feat: use sops-nix bc it has better docs than agenix and git-crypt still leaks to the store

.gitattributes

@@ -1 +0,0 @@
-*.secret filter=git-crypt diff=git-crypt

.sops.yaml

@@ -0,0 +1,7 @@
+keys:
+  - &server age1cma8j2jk0jmzgttjmqn06l87u4as9k46yzmvetflzqp995wzdsgsjppacx
+creation_rules:
+  - path_regex: secrets/[^/]+\.(yaml|json|env|ini)$
+    key_groups:
+    - age:
+      - *server

flake.lock

@@ -172,7 +172,28 @@
         "home-manager": "home-manager",
         "nixpkgs": "nixpkgs",
         "nixpkgs-unstable": "nixpkgs-unstable",
-        "nixvim": "nixvim"
+        "nixvim": "nixvim",
+        "sops-nix": "sops-nix"
+      }
+    },
+    "sops-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1770683991,
+        "narHash": "sha256-xVfPvXDf9QN3Eh9dV+Lw6IkWG42KSuQ1u2260HKvpnc=",
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "rev": "8b89f44c2cc4581e402111d928869fe7ba9f7033",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "type": "github"
       }
     },
     "systems": {

flake.nix

@@ -8,6 +8,9 @@
 
     nixvim.url = "github:nix-community/nixvim/nixos-25.11";
     nixvim.inputs.nixpkgs.follows = "nixpkgs";
+
+    sops-nix.url = "github:Mic92/sops-nix";
+    sops-nix.inputs.nixpkgs.follows = "nixpkgs";
   };
 
   outputs =

nixos/server/default.nix

@@ -9,6 +9,8 @@
     (import ../base.nix { inherit inputs outputs; })
     ./hardware-configuration.nix
     ./config.nix
+    inputs.sops-nix.nixosModules.sops
+    ./secrets
     ./dyndns
   ];
 

nixos/server/dyndns/default.nix

@@ -1,4 +1,5 @@
 {
+  config,
   pkgs,
   ...
 }:
@@ -28,7 +29,7 @@ in
       Type = "oneshot";
       User = "dyndns";
       ExecStart = "${pyenv.interpreter} ${./dyndns.py}";
-      EnvironmentFile = ./. + "/nc.env.secret";
+      EnvironmentFile = config.sops.secrets.dyndns.path;
     };
   };
 }

nixos/server/secrets/default.nix

@@ -0,0 +1,12 @@
+{
+  config,
+  ...
+}:
+{
+  sops.secrets.dyndns = {
+    format = "dotenv";
+    sopsFile = ./dyndns.env;
+    mode = "0400";
+    owner = config.systemd.services.dyndns.serviceConfig.User;
+  };
+}

nixos/server/secrets/dyndns.env

@@ -0,0 +1,10 @@
+NC_DOMAIN=ENC[AES256_GCM,data:q4yNX+QAzptwBo82PWL2XlJmaV4PL8o=,iv:09/3DcXAH9/86dPyblRfbc3ILuUmUzgRUjX0KIuQmOU=,tag:N3Ad0vfuz2Li9pra7laEpA==,type:str]
+NC_CUSTOMER=ENC[AES256_GCM,data:tqi91SnB,iv:OGwGNi298lHvcTuOi9tavb3Z+td7XzEk8A73tvRbQew=,tag:ivXW4uCirxja5PIZaGc/HA==,type:str]
+NC_API_PASSWORD=ENC[AES256_GCM,data:PJ/ppYER5nXAJTUD+eD2BS8jwuqLrb6dXfc5lfhL8vzYeCCvmRyTrvsfMLYFA8rC1VQ=,iv:3LsvJoPuq7YSKK93YNDBFmJmSaNF9VMPmAhL9mr5vjI=,tag:OozQp5V+A2ZsBll94vQtpw==,type:str]
+NC_API_KEY=ENC[AES256_GCM,data:LzfK825771pwYAoHEzaDh+5D9LyA29e3Jq9SLZTaCCtHz98r8uIhwZpWCFWU3hfU+xw=,iv:yAo1/DiSbl5T49X6EWlbhdYTOcZwuDw3AFlVbj/KlrM=,tag:sW1ahTqAcekhhv+5ctefUg==,type:str]
+sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOOFdSQnlXODBHMlIvRjNK\nQUN6N0Z5b2tZZWk0elZHWXZZSlk3YkEzOTJ3CkdIWmg0dFpCdkQ2ek4wRllHeUpE\nQUpXWHhSRG9aeHAvamJLeGQvUnFUYjQKLS0tIGdsNG5WMDVvbEl2NnU0OGpkMTF1\nTGdaVGhBaEJ1bGNNZi9ReUI0TmJaMXMKE5Zg7MwjkKHSNceY3kRomMAgqXnN2slq\ndGM1s1MVZ83x3AdKTxCfhPXOqHCTgdpHpvvCq+EqntB2Tze/SVApSw==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_0__map_recipient=age1cma8j2jk0jmzgttjmqn06l87u4as9k46yzmvetflzqp995wzdsgsjppacx
+sops_lastmodified=2026-02-12T09:56:38Z
+sops_mac=ENC[AES256_GCM,data:sixevaa0DdTDFqYkCT6giO/OjOeI3Z4OWP10zXazHoiRODXMnU4O4CwfHvzPbD0z0lLCUNe1lF9vCQgQhhxw09Ose3XOZXspcdO95aea+705cgA9uSAxA5Sms7eFGdhWFAHaOYI/Up9OYFtzDO2CJN4XYY9IinnkfEwlpoXog3g=,iv:NRUGvsOYhB6t1qgvaiXvam91jUOOgvirmJ+Exuldmhc=,tag:Uo4+n5umEHGpszz4B8p8+w==,type:str]
+sops_unencrypted_suffix=_unencrypted
+sops_version=3.11.0