From 62955d98e5b411ef5aa75e924a4e04e9d05e70ea Mon Sep 17 00:00:00 2001
From: Leonhard Kost <leonhard.kost@gmail.com>
Date: Mon, 23 Feb 2026 15:46:48 +0100
Subject: [PATCH] feat: use git-crypt for secret config that is ok to be in the
 nix store

---
 .gitattributes                         |   1 +
 nixos/server/default.nix               |   3 ---
 nixos/server/secrets/default.nix       |   4 ++++
 nixos/server/secrets/secret-config.nix | Bin 0 -> 208 bytes
 4 files changed, 5 insertions(+), 3 deletions(-)
 create mode 100644 .gitattributes
 create mode 100644 nixos/server/secrets/secret-config.nix

diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..155ce01
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1 @@
+secret-config.nix filter=git-crypt diff=git-crypt
diff --git a/nixos/server/default.nix b/nixos/server/default.nix
index ff90efa..ae70be7 100644
--- a/nixos/server/default.nix
+++ b/nixos/server/default.nix
@@ -10,9 +10,6 @@
   ];
 
   kekleo.graphical = false;
-  kekleo.publicKeys = [
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOsLFjdS9JEcgBPa6NvOzpJp8coJPJwJFuM+PQCZ8brl leonhard"
-  ];
 
   users.users.leonhard = {
     initialPassword = "leonhard";
diff --git a/nixos/server/secrets/default.nix b/nixos/server/secrets/default.nix
index 0352720..aabd0da 100644
--- a/nixos/server/secrets/default.nix
+++ b/nixos/server/secrets/default.nix
@@ -3,6 +3,10 @@
   ...
 }:
 {
+  imports = [
+    ./secret-config.nix
+  ];
+
   sops.secrets.dyndns = {
     format = "dotenv";
     sopsFile = ./dyndns.env;
diff --git a/nixos/server/secrets/secret-config.nix b/nixos/server/secrets/secret-config.nix
new file mode 100644
index 0000000000000000000000000000000000000000..9956c539f561d5e7c1f8a03f685ccd1895bada19
GIT binary patch
literal 208
zcmZQ@_Y83kiVO&0xH&OQKTvk|x|iQ>oteC-!<7B%`(xkgo~6}s@s!;P?#$W}JH<xF
zVT+~R)>~o6(+@Q%i87yeEd0LX$x*IDkBuW(H}&cLW!m5TBDg>8mOJm_SAW8<zWQ-A
z@WB<?oO7M4o&35EESwT{yz9V=C;zQ4p1j1PdTW=8VOGVh^s@X_N1|(wdxR@T%1pkY
zZ`E11kMYW@cE8^f6n-A+Ntjj3{L)Pz<m{@-e7%BsRT=Z0WXrkq4u6Vp{x9%g!IsNg
SU3u*Ho9TQA?3-ZJQwIRm_-Ql%

literal 0
HcmV?d00001