refactor(sops): individual service files

nixos/deluge.nix

@@ -8,6 +8,7 @@
   cfg = config.services.deluge;
 in {
   sops.secrets.deluge-auth = {
+    sopsFile = mkDefault ./secrets/deluge.yaml;
     inherit (cfg) group;
     owner = cfg.user;
   };

nixos/home-assistant.nix

@@ -5,13 +5,16 @@
 }: let
   cfg = config.services.home-assistant;
   inherit (lib.modules) mkIf mkDefault;
+  sopsFile = mkDefault ./secrets/home-assistant.yaml;
 in {
   sops.secrets = {
     ha-integration = {
+      inherit sopsFile;
       owner = "hass";
       path = "${cfg.configDir}/integration.yaml";
     };
     ha-secrets = {
+      inherit sopsFile;
       owner = "hass";
       path = "${cfg.configDir}/secrets.yaml";
     };

nixos/mosquitto.nix

@@ -4,12 +4,25 @@
   ...
 }: let
   inherit (lib) mkDefault;
+  sopsFile = mkDefault ./secrets/mosquitto.yaml;
 in {
   sops.secrets = {
-    z2m-pass.owner = "mosquitto";
-    systemd-pass.owner = "mosquitto";
-    hass-pass.owner = "mosquitto";
-    espresense-pass.owner = "mosquitto";
+    z2m-pass = {
+      inherit sopsFile;
+      owner = "mosquitto";
+    };
+    systemd-pass = {
+      inherit sopsFile;
+      owner = "mosquitto";
+    };
+    hass-pass = {
+      inherit sopsFile;
+      owner = "mosquitto";
+    };
+    espresense-pass = {
+      inherit sopsFile;
+      owner = "mosquitto";
+    };
   };
 
   services.mosquitto = {

nixos/postgres.nix

@@ -25,6 +25,7 @@ in {
   };
 
   sops.secrets.postgresql-init = {
+    sopsFile = mkDefault ./secrets/postgres.yaml;
     owner = "postgres";
     group = "postgres";
   };

nixos/secrets/deluge.yaml

@@ -0,0 +1,66 @@
+deluge-auth: ENC[AES256_GCM,data:DRh0wfsVbv8waMyVn/OjGgr//KvVZ6pQ4rrtvvEQH0Tno5COad1dMppTRH15CjVPovDDEheHytnDgfKR357KTvSDJHtrZiaB4orH6g==,iv:QXLbwbKDPfey6uwM3qiT+Tx8/Ug+EtOTDCXHGb9+Qrg=,tag:cKgsTDOqRVnT6b7HaK/fPQ==,type:str]
+sops:
+    shamir_threshold: 1
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1a2quf2ekkj94ygu7wgvhrvh44fwn32c0l2cwvgvjh23wst90s54szdsvgr
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNOUE2SHN4Sm9iSDlNRGoy
+            Y045S1A2NEMyZWJaNjhibGNldVNEZlhiQkM0ClJzQTBOWVIwcy9iSmZwcjNQSXJX
+            Umlra2VqSjVvZlY2SDNzcTQvNlcyK28KLS0tIHJxcVM3VWFaYmpOU25sdXdiUG1Z
+            Y003bzNOZzlHaWRMRU1VZHBIRlZWUncKZC13OceAyBKYWFPsHwZfOeMhYLqOTO3G
+            Yz8RGQvqHxVskL9B5Zqove9Uf6VKmDnzGUpWb3G3fozNKjGuS/2deA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age16klpkaut5759dut8mdm3jn0rnp8w6kxyvs9n6ntqrdsayjtd7upqlvw489
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtTDBhTjNSZ1hUZXRJeHNW
+            c000SnhDalM4MlhkbmljT0pPcVEvUlBLSWpnCk52eGhYYWNhVVkrOWszWWNwY3Vn
+            eEs3K2g0MVdCOTA0Uk9Ya0NRaHRoN3MKLS0tIGErTFRPTzBtTzNwdGFaaEU1U00v
+            elZMdXRHdnhrdURiTU9BV0tsc3g1REEK1yfyWy3iv9hMidASfTxyQE8qyVFUoCH7
+            fk2pTNQZCXQR9u8Pd0ZOTptsbrtcyDUc9l8VMfn6QTEuI53Nm8CswA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-01-16T19:10:43Z"
+    mac: ENC[AES256_GCM,data:Wb4ALWRT83My2hnlxfUgRoedG4M/aIRd4cfcb5wV88Rm8XQFGRUIZbqXBjKjZwy5w24b3nVmreKpPDsutHnBZQC2y0f9Pz4Jq/BTDDUWZXWNYI1xq5WZu/NTR7lhNGwkqdtG93TIEi3DkU27m9YODQYF2QaPmQ+LFWVCe9S83+w=,iv:XAs6aj+6j/QCBEu3aEGdyxgTkVkyhlay6oS2bTxxTCw=,tag:PIBrl3sPyFS6KhDqpEta2A==,type:str]
+    pgp:
+        - created_at: "2024-01-16T19:10:39Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA82M54yws73UAQ/8Cp+G1+mSAS8cijR6PjBq1lWnuU9jkYzfSiH8eDox4ZF8
+            59nVlUElb9qkDYE5FJ2hNyXiOmsG/0IFxn1rOFevHFYbLVH8HyQxniTvznIkKADg
+            OYNaESmSgk3IOzlwUK7BV8bpKq/ZQF4KI9eoh9EIas9ik4zkEpwPOVCTn1TAwwHK
+            upL0GwibTJNG2mzi880kJsEsU1BaSPM446YkGXKhVah0K+ltp5G3K7Z3csxX/nsP
+            ZNxlkyT6EPr7frSzqcp9Ge4LETHjtF8pOm3kVwcVSwMcV7o/mw1OZiN3JIjS2ecV
+            P+PtjiguoMhS8BHj/aXa3759hXKdzJMT4Y2qYx/W8npq7QAPGZH9FDXSOgqIFWri
+            2E7u7/Dp3hjfuUFss/YEsTGJbIsfjtCIXJgfjC+pEHcjfiQj9fCCYgcM8n3AZfT1
+            lXGKsRnt4nKzdjme3iP+GtBMdke2MSl5X76sFnEBTa7IbmyCOdtX1ZZL3dWjpvOD
+            1PJxldVVCJLgfIsgPe3qZaEVWUggXcsOOvlTsmxkCvlhoFOSDseuLgzKN56w7gHr
+            3FXgcSC6C6S+CufdMGQmMBvMx9JfvYhoiBmSLOO6g6hds9nb6D2XaQFGOg6mSggR
+            lupvvRRBp5BCI1MSBujXF8SPPfCJ4l7ySwMc73yERd/FbBXdsjl6RPFHuh6hb8PS
+            XgFhIItwbyFnz3hTm9TMSlhQJss9AVtOq7WcQ6Ehg6KVAoq1W8Jk24YZPHz7Jby8
+            2nRtKyHKAPUpPLUZv+TvBabHEDJ6wXUAVvwAevLnBNqlSaXFpmRBJnunHax6Pic=
+            =0777
+            -----END PGP MESSAGE-----
+          fp: CD8CE78CB0B3BDD4
+        - created_at: "2024-01-16T19:10:39Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQEMA2W9MER3HLb7AQgAgyq8OlLkOiMuG5v7OVsH/6GgGwtuubDt8qMog+KJn7Pi
+            lCoYL5sQJnvKaKG9/LxtzyiC9tGsMd4hO0Ja1IJkrA198OkbdOT/a6RKwIdVDhY9
+            G6tAGqViavmOTj+FmT2z0i0doVyd8lQF24o1pBcoyEzVVFeIP8hsriQUXoccnO4V
+            BMFeXW6fZvvXHWRjl7dGs5Tkc5HnRKj9i3PmC+VzgIUCDFN6dh9NUNkgIZxQHxVT
+            ThRQYMsFBJWm8jR5tN0yjufBzLjtJKECwQg8SED0Jtd/0YcsgmtbfAropobxG02L
+            GA//wzncOAFcurn18HqB6Rdo+98W3oht0gjkWPcELNJeAQ8j/Gtvc8pTTYxJxV9e
+            61RRUdGpzDECrZCtGiI6ui97GhPCMuizrXi/nNNf+y2+8lW/0KieJJASCuSafwE9
+            GEs2ZXpBvJta4yx2HvRuv/KnNRZgduU/NIvx456oSQ==
+            =0Kv2
+            -----END PGP MESSAGE-----
+          fp: 65BD3044771CB6FB
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1

