secrets: list secrets used on host explicitly

hosts/boreal/default.nix

@@ -9,6 +9,8 @@
       ./hardware-configuration.nix
 
       ./home.nix
+
+      ./secrets.nix
     ];
 
   boot.kernelPackages = pkgs.linuxPackages_latest;

hosts/boreal/secrets.nix

@@ -0,0 +1,19 @@
+{ config, lib, options, ... }:
+
+{
+  config.age = {
+    secrets =
+      let
+        toSecret = name: { ... }@attrs: {
+          file = ./../../modules/secrets + "/${name}.age";
+        } // attrs;
+      in
+        lib.mapAttrs toSecret {
+          "restic-backup/boreal-credentials" = {};
+          "restic-backup/boreal-password" = {};
+
+          "users/alarsyo-hashed-password" = {};
+          "users/root-hashed-password" = {};
+        };
+  };
+}

hosts/zephyrus/default.nix

@@ -8,6 +8,7 @@
     [ # Include the results of the hardware scan.
       ./hardware-configuration.nix
       ./home.nix
+      ./secrets.nix
     ];
 
   boot.kernelPackages = pkgs.linuxPackages;

hosts/zephyrus/secrets.nix

@@ -0,0 +1,19 @@
+{ config, lib, options, ... }:
+
+{
+  config.age = {
+    secrets =
+      let
+        toSecret = name: { ... }@attrs: {
+          file = ./../../modules/secrets + "/${name}.age";
+        } // attrs;
+      in
+        lib.mapAttrs toSecret {
+          "restic-backup/zephyrus-credentials" = {};
+          "restic-backup/zephyrus-password" = {};
+
+          "users/alarsyo-hashed-password" = {};
+          "users/root-hashed-password" = {};
+        };
+  };
+}