refactor cachix secrets

each of these are only used on single host so they don't need to be shared

.sops.yaml

@@ -108,7 +108,7 @@ creation_rules:
           - *zimbatm
           - *zowoq
           - *adisbladis
-  - path_regex: modules/nixos/(cachix|hercules-ci)/.+\.yaml$
+  - path_regex: modules/nixos/hercules-ci/.+\.yaml$
     key_groups:
       - age:
           - *build02

flake.nix

@@ -171,7 +171,7 @@
           nur-update = ./modules/nixos/nur-update.nix;
           remote-builder = ./modules/nixos/remote-builder.nix;
           remote-workers = ./modules/nixos/remote-workers.nix;
-          watch-store = ./modules/nixos/cachix/watch-store.nix;
+          watch-store = ./modules/nixos/watch-store.nix;
           zfs = ./modules/nixos/zfs.nix;
         };
 

hosts/build02/nixpkgs-update.nix

@@ -261,7 +261,6 @@ in
 
   sops.secrets.nix-community-cachix = {
     path = "/home/r-ryantm/.config/cachix/cachix.dhall";
-    sopsFile = "${toString inputs.self}/modules/nixos/cachix/secrets.yaml";
     owner = "r-ryantm";
     group = "r-ryantm";
   };

hosts/build02/secrets.yaml

@@ -3,6 +3,7 @@ github-r-ryantm-key: ENC[AES256_GCM,data:Z6kGGGGLClFWxBu4RpPw3F/QrkLVIgkvLzi5ALU
 github-r-ryantm-token: ENC[AES256_GCM,data:X77cQQQDFcUe9VcHZwbhZdyg6wFsAEwRMDaDojWYyHJf4RxWwRm8Vg==,iv:/PxtdHM1eTbRZb0KrjuSSutxBVwmFaSejp62qb+/D10=,tag:K/EH8Rl6CeZcigftKO3hNw==,type:str]
 github-token-with-username: ENC[AES256_GCM,data:9k+TaxVIQ6BUASckGTAAdDsSS1OQ7WfF6oUdY8t/24VU5bK3M2Uozbfh6qUtmZFLcA==,iv:4AE/eoXHm1/gd3SdRYY+LyI56YFod8YD7ZKZ6uG840k=,tag:fboN3lX6vKVZHEtaZ+C8Gw==,type:str]
 hetzner-borgbackup-ssh: ENC[AES256_GCM,data:/IFOie/xNTdthMSaH6Ltz07E9zoSC++OItZrWLuJAB8oqgVBZgs9uRdfz7ISKVgOwjTXBpWj1BJGFX/qO6repWPrIfULnrUzGrBmYc6yFmh38CI1ePr5vQMbPdXR009bh3rcuJ/FE56eDAZbeR3VWyYxRg/qtaddYiQFx08UVQjrWvw5ow9tz7zATN7c+KOclM1Uz2E7kSmO4vzXiDlaFjPQfFmCw+km0rxhUMnK07o2+7dt90/mtLIBZEOkof0e3LhJxcOEu+hsZjmkCENxASVyn6U2CHzh0x/L6Jic/8Z6rycW4OIzTGnQ08ZHYWGUwRN14CnAnVdwbZEBLWmX5gdoYiC5Qj2z3Egd91F8daCXlllLTkFiKAydLsuVOSCptO5rPPxOc2Uxbq93GyhDwQSDJf/sYDHf1MeQ0vCmAdFc9yJx5tjCYyAWYqiHML2edy9V3mhT2LnzBhWl0r0cp5xQyYeF7X1UYzIiyg3+VrEd61Yhhza8MmbE46/lVNoPMQkn,iv:nPYh3g8FnyuLcrvJchxzXK6wxJX65LQUpsk6QYY2h1w=,tag:pV88bePvVCVdRUVvM3E/bg==,type:str]
+nix-community-cachix: ENC[AES256_GCM,data:xuKxuljv5x7eSraCPbNtYO1S57nyo9edEoKV8fBjb4bNuBVK88e+5ZRRFTv2PbY7RWS9lwCNDZ6B+7WaCOcFOlCyVbQeIPMd1bDU3Z7+ySCZJVSBXS0vyQYD7X56yjZGTEoalY5TE+MNy6POpi+8TqhxCgl6TdKK6R0wL5kbzJ9bnOjPvxhpWTJavBnqj80P7ZINjGBb+dRDkqvZ5AcWfZzh89V5s41w3BeLbTGS0yFlKU+sSaCQZoV5vlAFyvulCoapkyKoqjVnVfOW/1spThHGkAH4HJ2grgwVZ0w1xYdL38YqMOKvT8a9HUlRW61D5Z2/ZnEBzjjR1dgNSroQYCwANmGuJljX6lPRlBS1TuUcsLjnNe0HQHUaZPBNVSArwGR+gZQTHx5aykEceh/a4nykvWLs5pU5AsEFtpw9U79m40EKbwQhgNJPdVzgL5U35AQW7okweikGLUjosyvBBAEHoonpAZOs366CIRHDjBtwqEH74jl2Z4rEZyWS8LeWlrCvsOKUCLrdRHmPnvH8Z0R2N4xhV6tZVzazrUoQV2+ir26Z,iv:eVJvH4PbkMLdxu04L5SLqb8gVJ6+AOwRb/u68V7yRfw=,tag:8TAvx+O3C+CZr6MI18czCw==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -63,8 +64,8 @@ sops:
             blYxOTlvUXRIZVR1bFByOXlWRFdGbnMKX2tfgtOnWMm8g4tCPeO3/poTkncZUCoS
             MrBJuCFYJJUUwwvu/1Whyv2WNE0uenaa+fe5kade0vO8Ke2OPfxVfA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-08-12T02:20:24Z"
-    mac: ENC[AES256_GCM,data:sUlUiZotLKsjsvKuu4QrMvnoxoKnuz5f+1cmU1WE1dmGfK76IzdOIxDGEgZLp46qzBEH5H7uVqntUntznr9UeyYw3h7GwPyEZ5u1lqaZQ7Jj3uKo9VJRThWMTnvGcvGWSuCXEJdpAo1RrNgYHAbMuadqjKZdJ15e6ySQrmebKCQ=,iv:AffKEQNlE5D/te5L+PHw80PgF+Tkswn6YrMTrVbKS8Y=,tag:nG4d6sFYqcvzczyvvlsmQA==,type:str]
+    lastmodified: "2023-11-16T06:28:35Z"
+    mac: ENC[AES256_GCM,data:TnC2U7D8HJCylZzfQhZOIvRBbVPaeKFXD+UjU6UJIzH4n7NcvtLVqTFfehzvx3hfRHlotJp9YW//5dMOa1Sm3YQ1X9t3KvGoZn7crICydEM3rC16LCOHuoVfC+oNUu4hwNZmmiURcZdumcbkJSOqRbAV5gBtBbXddbNqQED3ZgM=,iv:omRFt3RaTaYwbrg+CHBOpNRrLE4gXqpYM2GjUnY8tT8=,tag:XdHHLdpkv3rMjq5oPmlpIQ==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
-    version: 3.7.3
+    version: 3.8.1