nixos/secrets/home-assistant.yaml

@@ -0,0 +1,67 @@
+ha-secrets: ENC[AES256_GCM,data:JeoPXUOzj2bjCLqJjqr2UCJcaNMzQgLVUX1Oajl5JCQdpsVm0z4xNu+3PR4l/i/FsmTaJIM2Ls1ep11E85pPf7EqjZLY3s7+Z9Wv/zO0hPFULMPuXN34fj2I6EKsO1WtoIiPbo7Q3IDzjae4M45lD2wC06f2N6SNOuJ59sgJeix6YGrv5fM0tlsHsVUFyy6qm7zmdE15XiqUkMRdtuxn07BbzCuDghA9SOT3NluywjoLTI/qDTilgplrBjHohs6b+TCxnv0uI2v5MjdaGDz8SOuJWFDMee4WlR0slphQmbsrAyQeOgwOnUEuJgZ09/tebMJ5ZUwL/l7JK9QhGB/+1WI3H03MbOlki4r0kRjVFzU95mvxrOnlanBL2/4uBQplcVvTVrKkpN/JiJKPm8xRw0L6ZHAdYfPa0mTghr7Wb7Vu0jNszo8mBzoiL1+BH3Ub5TkfOf17ecbuQqLn+HPsqMCE2/PdMra4XerKJItTUT6AW3NFEMvLRrrz7g3mQsMYRA3S7I5Y3RsK3VuuAX1hdn12YnEgljI0AkUrGzKyKD2sm/un7uKN1mhXyYqwh65y2fiOkpd+vhvBWGYm1mEO3gmPtJJwXXsKOSPTizCU4U7S7T7lV6dqN/HZxQi9beaq4Fbe9nzK8OVZyVVr8QAc+m6/B4d7M4VBUgr1HcPOjKHc9jXhwuMRLkeVp8v/XhW2XbLSgDixPFiwt1+YgjqUkDhYkGqRo/9aLkflGGcrA+c7Y5U43O+z4KCuKtLJKGORF6JMRaQ=,iv:J9Tr8LSAmSw9k+PRMZyKETLl4hsUxOOwgKP5ksfvmHg=,tag:ImO+Rxqj3kAoD+NUE/iYMQ==,type:str]
+ha-integration: ENC[AES256_GCM,data:9egkjswlnbxvffLqp/VJ7rstVjNpvEnFG/pc2qu9a7EM0Vc/zhg92ajQGmbB18jKSvzvBrvNEsBxFol5w9pEA8gkgNFwilSlirQ5B3ArAM5GlUFMx7dAyS1S6Qnt5KNwXIi9xP0Ai9X9yTeov/bzOOuFp/3ZU2xJsA68lSEgP83Tj5kgcmYg7V+gy28oLTzFjmNzfzn8+ONVa8O5CXdCwpbTSGd/o+PIOVcOH9bSVObuJmT2hNiBnVUq3bS8UNOxP8N1iMrvgQJOh3SaFYOxDkjX3dDrRm1ejINlR1v2yvBAlKKKd6kNRSsW2mEwhVX15qog2dh2gqx/GzXq3h9Drpf/iLPm2r4rhUVN8k2MioE8pE4Atic08xgLCOPPsLPCgGe+lkch/9gHkRg1yQDLVtiXXpiAOb79/+eQYtjqv7KYU7yr1ikaFSnUtYUCUjLGehTNBuIWL7b6H7n4g31jFPyWosBJcmj2k6QEGt38mv027ZftWGmVYqVAudgOWY+Iz3zeJUXoZpfE9dcSq8kaXagLFqajKlK3ULzknef9BywOo/QkfUQMcC5fJatBFbP9ggG4l3rXwqHtwqkaKZ3fxPsJ08M78RKeaqy3unOef7U23OmVpklBZGioa0pFQ+IUdkA27XipNxuxZRjuDTtmK/RRohsqd5dsssa4MGhdWkMjGt0ktJuk4gxhwabF2DcP5T+HYSC0crmt7ZMXbwrqA/9aA1Di3A8H1j4riuidxJT4Ws+XJPNYBR08UiB93VbC//0/Uc3XcFFFjj3bwxRJb7ePFdnbfu+Pnv1jVLs6Rx9PXP7nWIWTM4+xWiPTqh6fPDHRVvrUEELO4O2tMpRWr1P3Av55pWv9vpJ4C6qcC8NWXNvHHcQMoJx/kTTHfv9A4HjBwrL5pwLCHyo3qqCTtpIRuONo1QN6y5VSuS3CLyEtmq0sKxSegLztOPD4HclaMzmLNkfR02O9iHcC6+r+iXICVgoVQgL7wslWaIAEX+CUamHZKJ2+DTbwQGwIVLrhQ1yWG6PhcBFuNMvLGNSunwi5GzDpvLCQ1GeDQn8IHAv94a7tlxPMvdV+aQFotRAKww9LTu/ooFXxTro+PctmA2xGpsCTOwqmWZEmvS8O49A8eZ7FEpnLNSQ0/vmKmsCJaMO36FP2sNFukfs2YHxdiDYTZbnWDrvVeGQ2hKAzTJt24jkXk6LhHt05snD/TJFGZh1FvJ2OGLY0pnptu2zvano4SB6h9+nHJmEbrPq7/isL0knmvMyuEpLBE9yUKjbOizEJTBOyLhze70Rv9XjiBTVzA2I+WLr1EPyx/OlX39eLwc9pfZdevU/CUJaSvWJTpS2jBa4KSQnmlZEAOeXPnD+xGyTsbAOaMHZv7TIbfBOQRd6avVpsS8p86RaB0rGLvFy+AYMPgmOK6BN0VOblHCaE3gxOBRpoVssCglOkr4rB+UB9zbbSc2zVZg5m+TCdTjQjznVyvOJQ/v7qm9cOSME0Frsbbk+gpXwTjfV8TzvK7u9n8xKXBhC+uqBb8r2KdTi+3gE6roqZLaUrKeTGzj0qkVWYoPXde2X03XRCWEXoN4/LQFrY4OT0W9c+r96WGySUgOl3AJAjHpfWZBuWNGsKTIaj22Lc825kc8iajOUwR9dUoIky1GwNPTMtAvglANABPWxrI/aPglnIOdUNNUupcA/abcMIpor0dUk+7J23vgpRIyyh/iOzg+3ax/QIsyQtmCVhVa9DYWxC5TFGxlRXaQ7yDLzr8ryDV+jb5mYbKqTIDYApO+48ML2U+bH1kCDNwcszG+Ywxy3TPCNugiz2439ZxC6FQaHBqvISUAKt/qhJn/3KKIYAtJR6mLe2NMMb9ui2CswMEfuWUllYu9iN2qJeq2K9dgpkOO1Syw0Q2842qMd5ZMbdPOhdbkuhDf5yxt+kFtNJU598dyKSF1b7nKH4ftIC7qu9HSWLiC5m+gTrbNB2Rjrruum1/Ko0QPGJYbALxhqqPDqaMboS6RSR19/SBQQJYNpwO6Y93kwubdki74Lm9bIIk0dNinBm0Cb7CsiASl5Wdmfikkncln29uOOAB5ArqtcMX3kunvGcTymSd75AHlqpj3bnYCskl19VXxlkrfkEg+o0ExArTHqIfYSNvMzUYKP+dsTWcjGA22E6iXTbFHjloHIXoYLsh4VfnmHj/2zdnWGCxi0l7bAmUzAioYoA/nfAgerfqJFFzns+c24HhTllrxv3m2YbxKKPt51beHUfVaNmLlF/g46ogu/PwyjnUJPw0FSGq68lwzpO8Icsi6xg3CdsF+iVG+MtXt0w9rxqqDyB/S1GDWChYXt8ZyrkjFaZvPhP400U5M4Cbry/AOf1msk8U1LuDzUxvmglsO+qbe3UqesQvTBCUaaiFTaUqs7wvzByHvvCmYAZjzmvW2kDVoR0mi5nB+dh0nU2FztFeOtXrDtH95UpaAPCVIP2x9wg9VKKvWFFGrZjrwRKmhDxWUjNjK0AOeWXG9hSLVWskKovWmXB1T7G73/WTwS6DqAtPQY2+aWsXALvBMIso92MlutGDTBZxzvKhYiZtEHzXDTxhRmT6dBQ8eDMnjECspocQYPh8BarjPtCriCIfS0s6L0jcYigiuyHvE7f+yXzTFmM+NM15Vgp/2MtbrQ+nCh7rbGNTS8A257cofW10dZDCH3j7ZXhrGDV8L4TgdxGZKCCsvh4GbJ0n0hvXLM0irel2Dc94l1TAnMN7cFvyvHyS3y0CezSYQ3sE65PTxg12lSE7k8ni49DLs1+gaMJ2rQFKyOtWmyTp+9//VPl6oC1akqsphyyVt68wvNRWPzxO1E1d1mPKMJCkLuUiG3rLayFXHsgMOz8zoEX9oKm+w9TcjqORPL7BOCn237yvvxhGuHtKN8zOeDVhfB7vJd1qvuYLzoeaJV6mN1YmIbNIPDgs17l5o2/+FaURFHUKFOUvvQHsFEjsHaJQ+ES7QwwgLqMysUv//dh2VLsY4DG5CvYkiUXc+fCBdUF9XS0S7mEp05M13ERzaYnn+S8fXZ330EcD/p0zll97wp2RjYaBwfQNh1IZVVzoQXkmleAtPAlQ9SO7cBXVyuENg==,iv:3TMjBTRdPOr/dRJv8Xj1F/hQbHjEvzQ+Ye7gNsk9TkM=,tag:PnVZ9jaE8HU9g8xxtOP9Wg==,type:str]
