Secret management via sops-nix.

common/global/default.nix

@@ -10,6 +10,7 @@
     ./nix.nix
     ./packages.nix
     ./show-changelog.nix
+    ./sops.nix
     ./sudo.nix
     ./tailscale.nix
   ];

common/global/packages.nix

@@ -1,9 +1,12 @@
 { pkgs, ... }:
 {
   environment.systemPackages = with pkgs; [
+    age
     file
     lm_sensors # TODO: this shouldn't be installed on cloud nodes
     nodejs_20 # TODO: this is for one job on nomad, it should just be a dependency there
     neovim
+    sops
+    ssh-to-age
   ];
 }

common/global/sops.nix

@@ -0,0 +1,5 @@
+{
+  sops = {
+    defaultSopsFile = ./../../secrets/secrets.yaml;
+  };
+}