feat: remove agenix and use git-crypt instead

flake.lock

@@ -1,50 +1,5 @@
 {
   "nodes": {
-    "agenix": {
-      "inputs": {
-        "darwin": "darwin",
-        "home-manager": "home-manager",
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "systems": "systems"
-      },
-      "locked": {
-        "lastModified": 1770165109,
-        "narHash": "sha256-9VnK6Oqai65puVJ4WYtCTvlJeXxMzAp/69HhQuTdl/I=",
-        "owner": "ryantm",
-        "repo": "agenix",
-        "rev": "b027ee29d959fda4b60b57566d64c98a202e0feb",
-        "type": "github"
-      },
-      "original": {
-        "owner": "ryantm",
-        "repo": "agenix",
-        "type": "github"
-      }
-    },
-    "darwin": {
-      "inputs": {
-        "nixpkgs": [
-          "agenix",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1744478979,
-        "narHash": "sha256-dyN+teG9G82G+m+PX/aSAagkC+vUv0SgUw3XkPhQodQ=",
-        "owner": "lnl7",
-        "repo": "nix-darwin",
-        "rev": "43975d782b418ebf4969e9ccba82466728c2851b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "lnl7",
-        "ref": "master",
-        "repo": "nix-darwin",
-        "type": "github"
-      }
-    },
     "flake-parts": {
       "inputs": {
         "nixpkgs-lib": [
@@ -68,7 +23,7 @@
     },
     "flake-utils": {
       "inputs": {
-        "systems": "systems_2"
+        "systems": "systems"
       },
       "locked": {
         "lastModified": 1731533236,
@@ -85,27 +40,6 @@
       }
     },
     "home-manager": {
-      "inputs": {
-        "nixpkgs": [
-          "agenix",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1745494811,
-        "narHash": "sha256-YZCh2o9Ua1n9uCvrvi5pRxtuVNml8X2a03qIFfRKpFs=",
-        "owner": "nix-community",
-        "repo": "home-manager",
-        "rev": "abfad3d2958c9e6300a883bd443512c55dfeb1be",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "home-manager",
-        "type": "github"
-      }
-    },
-    "home-manager_2": {
       "inputs": {
         "nixpkgs": [
           "nixpkgs"
@@ -193,7 +127,7 @@
           "nixpkgs"
         ],
         "nuschtosSearch": "nuschtosSearch",
-        "systems": "systems_3"
+        "systems": "systems_2"
       },
       "locked": {
         "lastModified": 1767448089,
@@ -235,8 +169,7 @@
     },
     "root": {
       "inputs": {
-        "agenix": "agenix",
+        "home-manager": "home-manager",
-        "home-manager": "home-manager_2",
         "nixpkgs": "nixpkgs",
         "nixpkgs-unstable": "nixpkgs-unstable",
         "nixvim": "nixvim"
@@ -271,21 +204,6 @@
         "repo": "default",
         "type": "github"
       }
-    },
-    "systems_3": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
     }
   },
   "root": "root",

flake.nix

@@ -8,9 +8,6 @@
 
     nixvim.url = "github:nix-community/nixvim/nixos-25.11";
     nixvim.inputs.nixpkgs.follows = "nixpkgs";
-
-    agenix.url = "github:ryantm/agenix";
-    agenix.inputs.nixpkgs.follows = "nixpkgs";
   };
 
   outputs =

nixos/server/default.nix

@@ -8,9 +8,7 @@
   imports = [
     (import ../base.nix { inherit inputs outputs; })
     ./hardware-configuration.nix
-    inputs.agenix.nixosModules.default
+    ./dyndns
-    ./secrets
-    ./dyndns.nix
   ];
 
   users.users = {

nixos/server/dyndns.py

@@ -1,26 +0,0 @@
-from nc_dnsapi import Client
-import os, urllib3
-
-customer = os.environ["NC_CUSTOMER"]
-api_password = os.environ["NC_API_PASSWORD"]
-api_key = os.environ["NC_API_KEY"]
-domain = os.environ["NC_DOMAIN"]
-
-ip = urllib3.request("GET", "https://api.ipify.org").data.decode("ascii")
-
-with Client(customer, api_key, api_password) as api:
-    to_be_updated = []
-    records = api.dns_records(domain)
-
-    for record in records:
-        if record.type in ["A", "AAAA"] and record.destination != ip:
-            record.destination = ip
-            to_be_updated.append(record)
-
-
-    api.update_dns_records(domain, to_be_updated)
-
-    zone = api.dns_zone(domain)
-    if zone.ttl != 300:
-        zone.ttl = 300
-        api.update_dns_zone(domain, zone)

