.git-crypt/.gitattributes

@@ -0,0 +1,4 @@
+# Do not edit this file.  To specify the files to encrypt, create your own
+# .gitattributes file in the directory where your files are.
+* !filter !diff
+*.gpg binary

.gitattributes

@@ -0,0 +1,3 @@
+secrets/**/*.secret filter=git-crypt diff=git-crypt
+secrets/matrix-email-config.nix filter=git-crypt diff=git-crypt
+home/secrets/*.secret filter=git-crypt diff=git-crypt

boreal.nix

@@ -10,6 +10,9 @@
     # Service definitions
     ./services
 
+    # Configuration secrets
+    ./secrets
+
     # Host-specific config
     ./hosts/boreal
   ];

poseidon.nix

@@ -11,6 +11,9 @@
     # Service definitions
     ./services
 
+    # Configuration secrets
+    ./secrets
+
     # Host-specific config
     ./hosts/poseidon
   ];

secrets/default.nix

@@ -0,0 +1,14 @@
+{ pkgs, lib, config, ... }:
+let
+  inherit (lib)
+    fileContents
+    mkOption
+  ;
+in {
+  options.my.secrets = let inherit (lib) types; in mkOption {
+    type = types.attrs;
+  };
+
+  config.my.secrets = {
+  };
+}