+sops:
+    shamir_threshold: 1
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1a2quf2ekkj94ygu7wgvhrvh44fwn32c0l2cwvgvjh23wst90s54szdsvgr
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNL1lQTGZteU9ocCszVTJ4
+            QWFGSkxlaXFNVWx5aGlBYlcwWHpNZWVWY2d3CjFVSStocXBJRk9ZblU5UGpuZ1NZ
+            NUxRcURXaTYvK3VUQ3VVaFRUdWVncU0KLS0tIDNKdFg3R3NBVEgvTUVtVE5rM3Vr
+            RWdrSGdNNjI5cjVZZjBFV1ZReHhpclEK2sq03ZFKjzZw4ZbaWx2EnSz1PdELXwvw
+            5NDJfkpV1PQ1/PbbUTkf7nG0NgTb/FEDoZH4X//wFILAF2MhUcQufg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age16klpkaut5759dut8mdm3jn0rnp8w6kxyvs9n6ntqrdsayjtd7upqlvw489
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRa3RhOElmdmhoaTN5V1dF
+            WEI3TFY1eDlpcjF6SkQ5a0cvVWlkV1dDS1ZrCkRHS3U0NWEzazY2RXpQOTZUazg1
+            S2ZmV1J2M01zakpsSzdaajZJb1p0N0UKLS0tIDREKzUvTzFDalMwV1hYa0pQcXpR
+            NStydDhtSHExWC9aN2ZqTnlSQ2wweGsKD0wbxkd65AsbBhHG/ooijrFE6XS8AYbV
+            ozPvg2N1vkiLtSWE4WrY79CeSMkMksxB3kLjr4NoHEKHRs9ADvR3tQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-01-16T19:18:20Z"
+    mac: ENC[AES256_GCM,data:ax4tNBIzzP8PV0JYBdEYP31w0+SmLZiM6mTwImOR6zAzfE9sX6q77CWGR+0QAO2pfC4R/nppjHgTbESdUH1X0HKdjJw2uiF0bUFom2ELaMGylqxV0llAQ1iqKHkLF8hHciRz8IS/zf247+8iZmOlZqWazUwlozAJW7A27d7R66U=,iv:sm0x1u0xz9B9Kk94GCn6sniqJ4rnTnSSDRdsYeAUqL4=,tag:KrTOdc86LAB+x+PfV/9krg==,type:str]
+    pgp:
+        - created_at: "2024-01-16T19:12:28Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA82M54yws73UAQ/+P+n7MZ+EEbg2AeKm6L2MnZnHycfJGBjXk3XH9w9zAy9Q
+            U7+ak6auxsx7kwS1Yy2f7nvsdn9+vGlmHdPiRZpuMpqaOKU4xvTNGoXQ0tzAjjWu
+            35IFKZIKS+BTJGU+oxQQ+BhPyP4HT4Atl33RSz4NtBFqxVEyiFXCjU7oYNLeqTDK
+            /h+l7vX2qz/KUCLyHjQLSHUZOmdTI7Z6us9NdIK6tWXOWUc4UfdxsxqxQe+ayRwL
+            HUuRUt5Sg3Y6wKe8oazg/jcMUWl4EDznZsckxGQuGyZ/5cD58FKiVtuSWs6m/oDu
+            r1mBqupf7gtwr/PleDe14Uo+IzcM9JHY8TZdvI87WI5t/xNgjyO5qTB2kPde572Y
+            FOxUhclNDpZgJJXP9+wZ1YYQG29VBzSFrlSV0mRZofQRJqorbb92Hst3bbb9xmmp
+            TjaIAq0FvrXLmNCQZKvBOr3R3lkeJrhqXQhd65emZPvflTxZNOOMTOWbfUk4XWKN
+            03g8LHarKY//abfcuVtMTIMEhfP+30tFNe7oSge5AjjeZWq7xh/bpf+CkLPzVDxk
+            O76N9eprJLqTTAh8cIA7ityUXUvToiL2yCxaIc/YKL2puOwK1itSfb9eYPS1556w
+            luvY5dRAXEERJaO22A0u21f1DLz3/2Vur+RcMTisXtUvZaV1BU1jYn+L+k7E/2fS
+            XgHwAajQDrRXPvMETZD+MN8wocJI9HMUKPHFljxXmI4yFuEX6WxNtNprBZMO+6x3
+            QxqK1eE5LRfJwwjuEojZ4omwDmbjS5Mz5aLDNi2poOCTbnlxVjDDiY38RPP6EwQ=
+            =9UTE
+            -----END PGP MESSAGE-----
+          fp: CD8CE78CB0B3BDD4
+        - created_at: "2024-01-16T19:12:28Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQEMA2W9MER3HLb7AQf/b6FqmQ3RQ1SDkB9IMV7tbtgOu3WmokrjHFsSmXOGF4tZ
+            CeuAhuaCyBeuV2nVdsyo+QxWOrSTKWza1rYQJtF5Uh+y37Uuf7xINHL5X6nEFm1J
+            s4Oq3XP/n8QR8Xe/u0+L5/Z3r3NQ/x+IkgTEOPyHkcpo0FrhXo2RgnBnm4fFGZKp
+            I2JSJ4th6pScGVNpnAwRw7dr4YMqoCx1/3TrHJCjT7t/r58mHp5vOw1IA3qvClpB
+            z9aIIM3hHIozpvDu2qFzdD+aMdb8yqLcGVVEj1qPKuRvlv6jt5i0koQ//9shPHkD
+            4Is0OO+XzKuA+yrYJebPZPaRv5rEKtTWpyvj3SHPd9JeATgkgX64DDOIQlnBSc8S
+            lAXMWQOsduvcpB1aVHQQsZQnlyNDgBUYSJdhKhntQuXaVXQ+NBD++JRWAW2sgYy7
+            ANp9zAzNo1CUNjNUSBC5Zf2iXwBwEms9P8uKqlbdjA==
+            =uDvW
+            -----END PGP MESSAGE-----
+          fp: 65BD3044771CB6FB
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1