nixos/server/dyndns/default.nix

@@ -1,10 +1,14 @@
 {
-  config,
   pkgs,
   ...
 }:
 let
-  pyenv = pkgs.python3.withPackages (ps: with ps; [ nc-dnsapi ]);
+  pyenv = pkgs.python3.withPackages (
+    ps: with ps; [
+      nc-dnsapi
+      python-dotenv
+    ]
+  );
 in
 {
   users.groups.dyndns = { };
@@ -25,16 +29,10 @@ in
   };
 
   systemd.services."dyndns" = {
-    script = ''
-      NC_CUSTOMER=${"$(cat " + config.age.secrets.nc_customer.path + ")"} \
-      NC_API_PASSWORD=${"$(cat " + config.age.secrets.nc_api_password.path + ")"} \
-      NC_API_KEY=${"$(cat " + config.age.secrets.nc_api_key.path + ")"} \
-      NC_DOMAIN=${"$(cat " + config.age.secrets.nc_domain.path + ")"} \
-      ${pyenv.interpreter} ${./dyndns.py}
-    '';
     serviceConfig = {
       Type = "oneshot";
       User = "dyndns";
+      ExecStart = "${pyenv.interpreter} ${./dyndns.py} ${./nc.env.secret}";
     };
   };
 }

nixos/server/dyndns/dyndns.py

@@ -0,0 +1,33 @@
+from nc_dnsapi import Client
+from dotenv import dotenv_values
+import sys, urllib3
+
+if len(sys.argv) != 2:
+    raise Exception("Something funky is going on with argv")
+
+dotenv_path = sys.argv[1]
+secrets = dotenv_values(dotenv_path)
+
+CUSTOMER = secrets["NC_CUSTOMER"]
+API_PASSWORD = secrets["NC_API_PASSWORD"]
+API_KEY = secrets["NC_API_KEY"]
+DOMAIN = secrets["NC_DOMAIN"]
+
+ip = urllib3.request("GET", "https://api.ipify.org").data.decode()
+
+with Client(CUSTOMER, API_KEY, API_PASSWORD) as api:
+    to_be_updated = []
+    records = api.dns_records(DOMAIN)
+
+    for record in records:
+        if record.type in ["A", "AAAA"] and record.destination != ip:
+            record.destination = ip
+            to_be_updated.append(record)
+
+
+    api.update_dns_records(DOMAIN, to_be_updated)
+
+    zone = api.dns_zone(DOMAIN)
+    if zone.ttl != 300:
+        zone.ttl = 300
+        api.update_dns_zone(DOMAIN, zone)

nixos/server/secrets/default.nix

@@ -1,18 +0,0 @@
-{
-  age.secrets.nc_customer = {
-    file = ./nc_customer.age;
-    owner = "dyndns";
-  };
-  age.secrets.nc_api_password = {
-    file = ./nc_api_password.age;
-    owner = "dyndns";
-  };
-  age.secrets.nc_api_key = {
-    file = ./nc_api_key.age;
-    owner = "dyndns";
-  };
-  age.secrets.nc_domain = {
-    file = ./nc_domain.age;
-    owner = "dyndns";
-  };
-}

