7 files changed, 24 insertions, 32 deletions
diff --git a/nix-conf/flake.lock b/nix-conf/flake.lock
index 0f9a6b0..9972cf7 100644
--- a/nix-conf/flake.lock
+++ b/nix-conf/flake.lock
@@ -3,7 +3,7 @@
     "darwin-system-certs": {
       "flake": false,
       "locked": {
-        "lastModified": 1746337162,
+        "lastModified": 1752902012,
         "narHash": "sha256-nnYgKXmhL+DfaiQfk9y5fEZL+pDb7OuB9gsAo1JBv+Q=",
         "path": "/private/etc/ssl/cert.pem",
         "type": "path"
@@ -20,11 +20,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1753761827,
-        "narHash": "sha256-mrVNT+aF4yR8P8Fx570W2vz+LzukSlf68Yr2YhUJHjo=",
+        "lastModified": 1753983724,
+        "narHash": "sha256-2vlAOJv4lBrE+P1uOGhZ1symyjXTRdn/mz0tZ6faQcg=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "50adf8fcaa97c9d64309f2d507ed8be54ea23110",
+        "rev": "7035020a507ed616e2b20c61491ae3eaa8e5462c",
         "type": "github"
       },
       "original": {
@@ -77,11 +77,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1753429684,
-        "narHash": "sha256-9h7+4/53cSfQ/uA3pSvCaBepmZaz/dLlLVJnbQ+SJjk=",
+        "lastModified": 1753939845,
+        "narHash": "sha256-K2ViRJfdVGE8tpJejs8Qpvvejks1+A4GQej/lBk5y7I=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "7fd36ee82c0275fb545775cc5e4d30542899511d",
+        "rev": "94def634a20494ee057c76998843c015909d6311",
         "type": "github"
       },
       "original": {
@@ -93,11 +93,11 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1753489912,
-        "narHash": "sha256-uDCFHeXdRIgJpYmtcUxGEsZ+hYlLPBhR83fdU+vbC1s=",
+        "lastModified": 1753749649,
+        "narHash": "sha256-+jkEZxs7bfOKfBIk430K+tK9IvXlwzqQQnppC2ZKFj4=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "13e8d35b7d6028b7198f8186bc0347c6abaa2701",
+        "rev": "1f08a4df998e21f4e8be8fb6fbf61d11a1a5076a",
         "type": "github"
       },
       "original": {
diff --git a/nix-conf/home/includes/common.nix b/nix-conf/home/includes/common.nix
index d3cb7c0..e4f08e8 100644
--- a/nix-conf/home/includes/common.nix
+++ b/nix-conf/home/includes/common.nix
@@ -59,6 +59,7 @@ in
     file
     fzf
     git
+    git-crypt
     gnupg
     gopass
     htop
diff --git a/nix-conf/home/includes/linux-server.nix b/nix-conf/home/includes/linux-server.nix
index 62233f0..d374942 100644
--- a/nix-conf/home/includes/linux-server.nix
+++ b/nix-conf/home/includes/linux-server.nix
@@ -7,7 +7,6 @@
     irssi
     libtree
     msmtp
-    pinentry
     restic
     sword
     yt-dlp
diff --git a/nix-conf/machines/djmuk2/configuration.nix b/nix-conf/machines/djmuk2/configuration.nix
index 0b31a01..b988dac 100644
--- a/nix-conf/machines/djmuk2/configuration.nix
+++ b/nix-conf/machines/djmuk2/configuration.nix
@@ -1,6 +1,9 @@
 { config, pkgs, ... }:
 {
-  imports = [ ./hardware-configuration.nix ];
+  imports = [
+    ./hardware-configuration.nix
+    ./private.nix
+  ];
 
   boot.tmp.cleanOnBoot = true;
   zramSwap.enable = true;
@@ -32,12 +35,8 @@
 
   services.locate.enable = true;
 
-  # Emulate nix-sops. Technically an anti-pattern, but this isn't a real secret, and this has to be embedded here, as we cannot set a file path to read it from.
-  # Populate/update with:
-  # SOPS_AGE_KEY=$(doas ssh-to-age -private-key -i /etc/ssh/ssh_host_ed25519_key) sops -d --extract '["openiscsi_name"]' machines/djmuk2/secrets.yaml | doas tee /root/.config/secrets/openiscsi_name
+  # services.openiscsi.name is in ./private.nix (encrypted with git-agecrypt)
   services.openiscsi.enable = true;
-  services.openiscsi.name = builtins.readFile "/root/.config/secrets/openiscsi_name";
-  #services.openiscsi.enableAutoLoginOut = true;
 
   users.users.djm = {
     isNormalUser = true;
diff --git a/nix-conf/machines/djmuk2/private.nix b/nix-conf/machines/djmuk2/private.nix
new file mode 100644
index 0000000..74e244a
--- /dev/null
+++ b/nix-conf/machines/djmuk2/private.nix
Binary files differdiff --git a/nix-conf/machines/edrahil/network-configuration.nix b/nix-conf/machines/edrahil/network-configuration.nix
index 4b85912..16df081 100644
--- a/nix-conf/machines/edrahil/network-configuration.nix
+++ b/nix-conf/machines/edrahil/network-configuration.nix
@@ -1,19 +1,12 @@
 { ... }:
 {
-  networking = {
-    interfaces.ens3.ipv6.addresses = [
-      {
-        # Emulate nix-sops. Technically an anti-pattern, but IP addresses aren't real secrets, and this has to be embedded here,
-        # as we cannot set a file path to read it from.
-        # Populate/update with:
-        # SOPS_AGE_KEY=$(doas ssh-to-age -private-key -i /etc/ssh/ssh_host_ed25519_key) sops -d --extract '["ipv6_address"]' machines/edrahil/secrets.yaml | doas tee /root/.config/secrets/ipv6_address
-        address = builtins.readFile "/root/.config/secrets/ipv6_address";
-        prefixLength = 64;
-      }
-    ];
-    defaultGateway6 = {
-      address = "fe80::1";
-      interface = "ens3";
-    };
+  imports = [
+    ./private.nix
+  ];
+
+  # networking.interfaces.ens3.ipv6.addresses configured in private.nix
+  networking.defaultGateway6 = {
+    address = "fe80::1";
+    interface = "ens3";
   };
 }
diff --git a/nix-conf/machines/edrahil/private.nix b/nix-conf/machines/edrahil/private.nix
new file mode 100644
index 0000000..c5941c6
--- /dev/null
+++ b/nix-conf/machines/edrahil/private.nix
Binary files differ