hosts/build03/secrets.yaml

@@ -4,6 +4,7 @@ hydra-admin-password: ENC[AES256_GCM,data:t0vmchbXXIAzvM2nxm4j16N9W67yWRb439M=,i
 nur-update-github-token: ENC[AES256_GCM,data:KIZCx9IeuBHZei2V13iiyHzCedhkkGEd08mVJEc6F0DWQn1wtzC7+w==,iv:pNVRj/RR7wj64g640F7Vo4H10ijsxnrfFQnt6YHBug4=,tag:UlvOMNB5JZbuJaD9TcJ2UQ==,type:str]
 hydra-users: ENC[AES256_GCM,data:askAB+a3bsFvue/j9i6sYSwgOQl+rL+uh+1+z+xizzBOWdTZcvRh5uFHTkg7MV/E7tG7eRByQ7b+v/onJ4+l3rGJJ6qsWtLLLizC1rusngsAXyI9jt66eqpsyacN5kw8cKILjGearptrhUZDWdKpbaHII6fwUbWbjyV5fpoQzNmI4VELWEQMZ50yECfAfCLHx9iTdoMJHPXzhqwvAZ+TbX6TsyqbDrrNauYWNUBhCK7E2tDYAQqOGhxnQWI+gQs=,iv:Baqyd/WfloMuXTiICD2dlvENst8G6YU9rSHdRkTECkU=,tag:z4j5dYcba3aZTyWu5wvkzw==,type:str]
 hetzner-borgbackup-ssh: ENC[AES256_GCM,data:ZNrQp36c3EuERlAYez6SHTLbHK7ZmLNqDpAffTTQARL2zpnjpw1wJQJdm6d6Un1wTjYmHMJ/f1jCKgn389FGiZJwxSLUL4Ko2n5HffBTjZwTeqE1y4XFe6qvAY/LYBmD728ZWOsSWPvoVZOm1dG7LsxxwUZWk2VyDtvODuJBInn19Dn7Tw5VqPjJMJAp5CfAaW8ilEPpdeG0JQfkJkBQj0+pMlpI1EIVDvdZai5fesweUWeaajrPnIjrBbqdFvd8eG9qrTehLM7FvpnT2qllfsCOeQf/KTPEw16I6eGFFm22iPblJgHFPzpu1a2Lvwn+8HcwqSMlGI9poOeV5RwXqBhFX9vozlN8G82csAnehiZmLktyYin1kYF3nfOXFqH9fKxbvXn/1hxQP//GDeoaNlepa/K/w51pj1mgbIXIb5g/PKsHaC7Rv3iDMcYW977+lobA4WnxfWhjA6k/iBb1unkSKbrZs+iHglpOKueAq9g6HO5fJ299eY2+GcmsPU3QKm4W,iv:550mzEValpqVruLQBMMJeJHVyYfaxNHwCvXkvz66qI0=,tag:k48T+9AtJs8GTVchyEP8Jw==,type:str]
+watch-store-token: ENC[AES256_GCM,data:VBEj9g5R/aa3hTDcKl8HRxJOOgl4B+0uyPMRhnrPth6LD7r5tpq4ckPHXqo87kekXMGoMIVeGYaM+E1iOLhnqOUOeOoSs+6NnnrUg2+nHR2gC2xAGZpxc/ntZ5g5DVDi0iw7jzxdd3X5OAru5mi/mDRXOAdeT+jtwLwqBEZ5dHMBRI/gGs2wRVIY0XUG5EQW/M1AYpanRat/jfmWJjuZvlT3MEA=,iv:AP66pQJiP8wl10F3vhwpdRcVKm8PP6U8T0POXa1fFio=,tag:WdI6TgV5D1ZJolOazFV1Ew==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -64,8 +65,8 @@ sops:
             WUZQSGQyQy9halJsRTIvb1FGV08zZEEKmjlYY6epTuZKRBcVyjPvJI5XKQtP5Yag
             FMrI+M6hUeyBeCade5C+Y4eGQbt57BWLmsX7u0J1WTlkUSS5j7+wPg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-07-21T12:58:43Z"
-    mac: ENC[AES256_GCM,data:zTImcUQeQsbWfWZjwJ6nPNCrYWkyUvZrud3pNWdsMLqXn0uB61n/Oav3i3m1zyz7eQObutG1OR+0aUlLMk0v7Xbz9rZCrMKN+GuV7tcaeu3ksvpn21ldd8PGzmYa6M+0EKkVqeTKXYHYY06OsxfeWafT52XA+0/uKE+3ldS2o3U=,iv:CSWcScdbdu+6lWt/6WFBBO8GqygNsKVNzII3bbxh8jg=,tag:tBwvCs0usPFBgoWRw3G5eQ==,type:str]
+    lastmodified: "2023-11-16T06:27:48Z"
+    mac: ENC[AES256_GCM,data:rObEhY3ArAQJjoYkejy3g9AOMHz0ophqG7nfOfZgUnejLmsNqxVlq9tIZCTEOXHT9QbDi34jTEobQLVdqCPX2wL7A4dx/cfDKNEtei8vKm1xAOeGl6gnyCyONQwP7Nqd1rtZCy6lS8ePa8Lyrc6wRL/giDM2yOcV+XR/aH4Jch4=,iv:Y2zYk9K1EGM7cwHNSOdY+OoooWjNfUiUWHKRJ+h8QHA=,tag:Oyjs1hEG4HzI76z2GA73Mg==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
-    version: 3.7.3
+    version: 3.8.1