nixos/secrets/mosquitto.yaml

@@ -0,0 +1,69 @@
+espresense-pass: ENC[AES256_GCM,data:2hUMlBpjasOL8JFrEz5Mqw==,iv:ORfaZRKxDji1zhGnuH0fxig/G+INgIWvILqs+AVit5U=,tag:1sB+Qj2/gEPKV5EsM9L6uQ==,type:str]
+hass-pass: ENC[AES256_GCM,data:5DLcpo6WL4H+epBvOg4=,iv:FTqHK3DFQ1X1bFz9M8shTaggiWymMJ3DfFVFgeuC4F0=,tag:bdRlDfIW9f/rODXSwgblaw==,type:str]
+systemd-pass: ENC[AES256_GCM,data:P5DNz3AfdkG7MBGytns7bQ==,iv:+YAoCTTgfiJ228soXrs0WecMpXnK2Zt7wAj6meohQ9E=,tag:PEiAfL/R7P9My3KEHEoRzw==,type:str]
+z2m-pass: ENC[AES256_GCM,data:xbBqX2d0jae5A2l6nMIs9w==,iv:3iO9h+MOaRcVL8eY8uJNIRKlhYcFUI4TrWYa+CobbMk=,tag:AkxoL99ZYrDEGkni53g9lw==,type:str]
+sops:
+    shamir_threshold: 1
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1a2quf2ekkj94ygu7wgvhrvh44fwn32c0l2cwvgvjh23wst90s54szdsvgr
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3WkdEcUUxMTQzdkI5YjdX
+            T1AyczFwaVBwUnFBVmxKeHZIWTJyVDhqalQ0CllsU0RaZ0ZNTUVoYU05a0xIY1ho
+            cmNLbzZtRFZFWlhjOGlwSUhyUG9ZQUEKLS0tIHhCOHBFZG9xeFZEYXU5WmdhVHpT
+            YVAzMlNFY1dyUzREUHl6eHhSUE5VL28KyWyBAzMx/aDa9b9/n2KkUJCvYgZblVFj
+            /gDBHjCs177fge8b0AIKqcJ3akUyQZS3WzhJZLZPR+dA1t8QpaZbZw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age16klpkaut5759dut8mdm3jn0rnp8w6kxyvs9n6ntqrdsayjtd7upqlvw489
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1cURDeTkwUFdENEdYaFh3
+            R2RZZjhYTmZ6a05wTlAydGZwNW1USWR4cnpBCktUdVRUd0daa3FBVmVMSjlpbXdi
+            OFp5dGpsVG5YUkdWNEt5RGtOQWNFWDAKLS0tIHVpVG5mZzZoa2k1QjEyV0pQQ3Jy
+            b2JFTk5GSXRocmw2czlNYkN2NWhtYTQKdss++r+z2AvjBd1JbMmEc2Am64hxwRDz
+            OD6kad9s02ZzGpryLfrBqyxvuQbfwfbTPHMwANS4WuiqvSSnJ40BTQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-01-16T19:11:37Z"
+    mac: ENC[AES256_GCM,data:aZl7545lk6KMNGanuyw4tcn5KsJNt2hrsEVn3VHTJdhtoLo6324Mnei2WCcJm6TfqYN5wKowzg9dnivtRvTD8r/ZM8J3dtTwl9091d9TKcEhVf30a3EwKrSYsDpQUL4vagg7rgFUjbZMUSKZTEgA6o46VbR4glnOiVZMpMMtGWw=,iv:OsbhloYhHRzgUKoUjwiRspHrZFxAf2XL0+JIwwEpmeg=,tag:v4pE9dfnySmrRwlZK7Fyyw==,type:str]
+    pgp:
+        - created_at: "2024-01-16T19:11:34Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA82M54yws73UAQ//aFxbDCVemOYrhkOpXZp2qhBlCrRzeykheQzpgnZHd9nl
+            ip7J6E1n9CNa9nPPKMRCbyQ2vYE/VEEbMtmU6kPkcHcRb3T8Q8O993EPBglFu6Es
+            hThXBc7DnQRt75Mc002KWoG3Fk4GkCNnkfxLA629i1z0M509STpK3cBliW4ehPy/
+            UlAAQu/z4+UMmclydLIIQEmpERBLz98B+o5G5kiTFr2UY0ZmtXYfK0F/DxgFNIn5
+            IrsDYaG9RELGG79rqJNBhDqmkFzXKLrr0OOnzW1NTeUCUMGsnz+BcYX3Z9g/XME+
+            OS3mCWxyXF9rnIagvKsXVx/8BCm8ltYvDMEzhaHoCApcSVz70crbRdmU9CrRNAOL
+            4BxO398dLEUX/2+DzMkhGL15G7fPoChGeHAcWq/m2G7iFSjcRNGpp4WnKPPy0eOa
+            59zKpl9zM49c85qJjtRH7kEuFti1LaxKrMir79EQISeR+BltbLolGGZ2pxAfnKxU
+            6Y045TwM0E05LUG2uAqcusiaBcmKeZA1BfcJ3a7n7+gQCZqwUZwVtDSqspfmfTwg
+            2z7Zthv200qgW941xhxkI05wNCqJvIPZUPoHXMbUs4qHYdkh6EGlz/gsNlM58GGy
+            XgxtQEx55CfkvfFR0aye83tVDjI+MpkhPoy7e4vGj2n3gZpy9RLDy/KYcXGDrWzS
+            XgE+pcqCi4kNhs9bO3qKvH/baEKWWlMr5myB4mVE/fZsOsrmINxHsB9lWbRtOUvV
+            C38jDgz1ZAJ2jWBpLWkwqk9tMn5r6xtXYfSirmluDnnO52qOma9IyiHh95xt25A=
+            =D8DR
+            -----END PGP MESSAGE-----
+          fp: CD8CE78CB0B3BDD4
+        - created_at: "2024-01-16T19:11:34Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQEMA2W9MER3HLb7AQgAo+QhhMhj1xlxowRwjUYfacuKJJisPWCOMlVEdBBLs752
+            AcCzJdV94GB9tnn+DNADZ/8A3HPUfVqMJdHVQKokvMZwxUN+pJU8HxuygLtBFJgJ
+            IfP1GaHWivHoVQJ0SUFbwvvZdlaoPBy/jt1tYI0tfIQVkqG892qeDEtyR7QWsg5B
+            xvmedepz7L/3k0fOFbqbk2jAhrNh9fhWfcSArzdeVNFALqFfCFrzxWQkbOSccV9C
+            UmeiD9kO1wJvkRagXOWAWEEnmC4Kp8SrrytaNZgEvk90gVERGEqYBJdCzmGV8IRA
+            t8tMwPWKwHJmrdREPE6xOxg/NLlITI0sGVArgPHoUdJeAavRjJuPWGL4vfIt9Pav
+            mxSSmF9LOUlu02S7bc82meN4V4idNo5T1FtFO+wZQbFr92mlJi3hg9hU8ZEuEtUm
+            H1CG8DDKHcEowqcfV+zviReJOXLKUf9m/arSKMYbOw==
+            =ukAy
+            -----END PGP MESSAGE-----
+          fp: 65BD3044771CB6FB
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1

