From 03e222010524af6bd55933e3ac9dae853ffb2e61 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Leonardo=20Eug=C3=AAnio?= <lelgenio@disroot.org>
Date: Sun, 15 Feb 2026 03:32:22 -0300
Subject: [PATCH] nix-serve: move secret to sops

---
 secrets/monolith-nix-serve-privkey.age | Bin 839 -> 0 bytes
 secrets/monolith/default.yaml          |   6 ++++--
 secrets/secrets.nix                    |   1 -
 system/nix-serve.nix                   |   2 +-
 system/secrets.nix                     |   1 -
 5 files changed, 5 insertions(+), 5 deletions(-)
 delete mode 100644 secrets/monolith-nix-serve-privkey.age

diff --git a/secrets/monolith-nix-serve-privkey.age b/secrets/monolith-nix-serve-privkey.age
deleted file mode 100644
index 843b433a17ac22f123776655e7c58497c91c8879..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 839
zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!*`Do#{zDlf0_NaqR<b2fCWO7lt2
z$gXfHOHV7#DK<$mNJ)t-@-WEo*H0-iGR}+etBeRN_0+B?^$IO4D|Pnr%E-%gO$~7`
zu{7rjN{T4U4RdjGE;5hsNGS=-32-Yf$u+Wc4fD<P@$}9t39Cx>O>(V_%q$HL$;iua
zH_33!4KT?!sVFfHjk56JiY&@<&r45rGAb=Gs_@LO^fpO#b<;O2%JOhdP0Xw)@$`ud
z4o%DVPj<@9Eptw-GA}Z7DlFE{aV+vI_VKB5;_@v@H8VBMiVW4SwD78ma4a&&a@O|^
z2+Ybz%}6TAv9v4+NzX6IDG5pPFLaE|@vEvRFLbYp$VvA%a&^ql%;n0CDhw%0HFgcH
z2r^2{PW3TPbt*}UC~?y^FD_0p4RQ`Is&Fzk_sdMmu8a&x_H)fnEerK1HmUG%voy}C
zstDk+NOdZ;%yo|RHp>e)Db@Eb4YY7}PAo1?&x<Haa!si!a1GM-v&c(N(+`WNF!uE~
zFfT36PK)q2^sTZ;OpOfY$~8*1FgGm^%E-?vPVr63iO30a@l7{Pb<?kOEcCMoEcSCL
zFHMYytO)TkwD2v6s`5zBDh(+1EzUD6_SZJm=h83D_4F?G@D0q)Hg@x?j4&%qDe+74
z&(6*&P0dKki7=_ka`VY^EcGz)_Q<WWEH6qj^fFC!3kWU=HmOX{3*Z7JjhKkwnvCF(
zNZs_J)WqUcg`~hx-$?Bmg_=^X(mXex%(6W9yePAjl2l(WV^@E3=j`mr@KB#bU+=W2
zBFCU|^APu<03XBhNHeFz0MlR#E?r$+g_J7O3=9AK(qIpZvQ+Ir_fqXrPuH|UZO1al
zQa4Y-Dqjzi!UBuX2seX3u5PhD!&grgTy`E!d$fD${R92;jy4ESva~FbYWBRlDPd-v
zct-I48wZb1t$%ej*heYX=*kz1Cr912rP=B#r}7wYHT%!*@ndrOip1DkE9@>c%u;_6
zE$Pts!A<}2i@&>E)-$;KugL$l^w|GTsavX-<eeAa?dxx`BjTU!p_zL1H-b6u7jw*3
U>_0oPk+brP(i6{vjhi*=08T$NY5)KL

