7 files changed, 11 insertions, 7 deletions
diff --git a/.git-crypt/.gitattributes b/.git-crypt/.gitattributes
new file mode 100644
index 0000000..665b10e
--- /dev/null
+++ b/.git-crypt/.gitattributes
@@ -0,0 +1,4 @@
+# Do not edit this file.  To specify the files to encrypt, create your own
+# .gitattributes file in the directory where your files are.
+* !filter !diff
+*.gpg binary
diff --git a/.git-crypt/keys/default/0/9B436B1477A879C26CDB6604C171251002C200F2.gpg b/.git-crypt/keys/default/0/9B436B1477A879C26CDB6604C171251002C200F2.gpg
new file mode 100644
index 0000000..cce14c8
--- /dev/null
+++ b/.git-crypt/keys/default/0/9B436B1477A879C26CDB6604C171251002C200F2.gpg
Binary files differdiff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..4887f4a
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1 @@
+private.nix filter=git-crypt diff=git-crypt
diff --git a/nix-conf/home/includes/common.nix b/nix-conf/home/includes/common.nix
index d3cb7c0..e4f08e8 100644
--- a/nix-conf/home/includes/common.nix
+++ b/nix-conf/home/includes/common.nix
@@ -59,6 +59,7 @@ in
     file
     fzf
     git
+    git-crypt
     gnupg
     gopass
     htop
diff --git a/nix-conf/home/includes/linux-server.nix b/nix-conf/home/includes/linux-server.nix
index 62233f0..d374942 100644
--- a/nix-conf/home/includes/linux-server.nix
+++ b/nix-conf/home/includes/linux-server.nix
@@ -7,7 +7,6 @@
     irssi
     libtree
     msmtp
-    pinentry
     restic
     sword
     yt-dlp
diff --git a/nix-conf/machines/djmuk2/configuration.nix b/nix-conf/machines/djmuk2/configuration.nix
index 0b31a01..b988dac 100644
--- a/nix-conf/machines/djmuk2/configuration.nix
+++ b/nix-conf/machines/djmuk2/configuration.nix
@@ -1,6 +1,9 @@
 { config, pkgs, ... }:
 {
-  imports = [ ./hardware-configuration.nix ];
+  imports = [
+    ./hardware-configuration.nix
+    ./private.nix
+  ];
 
   boot.tmp.cleanOnBoot = true;
   zramSwap.enable = true;
@@ -32,12 +35,8 @@
 
   services.locate.enable = true;
 
-  # Emulate nix-sops. Technically an anti-pattern, but this isn't a real secret, and this has to be embedded here, as we cannot set a file path to read it from.
-  # Populate/update with:
-  # SOPS_AGE_KEY=$(doas ssh-to-age -private-key -i /etc/ssh/ssh_host_ed25519_key) sops -d --extract '["openiscsi_name"]' machines/djmuk2/secrets.yaml | doas tee /root/.config/secrets/openiscsi_name
+  # services.openiscsi.name is in ./private.nix (encrypted with git-agecrypt)
   services.openiscsi.enable = true;
-  services.openiscsi.name = builtins.readFile "/root/.config/secrets/openiscsi_name";
-  #services.openiscsi.enableAutoLoginOut = true;
 
   users.users.djm = {
     isNormalUser = true;
diff --git a/nix-conf/machines/djmuk2/private.nix b/nix-conf/machines/djmuk2/private.nix
new file mode 100644
index 0000000..74e244a
--- /dev/null
+++ b/nix-conf/machines/djmuk2/private.nix
Binary files differ