nixos/secrets/postgres.yaml

@@ -0,0 +1,66 @@
+postgresql-init: ENC[AES256_GCM,data:TUoqSxYsydMShNZXjx5Xee4P4Lsar746UOs/H4xQ3yk1xxHejpANo39uhQQdqVXOTQ17JXKOAHjUmFJyIq8BotEFWgQ=,iv:13yUHxGZ+dc8LtHF8NPXIqaMatVoop4TA5cHr87UXQA=,tag:IEF32Ct8+IRC9VoUBlWQbw==,type:str]
+sops:
+    shamir_threshold: 1
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1a2quf2ekkj94ygu7wgvhrvh44fwn32c0l2cwvgvjh23wst90s54szdsvgr
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzemtXcWlQMFBqVHdVdGM4
+            RFJVeklvUVZzeTNUbzdHUVVVUnRJNGs1UkhnCnptSWtOcHBCWCtqS3F4NGZ2ZTEz
+            STBOQXlzNXU3QUpnUEtpalplNWR0ZWsKLS0tIDd2ZXk1ZlRuTnNyWERkdmRraFpi
+            WWZKQVdLbTYyRWlQK2llZFN4cXRaUW8K6tIwHU95aI1D9SWIU0sb0ZK0RJ9FhoCJ
+            +qdR87gWSEl27W5kFsDlkMQHe5a+68S/MbHmy3CY5dMmsETj73/veg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age16klpkaut5759dut8mdm3jn0rnp8w6kxyvs9n6ntqrdsayjtd7upqlvw489
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkbjl5aXBwZzBNRkZyUTBu
+            VDVtSk10YXdaY2tpcVl6T2QvZXIzc2NrZENvCkNndm9JU3p0bnRWUml0bFMrQ0lQ
+            VlprVWN6NlM1YmdkaUN6alk2U2UyT28KLS0tIDVDVFcxYTAzbkQrNlVPSXdSR3hN
+            K3IzMTJ1YUt3dDcyaEFMODh4SDNpdG8KMf2OKhUsO2kJk/v95ztfPNRh+hP1LuM9
+            2eHsbKZ7lEwQDJqKcRduAtr1jGXIioPR9+EaTLRH6NDTg8ZORYLpLQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-01-16T19:12:12Z"
+    mac: ENC[AES256_GCM,data:xT5guyOuwPe4BH24aIUfpG95Gu6o9Df3oGeA8HFJ6dtHuWXrf2xba9rn4tXDHkIxDm/18Z8v6nX4OFoiEgkwWGsg/RXqG1Rs1/+fhWHe4UOUU675bn8zJiFgBKEtr1e0Q1THSPlgfM8L/qgJhEJSYoPcNArbxkfOgXlKJFyH8ro=,iv:kw+IR4Xh77kkHixfWKlX0+mqS3Sq2E+h8NSryrwYchI=,tag:N7yiMKagn4y5j9iOrh93fA==,type:str]
+    pgp:
+        - created_at: "2024-01-16T19:12:09Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA82M54yws73UARAAsLhIJPLcHxsBP3ERy8OCJxqnwOPA86Bi491pbyg315N+
+            yZSRsVRHGHmJew3d3GNcqzgWAi4GtCDNukcmorrqPe53c5gdMXiEfUvBA3BN9QoG
+            HfFXkX02+Rpi2n44IuMTpVy/vGCqIsgREA85VU3oVmWWuVI5zLgEUlyKqq/GuBta
+            PZuI6mq/GLeFBWykEu2JD0KBVEF3U9HPXQ32S6Y1RdKrLI3CfCuQV8JGDE60N2Au
+            R9DKto/nsXfFNivBMKyV8fhl3nxAgXYpLuoYoP4WuHmwkOYfcTofJOaMu0VqE38C
+            jWdnkU1NkeovTNzpC79bp4mLAnEsswAisDFyuoG39Pnk1xOG/ctZYzrk3gtEOPKW
+            e6IlFOlA9z6dZYVvhWhPHKisF4w/zz1cBZNAzf2Ehu3M+QLJUm0HC+1/SYDXnKzl
+            XuMYERrPZBk/2h9EAhR4iJlP7trBjZy3HFlLrs766z7PrIILssqIPLzzQBSl3/fr
+            Owzf6XopMl9QxF1EbkK1yJ7LZGpyQk/phLJ7JEZL97KatFjIkxiGxC5Cp9oXYREL
+            vwH6yJB6p1A1tb/jA8oIVHg3JV8JYON0qZxjZd7GPkTQdKRxfo/hZ0m6VCNEswN4
+            3WBP/aGGmnqmw4eccgZPUlP7ZNxLJhEQuwXXsCCdHh29NnMFv/fjC8KIjuMTIDXS
+            XgH8Xg13xw6ttrJ4NxNGDbpZYAuUM1YbW7SIPLV1gKwuF5OH5lbSVl2DLsDwMKri
+            0LpUTxA8IvV39Fsj5tSrhsMaOgWQ/wUrl6B/+Lf2fT70/pY9NjiNtVFMrjIYfnk=
+            =ze4K
+            -----END PGP MESSAGE-----
+          fp: CD8CE78CB0B3BDD4
+        - created_at: "2024-01-16T19:12:09Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQEMA2W9MER3HLb7AQf+LIfrBcHtGu8WCAsjrNzxBmvJM8I+11wIG4X1erkfe/mY
+            yeQJNLElkLPa04uvJ+p68xGvGnBueKZX1TTE2a0y7bVqNYIAhTDYlP3pR3tG0vxH
+            KgKqYNWwUy7qLZ9V1HPxDtng4/yh4rQUYcf5sXCcW9tSzKwenYiiK10fEBJk6yLO
+            +uSLPAPsyxjMbKlS71jhDDtzn9z5815VnzgNxRWd4XhZPVxXX0/JikS6YQSPOKgb
+            MVJhgSi353/OPsBOnoqiCcor2HNvGUGxyJa/4LC9lG3yVyEHxctCm+afJ2kMBq2X
+            wRQrYQRkst/Xc+7RjCbgN+c0XSDcvOu4idJRFYgaFtJeAQ/ZlsYEZIFFqRsPW0mn
+            Z1bVcANbYc0WlLUSDvv4tgh5CToR6rwPNwD+4vLlAaRb0pyFFmExpWSew/Pt2M5z
+            hrGjjTSvSZ8fIUGrKrjxCEmjsHY4mvxsBIdGqFP8VA==
+            =GcJw
+            -----END PGP MESSAGE-----
+          fp: 65BD3044771CB6FB
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1

nixos/secrets/syncplay.yaml

@@ -0,0 +1,66 @@
+syncplay-env: ENC[AES256_GCM,data:2u4RT6hJYuDhvRbYVO5t0T0EDnW8QUNdM2krbuJ5WBqKXfTXlIjLb5Bynt5J3/mSSp9DRCggqtXvZaUTxr4Oia5HIms4mxBkUrfareaRNm0=,iv:+IWjGtsmSUfw1wNpSSFA7Kvnhv+lG1F9a6T6N+QLAq8=,tag:ucEwim9yePrgEZOqQKsL2Q==,type:str]
+sops:
+    shamir_threshold: 1
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1a2quf2ekkj94ygu7wgvhrvh44fwn32c0l2cwvgvjh23wst90s54szdsvgr
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4MXMvS2g1bmpGYS9tS2pV
+            eWFNSnpLWVBGMGo2TjB4Q005VlM5UEVFdVYwCm9tamVvZzM5ZC90TUdiUHNnRjNr
+            MGxoNFl1Qi9mc3VCTGZOSVJPYjBWZXcKLS0tIGJGSkxYbzZtVG5ESXp2KzYrdE5I
+            ZFE3YjIxTWE2anRoSVhKZ2VnYXlSSm8KqTdIqF5zT1J+/pcdgvqJnuCTDT2uFfXI
+            ogkwT/uetjoDywBUBifEcDAQL//OjmEiP5yVWiz058Vrat2OX+cgtA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age16klpkaut5759dut8mdm3jn0rnp8w6kxyvs9n6ntqrdsayjtd7upqlvw489
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBadUJXNlFIR2s0OEc2ajlH
+            eFdKZ1BpUlZWcDk5UXcvUzUzQmpuRm1ienlvClEvQTR2WTFqSjRxWGFOOU5OS3NI
+            ZUxpUWsvcXBURTRQV1lrWGNVbFdlaWMKLS0tIHlubWpsb3RId21JMXVDU1FENGdm
+            QzZtMURvayt5MFpvQ1M3QS9nTEtYVGMKlPlw7er1PUOvEFZaOIC2l0BBgFVc69QQ
+            B3CmxZ6x6e218zoOFNy7knwlbCmn+/TH2bhOD7iCFnc5JUMZmUxlSA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-01-16T19:11:23Z"
+    mac: ENC[AES256_GCM,data:mev1gtAUq0ujMdYVz4ipkGeyPn/rtLJZx993CVQRxTLVNOIdFkvJlbUwuSKWdZ29r1EdQgqDc7OoPekYfdO/7aMa/AyFoL1e/ohzD1mklGZLTP4YLB3/jB8fkqZUZXCdWtA2Ej1sRlBY2bUZx9rL/FpG9OyWA8zOlItReAEhDPM=,iv:rLXIGy4kY+tMHX6OHFE2DGtFU6niFUFCk/+CadXFP2w=,tag:j0GR5K4yxMQwVUyXCEyJrA==,type:str]
+    pgp:
+        - created_at: "2024-01-16T19:11:21Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA82M54yws73UAQ//WtCBv8uciyNo+5ZVd6yl1TaLHTdV8WVOL+42TWeCiHmF
+            8Zo8pi4RXprwxqcF2pBUVmerVur/Xhh0XYQN7bMX7othdxEI/wMT8oidbr2SH1UV
+            5nL7GB0A8ZjB81A4Sigin1IKRDgNMijDRBMNvYiHFdA1oRv1SHecBf069rGT4Mtu
+            tR0ULEAEKgSG0Nk7WgHtejqsBSaGl5CmLjGRmaH+B1vHcDpdwQxkMvxDeq8uSL/K
+            b9ClfqvkGtfuZBIe/IjGyC5e1l/A2+Lk1B6PVZrl5j4kht9OGJAWodqdNu82yvuC
+            jZLYQWhT/k2enVCGGt8QI31Ix8SDIQ6yvAxtE9jlzb+jxJfrMOVKgYuXYwkasdms
+            lYwyJM+vvF1HwpTPKlxCjCvtOqx/CSjJZrKLIeodkoC00VHtlPzbYtjAz/JgZGBd
+            SmQdvZ1nk5lTVLRpgkN068qj5X2mHfjOHEeuhNY7vuzLStraJrb4sA+yZOMBAYTC
+            s8UgRzZpN36V/Kbn68mQVT0fVX5JTdKCeOM51gm8xxwtL19saw8qByzvUIUhvwBO
+            xgZZCKQJoIGd8AaD+OYc0/f60UmjobVIudJII66ZxHKssGxHEQwj2p7Ru5iZbzy/
+            sjB7T2HuPQJHI7Kcd3QNsC4BviJ4zeAQEC0v3ed+pJcJRBSDRcURwhZdQBEyekLS
+            XgEv338ih8/39Mmv3lvVZk1MMSp31wOUopsIsU9Iv1hqYtrK4FCsimDCCALXA0FV
+            ZTVljmxA4lSr5C0EUg4C1FFPC/CxWuMfrSLTxvsoH4+RULDV5O7tqNfEfAZMiDk=
+            =IEMc
+            -----END PGP MESSAGE-----
+          fp: CD8CE78CB0B3BDD4
+        - created_at: "2024-01-16T19:11:21Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQEMA2W9MER3HLb7AQf/Q+PBFdmtztV+d3fWDqdi4D8nAPcevbMNvQLwq+oPSByt
+            db3HXcQV4HbrrGyUtULAjcap19R/t0jpNMNmx7jddsKpSk1cYSmrFmD35YQ76sE/
+            FeVyqbAkB8ofQCeoDTotlPGVzxluAs/cQR7YGpZrB4WJ/zTkG3Njhi+MVoOkk0f7
+            3iUIXcFA6qvvWoodI0oWpD2hwx3V060Yv9X/sSG/ymIXKo+MM7cEAe/AasxXIWG/
+            3InpE3/fJMssSb4+4uq0rCHpXrwhKENKjYyRlYqRc3KurNEIYZHyEGCcMSAnexcZ
+            PkNZZrZJ3c1fUCtyI+1hsntHJQQOwcu+6/JERI7SodJeAaeSZIgMVx7jEKtL36cM
+            u73VkMqTxK/ebGaMkoT5fbT0fCTMFvOhp9cRB1Viy+cNo6x68kC4VQZLeLHKRPpf
+            fGhxFogt59q55ZzVYh+xUlhs4zu2aekFKcpMzjfu/Q==
+            =y7Sd
+            -----END PGP MESSAGE-----
+          fp: 65BD3044771CB6FB
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1

