = {
+          file = ./private_keys/ca.key;
+          mode = "700";
+          owner = "serverphone";
+          group = "serverphone";
+        };
+        serverphoneServer = {
+          file = ./private_keys/server.key;
+          mode = "700";
+          owner = "serverphone";
+          group = "serverphone";
+        };
+      };
+    };
+
     services.serverphone = {
       package = "${serverphone.packages.${system}.default}";
       enable = true;
diff --git a/modules/by-name/se/secrets/serverphone/ca.key b/modules/by-name/se/serverphone/private_keys/ca.key
index d49c5395..d49c5395 100644
--- a/modules/by-name/se/secrets/serverphone/ca.key
+++ b/modules/by-name/se/serverphone/private_keys/ca.key
diff --git a/modules/by-name/se/secrets/serverphone/server.key b/modules/by-name/se/serverphone/private_keys/server.key
index a2720406..a2720406 100644
--- a/modules/by-name/se/secrets/serverphone/server.key
+++ b/modules/by-name/se/serverphone/private_keys/server.key
diff --git a/modules/by-name/ta/taskwarrior/module.nix b/modules/by-name/ta/taskwarrior/module.nix
new file mode 100644
index 00000000..ff1569af
--- /dev/null
+++ b/modules/by-name/ta/taskwarrior/module.nix
@@ -0,0 +1,35 @@
+{...}: {
+  # HACK: Migrating the whole `taskwarrior` setup is right now unrealistic, as the module is
+  # tightly coupled with the `firefox` module, and `neorg` script.
+  # But to work around the  fact that setting the `age` secrets in the legacy module is
+  # impossible, this module was created as work-around until the `taskwarrior` module can
+  # be fully migrated. <2024-10-18>
+  config = {
+    age.secrets = {
+      taskserverPrivate = {
+        file = ./secrets/private.key;
+        mode = "700";
+        owner = "soispha";
+        group = "users";
+      };
+      taskserverPublic = {
+        file = ./secrets/public.cert;
+        mode = "700";
+        owner = "soispha";
+        group = "users";
+      };
+      taskserverCA = {
+        file = ./secrets/ca.cert;
+        mode = "700";
+        owner = "soispha";
+        group = "users";
+      };
+      taskserverCredentials = {
+        file = ./secrets/credentials;
+        mode = "700";
+        owner = "soispha";
+        group = "users";
+      };
+    };
+  };
+}
diff --git a/modules/by-name/se/secrets/taskserver/ca.cert b/modules/by-name/ta/taskwarrior/secrets/ca.cert
index 203d62a8..203d62a8 100644
--- a/modules/by-name/se/secrets/taskserver/ca.cert
+++ b/modules/by-name/ta/taskwarrior/secrets/ca.cert
diff --git a/modules/by-name/se/secrets/taskserver/credentials b/modules/by-name/ta/taskwarrior/secrets/credentials
index f3aaf502..f3aaf502 100644
--- a/modules/by-name/se/secrets/taskserver/credentials
+++ b/modules/by-name/ta/taskwarrior/secrets/credentials
diff --git a/modules/by-name/se/secrets/taskserver/private.key b/modules/by-name/ta/taskwarrior/secrets/private.key
index 5afecdaf..5afecdaf 100644
--- a/modules/by-name/se/secrets/taskserver/private.key
+++ b/modules/by-name/ta/taskwarrior/secrets/private.key
diff --git a/modules/by-name/se/secrets/taskserver/public.cert b/modules/by-name/ta/taskwarrior/secrets/public.cert
index 1cf9b5f0..1cf9b5f0 100644
--- a/modules/by-name/se/secrets/taskserver/public.cert
+++ b/modules/by-name/ta/taskwarrior/secrets/public.cert
diff --git a/secrets.nix b/secrets.nix
new file mode 100644
index 00000000..3e16473d
--- /dev/null
+++ b/secrets.nix
@@ -0,0 +1,16 @@
+let
+  soispha = "age1mshh4ynzhhzhff25tqwkg4j054g3xwrfznh98ycchludj9wjj48qn2uffn";
+
+  tiamat = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMD87QQIUXdEv3TaNRrI9clD9VgpsuVLFg2CrNGa5lVB";
+  apzu = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBivF5b6PyxsR/t+4Qg4IEDXHVXrjmZpslTUNXpvcVbO";
+in {
+  "modules/by-name/lf/lf/secrets/cd_paths.age".publicKeys = [soispha tiamat apzu];
+
+  "modules/by-name/se/serverphone/private_keys/ca.key".publicKeys = [soispha tiamat apzu];
+  "modules/by-name/se/serverphone/private_keys/server.key".publicKeys = [soispha tiamat apzu];
+
+  "modules/by-name/ta/taskwarrior/secrets/private.key".publicKeys = [soispha tiamat apzu];
+  "modules/by-name/ta/taskwarrior/secrets/public.cert".publicKeys = [soispha tiamat apzu];
+  "modules/by-name/ta/taskwarrior/secrets/ca.cert".publicKeys = [soispha tiamat apzu];
+  "modules/by-name/ta/taskwarrior/secrets/credentials".publicKeys = [soispha tiamat apzu];
+}