{ ... }:

# sops-nix secret wiring (real host only; not imported by vm.nix).
# Encrypted values live in ../secrets/jupiter.yaml, decrypted at activation to
# /run/secrets/<name>. The host needs the age PRIVATE key at the keyFile path.
#
# Deploy the private key with the install, e.g. nixos-anywhere:
#   --extra-files, placing your key at /var/lib/sops-nix/key.txt
# or later derive a host age key from its ssh host key and add it to .sops.yaml.
{
  sops.defaultSopsFile = ../secrets/jupiter.yaml;
  sops.age.keyFile = "/var/lib/sops-nix/key.txt";

  # Decrypts to /run/secrets/samba_password (root-only by default).
  sops.secrets.samba_password = { };
}