nixos/server/secrets/nc_api_key.age

@@ -1,18 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 RiiDcg hRxnpXLZ3iWII4uhNkKYnNcG1xmTagGOoq1H3Qre2Bk
-wdXkpq3QTSZkp4TKS9Yhe4Nl8kxTnXqbAEhniI6W2Mg
--> ssh-rsa t41wew
-N0NqSos7sbCZNlcCWx50DLkF5uaRgITie49w56Ppml2AzVCSOqj1VtmHj6Hudc4J
-8L65vAFp1y9L1WZELTk9p/XlnRPxvixxW5loiz7DCVVSYR9QoyJXdejlv+Sek3O6
-8zkroUZrb3Uw2EP+YnyDM3V3mg112VZJuMu1RyVVJ6HUFn1jUKrrnftbcD6HZ+g1
-ajM4m3EC3XDXecGj+i9/7BQooU5wVEO+Nyro3SWe3VyFJyImeUc/Wi5BVSB3Jr4V
-fm3ffD4dfF9lottl4+oH0u7itNZekMk57FWpM+a6+QXjxXpQiL8LPz8cOfjdenAq
-wVHWpnW1l8ZdgZcN6PGlJ/UkBqiWJHWJtdgqc/y5rVNlfhP6BXBh53IAAYqFBkAj
-BIbD4tq0xMxtE+3kYdjzzb92+yYUC+A13RddDdjdTC+biekbklDkkJOscatyWMtM
-uzPsVUuP5YjXmfiYWIyosh++AO46vCjdjuYFtB28YYUBsWeQsJdOGsFRWDoQRgIt
-wnf5RbZH23AySDYg3xgRsL3JVmnHJwPg6u6FmmQEJ+FvxJLBchI4Llh7uI9N2Pep
-VRgMlhQnvzdVqoPcVnXc21WV59fXmueN/BuUuAU8TnhX/TGp8Qi2z9VjFc2DIcFd
-A6NsX7IR2lKflRBipMmCCvVHNHyKtqwQu/UoCdfw2sA
---- gQ6FWeE76Cmb4A6OBfCi5vAOpopjzFOq8OH4kBveU/M
-ø“ {(ͼº|ŽØç|Ÿ)-:÷¡[%VqÂíp6~]ÔC
-ó'ªE␍Ül2B;öÂ3¹ ƒë¾“.òúhë?³‘PØ4|y»½&ŘŠ¢"³%Ó

nixos/server/secrets/nc_api_password.age

@@ -1,17 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 RiiDcg MTldmhXjTeOVN+dDo5kEZ/8Lre0HXyYnbazJYPSr2R0
-kxj9013CGLFxOd9YJ+JDGyCF+dHQiy+z/vcNglGh3HA
--> ssh-rsa t41wew
-h0tDDdK/+F9/jg7+yxHI8raLlJReUnjroJT3WekKRxXbjbxdOfdpGfmF2g7ul+JF
-jPSIzJONiZu33W0+qrdph1fL2crYf6dGcuwU62RLqdOO3D3gaUgaFQoZDUdT0nPh
-OvgmBIBSyReydQGP+poLE7kLQX7XL02ct43PxWZCjMEuw+TmG3FY2gsk8rENXiB5
-SGd/TnD57L1jAgMt1fb7E0w365eSlG+1Nw4N9scPuDNDqmEi4fuSpk/SNjCL2z/O
-mjPmN2rfRTtUj12+kHyQdLfM2RucenAStI1FqNyQiPO2LK2uvl9poZLk4nVBCj2z
-eNm5i6n9rnLo66e3UM4kh02++yMqsaRRVOf4hhNhv9kqO0AnWy5uAI988iHmc06H
-9Bo1bUnRHVeqwp8iKwXc/8r+JCIcwCZD8e+tzmtEWf8B6jZehzqgzET2MqexzS/x
-zTn/vnU4hPoO/mSqtWsjT3W4/Evek8PP535VTvSbvpxDwd7+MaUQ/LfUvfqVBaqO
-wLucJvSz1xgQWJV7D9Ek4OcLwdLMA3DUYIXwdwBUmXWS+oQFUZiTWtPBmEep7Uaq
-HJWNHUAliy2bKxhXp+D6iwPSrxwvPHidc769DNsvA98fm9fnj/ErRL+me1qx92VA
-hQk7UGEOvoJBmlosgEuI/XCRWVCwYFveU/9HB9qsOo4
---- fuxhbcDgkVq0k+8Es9YeK/0ukAzpy9fuCUNjcPyKOcU
-­[š¤n¯Ð“Y‘…¿ö]Ô¦\;&‰�ê!Áã&étJ^	ÂFtlÞÿk
—Ônç�X¡X¢¿’ÜÊÀg"¶S¹‰W�à^Ýß«?©ŠÉk[QóyéÝ

