{ config, ... }:

# sops-nix configuration.
# Secrets are encrypted to two recipients:
#   1. Your personal age key (derived from your SSH ed25519 key via ssh-to-age)
#   2. This host's age key (derived from /etc/ssh/ssh_host_ed25519_key at boot)
#
# The host key path below is where sops-nix looks by default when
# services.openssh generates the host key.
{
  sops = {
    defaultSopsFile = ../secrets/secrets.yaml;
    defaultSopsFormat = "yaml";

    # Derive the machine's age key from its SSH ed25519 host key.
    # This key is auto-generated by OpenSSH on first boot and stays stable.
    age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];

    secrets = {
      # Miniflux admin credentials file (ADMIN_USERNAME=... ADMIN_PASSWORD=...)
      "miniflux/admin" = {
        owner = "miniflux";
        group = "miniflux";
        mode = "0400";
      };

      # AdGuard Home admin password bcrypt hash
      # Format: plain string containing only the bcrypt hash
      "adguard/password_hash" = {
        owner = "adguardhome";
        group = "adguardhome";
        mode = "0400";
        restartUnits = [ "adguardhome.service" ];
      };
    };
  };
}