diff --git a/secrets/monolith/default.yaml b/secrets/monolith/default.yaml
index 6b3c1ff..61f00ce 100644
--- a/secrets/monolith/default.yaml
+++ b/secrets/monolith/default.yaml
@@ -13,6 +13,8 @@ nebula-wopus-vpn:
     monolith-key: ENC[AES256_GCM,data:Y8KVQk66dewyeRIF+6HJeufD9EYO55m73LxrtZi4KQU0RbUpsV0eiRMX62rYtw6+uP87f5Tx6kC3fX4+mqNb2ZgDtVvm3/Qnz5Ly112c/h33krNqRpv6pEHRkrS9j01tLkJnxwiyIvq3b03GTAIoCKWgqaaagCXYHArgzRrDIw==,iv:lp3zuD8XWaiJvyxzXHrgpF4qbrCv/uf9l9qyWXVrkkM=,tag:eSlTCa2TrIuga7UUxoloBQ==,type:str]
 minio:
     root-credentials: ENC[AES256_GCM,data:izDiis6BgAubbe91EUcuwMKrSrYEDQFQbaEGzpdjj3Wlt8Z8gzgvGmYCryAK8GBUMbzQvy0do26xMGMl3LxLWz9bgixixPVFTTg5GhfUJw==,iv:hkrkGz+EpVwkWEMQWBrm2u4Jti7azsDtsTmyouDREug=,tag:mDnOKKBwgKOmsxegKcRhpQ==,type:str]
+nix-serve:
+    private-key: ENC[AES256_GCM,data:xSHNHiLKs5QG92cSR0gNlusRhGjRUcelSvBt/f3+LdLjTtPaYMmiEiUsl43FyaigGkGq4nGDWAgPVJ+bFNpman0F4KwYqoSp5zH07IC9KaXouvudRLMZc8MkpwKKptKebKDlxKfsLt44n3qnV7OPYzSgzA==,iv:yUM/4yCIJqTt04HyXBVe+EMN4NnFkVnVhsUvUlKv2QM=,tag:qAr0UIjWzXH1eEzGCrK5Vg==,type:str]
 sops:
     age:
         - recipient: age1zrgu7w8059xydagm60phnffghvfe9h2ca58cx8qwagqpyfuvs9fqw79c8h
@@ -33,8 +35,8 @@ sops:
             aFVxcDFhaGdYekRWRVFIWnRsZndtZFkKgsvxOFHOcO306Z9FkucA1fDOpZA8N1/h
             jYmIgcKTFgWoSCvux67lK30jFsYp7sm5z6WxxDYsGcoQ/+pxoUX2jQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-11-27T15:58:01Z"
-    mac: ENC[AES256_GCM,data:8JemHyxdcDjkg++kgBAGpvGZAyGnQhcAOzs58D8EqjJzTWWf4HgF3uD8od5EGu5i1f7IzUBNio57H/0DC7fWZk/vIRM/Xn7DREuXClBGmBsc32H+K0tOKg8hMb11PDGqviw0qj0qwl1Gs0+j8C4OY9qLupTDzsECUgRXBtsD4cU=,iv:vOV25BV/C3hK/D4bKb26Xi0PaiSlJ5t9bN18ZJQnCRs=,tag:1AZyn4Zj1/e/2dhNzcfPqg==,type:str]
+    lastmodified: "2026-02-15T06:31:14Z"
+    mac: ENC[AES256_GCM,data:FPf6xhBN/D0zfeMcpcT1u+94oWpO6XApn11CtiA36MmPMaD/8kIpT7WxX2uV9OVnAfE1ab4vhaIPflLNt+iIOVJRxT0d2kjGqnWrJlRsu0C7gandbUjx/QnDobb82V0KFZ/E5wgZEdd2bl33l+BWdMHeUj32yFzSyP5d98GloJE=,iv:uQ9F4b2OGF+dGp7B7tl+qXB16cGdCLeTw7vQ2h2JjWc=,tag:UpCKj7CaRI5MralcT4oJQw==,type:str]
     pgp:
         - created_at: "2025-03-07T22:49:16Z"
           enc: |-
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index b361438..3d6a466 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -2,7 +2,6 @@ let
   main_ssh_public_key = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCxR/w+38b2lX90yNBqhq3mUmkn1WGu6GAPhN1tVp2ZjYRJNV/+5gWCnTtOWYtDx35HmK/spQ2Qy8X9ttkzORa24fysNx1Iqn/TiXhD7eIJjbGPnrOpIKTkW5/uB3SD/P5NBSa06//BaqJU4sBlG79hoXRpod052hQtdpTVDiMCIV+iboWPKqopmJJfWdBtVnHXs9rep0htPRExxGslImFk7Z6xjcaHyCpIQZPlOGf+sGsmUU7jRqzvZFV8ucIdbnAlMHrU4pepNFhuraESyZVTa/bi9sw0iozXp5Q5+5thMebEslmT1Z771kI4sieDy+O4r8c0Sx2/VY1UAzcpq1faggc3YB01MTh+tiEC6xdMvZLrQGL1NBWjHleMyL53GU5ERluC0vXJF3Hv3BGGBDfXWbrEm5n06DHr2apRVJGC0LwiQ7Woud1X4V4X1pKSusxCVMjT2lmcOwV6YhKhB2sowJc1OdMx4+tL0UWE+YKSZgBHfolwk6ml0F4EO9nnUHc= lelgenio@i15";
 in
 {
-  "monolith-nix-serve-privkey.age".publicKeys = [ main_ssh_public_key ];
   "factorio-settings.age".publicKeys = [ main_ssh_public_key ];
   "phantom-nextcloud.age".publicKeys = [ main_ssh_public_key ];
   "phantom-writefreely.age".publicKeys = [ main_ssh_public_key ];
diff --git a/system/nix-serve.nix b/system/nix-serve.nix
index 6cc7161..7cd7377 100644
--- a/system/nix-serve.nix
+++ b/system/nix-serve.nix
@@ -7,6 +7,6 @@
 {
   services.nix-serve = {
     enable = true;
-    secretKeyFile = config.age.secrets.monolith-nix-serve-privkey.path;
+    secretKeyFile = config.sops.secrets."nix-serve/private-key".path;
   };
 }
diff --git a/system/secrets.nix b/system/secrets.nix
index acf4281..1e5d68d 100644
--- a/system/secrets.nix
+++ b/system/secrets.nix
@@ -2,6 +2,5 @@
 {
   age = {
     identityPaths = [ "/root/.ssh/id_rsa" ];
-    secrets.monolith-nix-serve-privkey.file = ../secrets/monolith-nix-serve-privkey.age;
   };
 }