nixos/server/secrets/nc_customer.age

@@ -1,17 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 RiiDcg HVCrbHY3WjXrBvurhoOSerSfIQotTmvkacvVQeRdBQo
-WmgqeMWjWpP8qt1DZ9SS9ZTP7TD9DbXsXKr14/uPOJA
--> ssh-rsa t41wew
-QEejaG5G77mn4EA6rq0Ha9sJtfdNk+AUhgBJLqtVDE1MlygAf2w6jaXMDCBDhBM1
-nDidFNAKNmF1GmFK0hBX4TJ+7vk2buMpJ7nU99xBypDsBqpOhWlaoc+gTtT+HsUF
-B+4THp2e2UfAoWc4jhD5f43rXuxxzhOAfOjVj6Ll2nHvd+J/iw2vZ5d/2vM6DO0z
-JDRmwwIzSZlGChVEytgrjYpcPBH9nEc0ekvaRooUMa85r2C6AM+rx1G1nWgtVQt+
-xApOHDrhKe83rEMk+FzlOTKkpkW2NmHk/7jH2915eTZRhuu6tib6DZqJW8tgwvTT
-Fu7ddhvXTX3m4DqE/fCC8UNsb5MzZwxflohOZUh+MO3cljiGwjUPIjzntcZDd8Xi
-cm5CJ0fMuSqIJhRGXi4vVmZHNznCsqRs1QahsmEHk/iavGJwgAZFX6VDtW1sI9Vc
-cEPBjnguOPumJbKgwvEGEvBvKgxCJnTV7c0NhDc6JTAky+tW71aq4xSkgt3ngy8x
-W4u/n5kggNKGAI2ySrMo1ESgKQ8tiqWeirqvFYnfv2wStYaDKm0/BSpPFyf3dMfJ
-Fz0vU4gFD8HqdRiZnAKdzxS5pxdsS4G4S7eyPm1tjZQ7O3skXNV3dZvRPOdgIImU
-PtQWuGGXr35gwiy942O7gepQucwxq4z/ScoMrwWq2uk
---- 5hI4M+ZmygSiQf6yb1x+xNCACNa0DioQ68GltD4II/k
-’v']¿³šë4Â;X.Ý•(pR»è+hZÅì½�ù»@!KJP¼�

nixos/server/secrets/nc_domain.age

@@ -1,17 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 RiiDcg JineodD1i5o56Z5gMieXLqfI31mltwwNYgW/F+Dyoy8
-mjASjjLWIjKcmZlZYAnLX5qewbz0xU798cBNeUtygjY
--> ssh-rsa t41wew
-H/4HrD8Cw6A7NrXgslzYbm+okXjY5PslDFQXtchQ4J4ZDp7upOZVyiSOHDkT3/XU
-zjKXSPaS3HkM/OilwG+sFufS3UUKiFsSInmQyYieztBwLTrjBCnLfEsh+y/JM/DF
-EMiiuZ6dAMT0HbRamFYh0E5XMyrRuMgngvDrjkFnYsWWCGPwT5jzNjf19p+dAX6g
-7svxMaQEkAgA0jZU16MGG0i31L8SRKkSPadGh3EqoFMw/fg/ECjK27WVonj+UMM9
-SHq/Ahu6eYOIf69Ayk5P/iyi4hyDpNXXCBd2TigSZmedhkx6mH/PVR5LwAHYcNQQ
-VKroeDCHhO4C6lKQ0M0xvhj/lgoBMd+Tp03aL5RohqGnrkQNIppY5vsXcKWolcvB
-cC8OGu+fu2NBSDNALCDwbglzs3TLLk7GbqWYltqpzbzX7fi+CE5lxkG8ecsygMpY
-jXLggB2R5rgtjYti/56ux7DLuRVAY9FoYZOt9+PJRj45YnwS2Z1Er/A5TejC4TuL
-VcYMVyt8D8PjmbEefZWbvT4eYAWgZFqIUwGTGD+qKWY1iiA1kruebOoMeyUxM3ow
-9aZglWA378kwbSCRyGrMPjV8UzIPoQmrzqqjF5Ow6GGLvEuw3DRoLC2aTH3ZfY1k
-u9K8j29Nl3Sj/hBFPSnW0YR05diMZbWFrybhQQ9x3HM
---- O4TEPeHph/lRMujfo8YPF6d6EjJpDd+BBNtlWGfQWQI
-_N¶[,`E�,ãÊFyÉT¶J"¼§bXCõF
m€TËg&J5z æ�”Ĉ�ì␍
¹£¢