From 8475e3ecb64b845447b65652056769f45b8ed89b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Leonardo=20Eug=C3=AAnio?= <lelgenio@disroot.org>
Date: Sun, 15 Feb 2026 03:25:24 -0300
Subject: [PATCH] secrets: move forgejo mail secret to sops

---
 hosts/phantom/forgejo.nix                   |   5 ++---
 secrets/phantom-forgejo-mailer-password.age | Bin 678 -> 0 bytes
 secrets/phantom/default.yaml                |  12 +++++-------
 secrets/secrets.nix                         |   1 -
 system/secrets.nix                          |   1 -
 5 files changed, 7 insertions(+), 12 deletions(-)
 delete mode 100644 secrets/phantom-forgejo-mailer-password.age

diff --git a/hosts/phantom/forgejo.nix b/hosts/phantom/forgejo.nix
index dbb63d3..c7a224b 100644
--- a/hosts/phantom/forgejo.nix
+++ b/hosts/phantom/forgejo.nix
@@ -42,11 +42,10 @@ in
         USER = "noreply@git.lelgenio.com";
       };
     };
-    mailerPasswordFile = config.age.secrets.phantom-forgejo-mailer-password.path;
+    secrets.mailer.PASSWD = config.sops.secrets."forgejo/smtp_password".path;
   };
 
-  age.secrets.phantom-forgejo-mailer-password = {
-    file = ../../secrets/phantom-forgejo-mailer-password.age;
+  sops.secrets."forgejo/smtp_password" = {
     mode = "400";
     owner = "forgejo";
   };
diff --git a/secrets/phantom-forgejo-mailer-password.age b/secrets/phantom-forgejo-mailer-password.age
deleted file mode 100644
index 90fbe735e74103886baaf56a7bef66d16e8233ab..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 678
zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!*`Do#{zDlf0_Nau2MH1kaM@bJw@
z)VDDAur#W2_VCJd3(_|UDlsw-4U901a<oh{F)%YRtT4_sDl693jxtX&3yg@$^mEBK
z_X*<)_X^2OGBq@I$}!Ka%J&U1PmVPAb*zevC=96ZD9sMcHqJ8&^mfutH!e@p&MOY|
zFDvm+j>?ZnDN0JO^zy0TN)5CuHcStwu=MiI%+RikbW6#~@N|jtFb+s@)6OW)$_Vo`
zt+4d3aL$QxiS)>c@HES}wA9Z}^>Po-bu16d;fe~$GssB_H}S}EDRDOOF7x$BjkGMv
zcCJkH4Nh@R4{>vka4R)SNvkOJjIyZ8cCs)u@Cm92N-;?C3y*O3N#Y9iGpO=1j0iEQ
z$}G$b2`)4>F)DM;%5<r4HV^a2NjLZLFAL0YHS<r>w@7mf4KyxuD)KH1NlWrGHTDYf
z%gyFW@(N2zEe#LJjB=^)Pc1SIcghWL4$Zglj!dnnFiy_Q^zpCA3^XY*&rb>W^EEf|
zjqnU9a5eA_sBkawE-EnPvh?@NPjpKyH%Kz{3Aao(cD2kfa(DKw$TTSR)z|kl_Hywl
zFDP^~4)HZE3XdocOp2<gDoqOT_4JE!2{ExO;3^NwvkVCH^GFRz^oa^D*7q*XvdD4s
zE6j9pEAb3;Pbm!u(+|$~^fNN7F!Br5c8)ADD-JYFD#%KzFn20WH{jyZ)zww-G%2wR
zPfc@lFHi9)tul1hPEIK;^GT}o&os>m_D#+y3<^)PFfH&2HFV|LcK#-FG{c_<a*8~2
zRo6V59y*0x&2)-Z!lU-4m05WQm3dx-?r)jEvg}Om!51B7+PyP&NapEgC*FE4l~K=i
M=kF_3{w+c20L4S)*Z=?k