nixos/secrets/systemd2mqtt.yaml

@@ -0,0 +1,66 @@
+systemd2mqtt-env: ENC[AES256_GCM,data:VcZQWEoqnr8Vv7IawU1N1P6JRm+xm32HrsNC5yzG6w==,iv:BNV5H04FevwChVZ4sZhx6MX/jQDPawcYBBgQyaIOrOY=,tag:rqnWOMAqkW2OJHqeKqeafg==,type:str]
+sops:
+    shamir_threshold: 1
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1a2quf2ekkj94ygu7wgvhrvh44fwn32c0l2cwvgvjh23wst90s54szdsvgr
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoQkdweWxadkM0RnNpNXBn
+            MWdDdGpQZ3hjSFZORkxVVUJ0cmVIVlZCTUU4CmMyNHVGUFRLbXo0Y2RlbVJualJW
+            U0FrNFlSTnE3b3g2bU1RVGZjc3dBY3cKLS0tIE1YTkVNYVhjNHpaTGFBRzdZN2ZM
+            c2VGeVJnRDAzb2VCNTl5b2xzR3VZNGcKBK/Ms73IPWONt39WLgcmFVxWR7Hs8KfR
+            6V+obwwvUCNeZgt9K2wOKZjvL9L9p8CqfR+0RT0sJSmwmKPNbDwFhQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age16klpkaut5759dut8mdm3jn0rnp8w6kxyvs9n6ntqrdsayjtd7upqlvw489
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5eWsxWk1menluL2FxSkF3
+            bGwvTFczM1QyZU5JaXJzYWVHcmZTbG15ZmhZClJhdGRLOXVDVjdvVDI5SG1Qa2tP
+            ei9KZXhlRDBsaWY1THdqVUZpandEdlUKLS0tIFFUTExjSWJNa2RtaHdrMDdveURU
+            cmFMeEZhODFjVXhkeFFvUFNWaDFoZVkKhvOyuDsvvYuM0dTLXbmsM+fTM/MN32Jx
+            JW0yZgNZl+nbrmB1ECd9Tw+m3OlYmuCDj+n/uh7uQEw0bpiVFWvmtg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-01-16T19:23:39Z"
+    mac: ENC[AES256_GCM,data:cx4yChbZ8wvNh8z29i1Ck8DYyJqPQCZBk4UApx8HoubGxtDVocvdtFl+98nkv7fKQkynmEmAKVd9FlFpmIbLze8m30pj3AkPy1NBvhIY+6VJExKpsPQT/n+cuxiSfEDovD+cptEyscpizy8Olrqeko3xcdn5DeRcRI7Y2lFQBGI=,iv:iHiEn0fjgRTaffSeSFzIsDnnEggBnwX1e8hJfGZ0YeQ=,tag:9Ax9ASlEXD62BKH6JQzl4A==,type:str]
+    pgp:
+        - created_at: "2024-01-16T19:23:35Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA82M54yws73UARAAqRJPALcI72IoazZIw2k1GApTNGL0VSl7h2G4OIOUN8lG
+            I3wMrp2EHSU0XKogL2mB00Yz8fm8p5r+7/gq7rwwS/jMO1dr2Mx7OYoO3Q81YkdY
+            u0qfCmWrYAktAGrsn4Ax9BWSxx+rJZ+Bz4MdMPdNA+eeGAfdqXwXajmd9KqMtEdi
+            xmfbL3Hza5KpRoJlKX5eiKBPeown84fXlqnPGhi2YgTZ83vgBrnySJTvOhoaFsHf
+            1njY+WHOHoDi7i/Evgh6mjHyWGtvcicOGEBIpMD/RfQrJiIaDdRCajHVB9Aizwy2
+            5AsguSOMh6qi0KXoh/3jEPuNl99idQy4ej5sY+H9pmOmial5qZGEL4GgPCsbHM2W
+            DyDkk1MXsU/gHz+AvF+lwqpyyrJwg8LyEjaPwcbCZtITu2lSPze2Pu+w9ITvUwK9
+            ekftMXSY5KmfhiICdWQOqbbeOIoCez6CSHpakQ2zuhr5kA/NCAqueRKTY33MpBd+
+            IEQtGoG8JMt9ey/LinwVYGLWCEo3/fGqkoKvVPUZa+3mLsC7NFv4Sw3rl9GUP7Vo
+            W4KpYSKx8W5vvHr6D8PTaJMVv60xuZheRGFKHXCvv57YrJ/ZqF6oYf6jh5GC7sjn
+            qn+h6aAN4txUQPL8GgpP+nw/sVMqKbF9CCSydDC9plWMrNNXGImlQDmN69aIZxfS
+            XgEVWjMtqv9wDYcVy0b5ane0YAEB5ncB0Op2g+wcEraggynVgLYhS3ZludbpAy+Q
+            zu7K8UgYW0+pBGc9vTOe1qcsTzqwmFxzxTKLlGIQcoDybNEeYgflWlYGttzSyWs=
+            =cCBb
+            -----END PGP MESSAGE-----
+          fp: CD8CE78CB0B3BDD4
+        - created_at: "2024-01-16T19:23:35Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQEMA2W9MER3HLb7AQgAvx91WDQu/kx57aMTe1OVormfyWXEZeMl11GTPwebhO2c
+            Aifly4zsyn0qPsgj95Gm9y19kWmBSmEOn+X3yVdN06M1vkH5oN7pJX+NqGn2Al7W
+            Q8P0pjb7LdyZuGkc8u749BMUZ3lVtZMjCbwtGPABXdDni6fXwu+9pdojm4/h1F3D
+            ziLAgFwYFRrSXnX2kC8hT2cLKXW5HG8U2Qp2iAZGtHqbTFA95KcAtcCg4DB9YrES
+            NUVttGiUelDMC0IrOzxMFj7OF3lOeiL2cpfS22+kbJsWJw03D39tzeldMVm7++jl
+            GpmEn3onje0yxfU7+8OWAE7mv3rRlxGgF3aGj1CbPdJeAaLlY1TcWv2/QqsFRy8f
+            uxe9IOppZ8klQsQ8AjVWFv60QFrn/iKO0XGxtZ8wPUMXgJpPnBLFk+0cgYJ51+ou
+            fuwvmpkBdd18Rjmana6AlxY9L9TmQxORneugp9EL/A==
+            =nkDV
+            -----END PGP MESSAGE-----
+          fp: 65BD3044771CB6FB
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1