diff --git a/secrets/phantom/default.yaml b/secrets/phantom/default.yaml
index 962c6ba..aa133a2 100644
--- a/secrets/phantom/default.yaml
+++ b/secrets/phantom/default.yaml
@@ -8,11 +8,9 @@ example_number: ENC[AES256_GCM,data:R+/m/QVBH9/3DA==,iv:FumBUj97ICrRQmyh5fg8Gu9L
 example_booleans:
     - ENC[AES256_GCM,data:VvI5ag==,iv:koMzyWcua75sK19vuk65oywCD61lMyH3xUwue8LTqy4=,tag:2ym1M0FTwevLm7wefTUWAw==,type:bool]
     - ENC[AES256_GCM,data:lFEC/S8=,iv:cJWbnmseP/AqJzyORM+VI5y7rK8axVeh7EXoLP7mT/Q=,tag:BaS5HyecokdLCq+LzQxGkg==,type:bool]
+forgejo:
+    smtp_password: ENC[AES256_GCM,data:g/Uqmtp8A9pas5WcslwnGCKSXv7dYSRMA8wKm7DWpvssVRZJ,iv:vNBqdTlZ5mg0AhjMNr8rUts1rDBYmq03tdiceVN3xjs=,tag:M3qfiZEWvJN/XUjjmnAXqA==,type:str]
 sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
     age:
         - recipient: age1zrgu7w8059xydagm60phnffghvfe9h2ca58cx8qwagqpyfuvs9fqw79c8h
           enc: |
@@ -32,8 +30,8 @@ sops:
             RU1HSUhldHpzeURaUWQvcjBCQ3pMY2cKYL87Njs4e68zu5AXKNF/hxiB3HduS8wz
             o0kmGI58DZx17+Cdipw0ab9a9wiu9C9Fn+LaiCcdM/ESXtS79RzdbQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-03-05T22:27:18Z"
-    mac: ENC[AES256_GCM,data:WSopSnWZ+uOllywd7difaZtJcfxkL7eIf9Kr3GajZKO0+rP6pEHIS+5AbXZy6oKRlCLUPecY/WXFvk3//akpvvXHbf6Jp4fQ/YSuTcYKRQupbDBpOXSlc33QyRl6oEyiMOjxMxa2N2tmq8dmA0NbF9wSDMa5a4eNDoiL5T/sUZ8=,iv:QqbVRApzFF6q24rk8KfKuthj656nEczD9Si4INj+N9A=,tag:tMRNYo+u/jIQ6iX3KqKJdA==,type:str]
+    lastmodified: "2026-02-15T06:20:05Z"
+    mac: ENC[AES256_GCM,data:3S52Sd3qaqHWy5TL8MAq9yOpH7ZYMDUHprJH3JtW1Vs2rNJIm9li7x3RT0mRnct4NYgikyFi9PBghDJsDN/QKxxKfEDm6KWET+okL41/h/KnzJRFqHoG8sxZYnr4NWc1R60A6WdD+xIa6njCwCNLP4hDjHeQuLjhDsvhqSG4dO8=,iv:xsqZB0GaFYN7QhP24Ik602JoBjVnPGEtgKRbIp9a7Pc=,tag:ZfrKyzRn2bd9lY1bvFjZrQ==,type:str]
     pgp:
         - created_at: "2025-03-07T22:49:19Z"
           enc: |-
@@ -51,4 +49,4 @@ sops:
             -----END PGP MESSAGE-----
           fp: 0FECE8316E74BA6F44EFC21A2F8F21CE8721456B
     unencrypted_suffix: _unencrypted
-    version: 3.9.4-unstable
+    version: 3.11.0
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 3758621..ad44b22 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -12,7 +12,6 @@ in
   "phantom-nextcloud.age".publicKeys = [ main_ssh_public_key ];
   "phantom-writefreely.age".publicKeys = [ main_ssh_public_key ];
   "phantom-renawiki.age".publicKeys = [ main_ssh_public_key ];
-  "phantom-forgejo-mailer-password.age".publicKeys = [ main_ssh_public_key ];
   "phantom-mastodon-mailer-password.age".publicKeys = [ main_ssh_public_key ];
   "phantom-invidious-settings.age".publicKeys = [ main_ssh_public_key ];
 }
diff --git a/system/secrets.nix b/system/secrets.nix
index b7a484d..18547ae 100644
--- a/system/secrets.nix
+++ b/system/secrets.nix
@@ -6,6 +6,5 @@
     secrets.gitlab-runner-thoreb-telemetria-registrationConfigFile.file = ../secrets/gitlab-runner-thoreb-telemetria-registrationConfigFile.age;
     secrets.monolith-forgejo-runner-token.file = ../secrets/monolith-forgejo-runner-token.age;
     secrets.monolith-nix-serve-privkey.file = ../secrets/monolith-nix-serve-privkey.age;
-    secrets.phantom-forgejo-mailer-password.file = ../secrets/phantom-forgejo-mailer-password.age;
   };
 }