nixos/secrets/vouch.yaml

@@ -0,0 +1,67 @@
+vouch-client-secret: ENC[AES256_GCM,data:RWGjoC+L0FilUipBgvCy5t1bJEzDM8THc/m6RjwSPs9qPqfQCbSQWt/XXtQMR0VJ,iv:PJREZcXjLf3JVU4W5jD/6ruoaCIUV5TRocrmb1PjQeE=,tag:ZgKi+rI4ok7aIB3TOCXFKg==,type:str]
+vouch-jwt: ENC[AES256_GCM,data:7G1/pzEmR7NM7eFb2wED4HR/A00TNdBjBs/OdziDgIuPttqp4AeLRnJ0UhRps5taEx2cTH0U5GyCR/A9ef9hfA==,iv:ugOuH35frzoT6lX9UTJjzoTm2OTCqS3sNJGq8TfViEY=,tag:jvv4DkLwMB9ytefpGpIqPQ==,type:str]
+sops:
+    shamir_threshold: 1
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1a2quf2ekkj94ygu7wgvhrvh44fwn32c0l2cwvgvjh23wst90s54szdsvgr
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzL0tTSjhVYllWalFXUnNT
+            UCtKd1NFVzVmVUY5aGM5cksySVBIMm8rOHlJCjNRVGdSaGR1STNXV1o4Rm5jTFYv
+            eTRsYVNIZ2ZhdEttbXlwZjU3ZU9CSkUKLS0tIGFvUVN5Wjk3MFA2VkpmdUZXbFJI
+            N2FoUWZDMTVRZTk5MGdFeG5OR1JYMDAKBm/mP8HBEh9KeUAPSBNxgfAm3vTLDfRU
+            J4X9kPj6a+9dDkE0qT1R1ZplGeME7iekRN4xKNicXM/m/5pH+b3avg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age16klpkaut5759dut8mdm3jn0rnp8w6kxyvs9n6ntqrdsayjtd7upqlvw489
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtZ3NYYVovMUpFYXVHYWZK
+            ZGY5VElDeTZLSDI4cGIxbFhJS2E2RThtblRZClp3OUNlMjh2WFYxVXFNVDVSakpB
+            NXNzM3Jrb3gvelc3NkNQaUJMTzBXNUUKLS0tIEZSUGdMckIrQ0RRRHU3WGdnNElM
+            WVBNeWU5amtqMHNRalRPdzZGckhKalkKO6mgs/uRb8AzDHbYi+1XWCIhpbkg4xD9
+            UlR26e11EdUxs9VE1ja6RftkRr691Lv3HPwyF3DZZ0ZRdYsvQwQKTw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-01-16T19:11:11Z"
+    mac: ENC[AES256_GCM,data:1J3dCx5ptr2ah2LbvoP/rcUzPlzm3wZvpWLffIvh7PriNJ6vx2xj5fFK9s2AhIunxAaef0KJLzwzcfNwxEkJO3M6QSf0UUw3wopah1W3ZKLE2H/Z8bNncaNzSuh6QODbYShSG2yK4HmQApd8R9NfKlAHsDno+aRhuh7OYM7CaLI=,iv:KzMfJDJOqYm2epLM6Epd44aRoU7uJcusCl6m6/+cDtQ=,tag:tQ8MQ1NWey4E1dFu2YnOQw==,type:str]
+    pgp:
+        - created_at: "2024-01-16T19:11:06Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA82M54yws73UAQ/+OrL7IfM8S58MlFwx21plZ2Bl7lPBZ2n1rpM9F5sRiSO3
+            mlWC1YvOeeRLRgM2uZCusnZxDeKZ3wooNVmGWzdU+rdnGmo1hSoFQ8kU8qmB7GOI
+            IXG7lU/LJIP8fv2lubb996H8+x7Y/AiuOYjrb9r84T/HxFvgORjwyZsmqeAQPdVm
+            IRukbo6MuWgxl3BC9rDGzByofIQ928V7hqI7msRPawl5fGHTxw8Jt+6EIqMrHdtU
+            bx33qfI/GjWmV05/7KWP6H2pQENANXvQDRFxbLw58VqdDZD+DPl1opPoSO3i9a+a
+            5cxpojZlC9/jlTuk2CVPLP5N8Oj7XzDPzqxaM5uq/BtpjJ64RlJQ0yAZx8S1am4D
+            IK7DN4E64s/EdeUExMQl3fmFj+P5yjzU5mJ1p/G9ltyjj6tqu4iskHXqRbY4q4oG
+            1o67lISX8Kq32o3HJpy0POtIbOQqeXP0JbEMNA9pCkvId77KY1NuBX4Vv0rZELUC
+            QQXQ/sNjEzLK2fr/EJn3aud5RE0tVWEvVrV+6hSOQB98vhR7K3UtZb+6l8fb/dQk
+            J/lzWhOB8eDnsAbiaKsH8u9hfjXsds6RKYfXoyom92lCPh5/q/Pu5VRNHbvgcqwt
+            PUzGEgoZ0nLkzd8DBO61umxt6LGageo6MZupC/zw8rvbArmPHZMBoCREMNrYzKrS
+            XgHI+Dn5rYqfLoLfs73TddytnAgfe9Me7h58vEU+qJnIN5BUG4CxtVcLXifAAe0P
+            FbzN8X8rJSSHqHRYhUZHVFlQ0f9xJLgG/2zI/JWY59GW+/UZcarneKtWn0LGUPU=
+            =asyX
+            -----END PGP MESSAGE-----
+          fp: CD8CE78CB0B3BDD4
+        - created_at: "2024-01-16T19:11:06Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQEMA2W9MER3HLb7AQgAnS9gUv3czD3mojOfrTQvWa7nXw3Tc51fFdRylKxp7ryR
+            fDixF1qtnLe3kzsjM5eB8VobMq3cZoQUW6UrR94zyPobR2SDvne02lLC/YMiGqn+
+            xCLYHORCRKA0WrgzECJHBpFqwLo/yhvxdXpBcd5uV4CNvq/k5wLZt+rCxRvU2YfA
+            UsbR6V+iSwP2IaowY1J8bPO+Bv9fSRAHBDDa3VVPP7ZXXLwmBWsZU2PIh6sd3GOg
+            gz+YLOeWtkTW47Od1aM0qeHXEGBKeDfw2oMbhXi5fhMGRVN8z+dVL3KER8Gs9/Jc
+            sDcLg2p7bmcy90Ns3q4p+Ncu8K7p/dJL9X4eC2GU5dJeAY4IeCh5+J7ij75nWlY2
+            3OWb1pZZYd2FKgOX2zvJryq14wi3EW+9PZFGZuiEgKsis65gRsMUZiwdZZEQDnOm
+            5VDe9va5rNTMRpuG3Fid4VtMqxR29SfjKp/jOHAwsw==
+            =Ylpk
+            -----END PGP MESSAGE-----
+          fp: 65BD3044771CB6FB
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1

nixos/secrets/zigbee2mqtt.yaml

@@ -0,0 +1,67 @@
+z2m-pass: ENC[AES256_GCM,data:mN2xyzQ4OxNz4Y6dV3O6mw==,iv:LFRAbmWnialu47PPOOS0ilcmCUODP5lwYv8rDGrP83Y=,tag:fcnxuuB6itaE+WBjbSoFIQ==,type:str]
+z2m-secret: ENC[AES256_GCM,data:YQ3sFB0v5YI/Wm6dNCNpwSZ4aI8eSs6LQkSqw6PLv6690O/p0MQwlMFFp6r94JiRJhMVijxfNM1metWaWFGJ5R/qviuyffmXfgsP5jPwUdtwboDgJ9zapXddsr4tRNulxDLQqnuhZiu5aDbmZvQ=,iv:vCiYPpuylnY5TndlT/7eN1r9gXXmA5qXcvH5O0bCqdE=,tag:igFnHKQeFflxjnkLPdeKrg==,type:str]
+sops:
+    shamir_threshold: 1
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1a2quf2ekkj94ygu7wgvhrvh44fwn32c0l2cwvgvjh23wst90s54szdsvgr
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyYVd0bHpPcWx1cXNSQVFP
+            dUt3MHBvSDlET0xER251MHZNSFF0US95ZWw0CnFCM3c4LzVqWTA4OGN2QVVzVThU
+            S2ZZb1VpT2ExUWV1Nk0rUTJnbm8yOVEKLS0tIElKdDVRWFJvR3VXOHY1UkJFMXUz
+            VmttaWI3T20wMnRNVEQ2WFl6aktWMkEKjpKMwUJR0+Zg0+jMJuWudI1F/8pG3tr8
+            sDtfwcbtGxekfeiKhYywjXFykl3ACJqi9wEHvYElhIhIf+4du9YHuw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age16klpkaut5759dut8mdm3jn0rnp8w6kxyvs9n6ntqrdsayjtd7upqlvw489
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFR3cwUjQrcHp2Ulh1aUx0
+            aWJqcUdhbjd1Sms1RWFiQklqRUJhNGE3LzJFCkx6TkkxNjJEL1dRY3luWFQ4cFdV
+            L25EekFHd3BMU1V6a0tnSm1BbUxEdWMKLS0tIG02OFoxclVnczlJUk9pUzRURVMr
+            SncwMyt1REtCRjE2bzRTNEQzdm1lREkKuwjkWpzchiu+kxD0yhhPKLSUt3Ik58ab
+            UQ6TP42q68nt/iu4ZFA41ie3jTM93bQZESbKdnCm5uQBmrIPAiwH7Q==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-01-16T19:11:49Z"
+    mac: ENC[AES256_GCM,data:l1IxjLwcgzPL4zgYqs9lJvE6+/VkqKJZ6SHc7uz01fJFIP3TIyI0CsjCTev8hpMXCImFyZIa6XwdDd4bxXMO8UVGvdIjZF//Do4JhpTPYvem7qHf1Q754tgr7vPVOH9HcP/szL6QTGC7++9S5exOp8U1M1Vlzh+DFe/wLz12wAQ=,iv:TyaV/2/RoD5FwWufWi8N+xeWW4qmmgrzcETSdXfMGUs=,tag:KvL3wsDPbd5yY74x/oJL+Q==,type:str]
+    pgp:
+        - created_at: "2024-01-16T19:11:46Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA82M54yws73UAQ/+JnAXyGmqdZP8RvA1QebRDq0i8dRjOEfDSEGppZxVxbBJ
+            10HCWPWe36NneGs4mv77JZQDjYt+bPI8oXIp87EhhMVfZFfBDoI58jc39F86pmAR
+            sTupKwbuwGuEycnLteSAGRJIprJH9XkPJjHchLbGRTJQaDecahdhoH7PVMXiFICS
+            VzOtq22KDiCrgj055dtQFPQVG8cUD9epI5U1VZUk2UwkOuJ8lIlwrghO4rHmFAHg
+            oCtmvI/m9DdVKG+qo2iRd74CXwFa1eESgcdQ4RZl0+rZQJPLz4n6oWPjb/9JDaWq
+            DPytFYf9cDUZYHhv39L5Q0WOmwladMYTApVN+6IBQ0Gm9RqCkquODlngev4p7Pra
+            IhQiQCNb39LBQ6Tt7TuLMPp9KfJ0NUdEDkUDnCqHU4/qzIF6QaRfeyE9UxsNXjHu
+            QYLhVMX7iYxRNgr4CqAaiKbU03rRTzprJfZLDWI/udcFJa4QTtcoT5jn/SULghwS
+            shI43k0cT04LPB7TPC8VrhpWVoZGhqPuuoyrQ+SVvK9bC38CC5Ax8s6l6jPJrfu2
+            9S9+jldbstRkTQ2k/Nbo4QJEwSIRZeXIqmhDfFOe/DB0kcjAeI47ehjjHoQh7mlO
+            F+pdQcHkyFtSYAc08F5xoLEc0o22t9Pb3WiiHxKmzWFd36heeotAdIix6i4jF+fS
+            XgHSp4f31WxNu4SnYIBwV2CklLSdiOQn/uMC8jB11ZJ94OY9CJs6XXT55sAV+nKH
+            N8fsjrTP0BWlFhxQzATHgk+6TL9znPOygdlbgCCwPDFqzB7GNdhZ0ZBrOFZkZSg=
+            =WAK1
+            -----END PGP MESSAGE-----
+          fp: CD8CE78CB0B3BDD4
+        - created_at: "2024-01-16T19:11:46Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQEMA2W9MER3HLb7AQf/VSnitRF1sNE4x8R9YdOaVtbJo1EXnlazo6uVN3zf8imC
+            sB4wo/fjdE3DvQTG97KQVzuh/lAIWCSlvRSNGMlw0MFwo6awAZqHYTEW1AU/0k0r
+            tw0TjpYnqWEzXid1HW+M1SIAGpwmVOxlQGRfoLHtMzgdoRp6BRUPFJHKd+hAA1oR
+            ix1IC/YJleGQ2HePuvJ+XbeKUA42adKO3EhOAM+8dGCzGtraiFJhcGsrffcFhtB0
+            MQEGj7RT0IaiECp8t8zChZvPg0vkPFuwhFgIWFLmHjt24DY3JdBj6BeFaMfiYPPG
+            hKOqGK+ek6gmkmOivBiZGRPUls9ejXz1gN1yHMhwuNJeAcJ3iHdLuh/FC4blnjml
+            Ta9IFbuf6UDPF10XAN6L8SeBubFdolCc9rUwQu8oogw9mxu9rP+jt4f4Y3yVtl0m
+            eXpH0NYJMKBEkiGDsM8jpyCHJ8WPD3FX4KUxxjsLqA==
+            =Y61H
+            -----END PGP MESSAGE-----
+          fp: 65BD3044771CB6FB
+    unencrypted_suffix: _unencrypted
+    version: 3.8.1

nixos/syncplay.nix

@@ -15,7 +15,10 @@ with lib; let
     ]
     ++ optionals (cfg.certDir != null) ["--tls" cfg.certDir];
 in {
-  sops.secrets.syncplay-env.owner = cfg.user;
+  sops.secrets.syncplay-env = {
+    sopsFile = mkDefault ./secrets/syncplay.yaml;
+    owner = cfg.user;
+  };
 
   users.users.${cfg.user} = {
     inherit (cfg) group;

nixos/systemd2mqtt.nix

@@ -27,6 +27,9 @@ in {
   };
 
   sops.secrets = {
-    systemd2mqtt-env.owner = cfg.user;
+    systemd2mqtt-env = {
+      sopsFile = mkDefault ./secrets/systemd2mqtt.yaml;
+      owner = cfg.user;
+    };
   };
 }

nixos/vouch.nix

@@ -5,6 +5,7 @@
 }: let
   inherit (lib) mkDefault;
   cfg = config.services.vouch-proxy;
+  sopsFile = mkDefault ./secrets/vouch.yaml;
 in {
   services.vouch-proxy = {
     enable = mkDefault true;
@@ -21,7 +22,13 @@ in {
   };
 
   sops.secrets = {
-    vouch-jwt.owner = cfg.user;
-    vouch-client-secret.owner = cfg.user;
+    vouch-jwt = {
+      inherit sopsFile;
+      owner = cfg.user;
+    };
+    vouch-client-secret = {
+      inherit sopsFile;
+      owner = cfg.user;
+    };
   };
 }

nixos/zigbee2mqtt.nix

@@ -7,6 +7,7 @@
   inherit (lib) mkIf mkDefault;
 in {
   sops.secrets.z2m-secret = {
+    sopsFile = mkDefault ./secrets/zigbee2mqtt.yaml;
     owner = "zigbee2mqtt";
     path = "${cfg.dataDir}/secret.yaml";
   };