modules/nixos/cachix/secrets.yaml

@@ -1,85 +0,0 @@
-nix-community-cachix: ENC[AES256_GCM,data:tGMaYSBnhZ9idMV7DGzUfR1Zzk70syR8f4DSkrO65XcYUvoS4tcaVXr4l6PzDAFetkgU92a/kkIrEMZ9tZZZGHMvmCteGObH2BgF6k57NdozNnkXsI4ZhltATu5tpwzI+DUFgtpAXPEVYY6DRDlUATrt8SKJ2JuI4JtpIHpPi0noS/WpBfsphOUQ/7epTtABLpyDb0EOXisvkPLjDIKwfNDE+dOHO61aN8zS14QhelRIfJUSj7BwVFWbaseLKmq5ZIDAFK5s/FSgToi4Bj/YYVrTo23RH8wvhYOelSNcAWW/wotMZ5u/pklTytytLC41DhyFXU54k/UEorfVMHMnLAlujDoBs/9oV+M18Jcs0qV7c1utzjwoGlYhxV7zV/QvJ2zuMyDtszK0twcL8BjUSpsy+W/sR3kpGBKzjt1oNteTlz0YvIXlxg/Yn63qGr2/HzZlNd9rygMnLhTf7VO4Su2AB4GLXI7ljgQdqM7AREuAgE5J0hHE82fRalBsZcK34QGEFVKN4mzybcK4HO70yUQY4o5cOc7R5DHvEJmukjjJclm/,iv:N/yKtyd56YpdpNEe92g9Eml8gYR9x5pBT66U5p20Rzw=,tag:HCAJSqQ3Wq5SnZDwdryN1Q==,type:str]
-watch-store-token: ENC[AES256_GCM,data:ectFQuDP3HWW+QVBvxtQ6PeBVuyyi6NVFpL8E1OvMfYfCvu3XQQppEAeqbdKhns6dHD2NZOz6Hts3hQC7ob936ss5nQrIAcfM/9JRcrC8E5yYCtllHuF8MSfeq7CGRWtzjWhLtJrnMowuBQVr1Oqh4Twac2fdeRH7NnC9DJZiMht94iHk+nW6j3jpkpbHu/3+oZxSgGlLaedvpS8noKtr2XNuxM=,iv:o5XHaEjJxiq4gU7pmHHlr8Ep1stDGq23CSBHPC3RCdM=,tag:1bOdCHl8HGrxzts5dZQ4IQ==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age1kh6yvgxz9ys74as7aufdy8je7gmqjtguhnjuxvj79qdjswk2r3xqxf2n6d
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTSENQQ051UmduMis0MHg4
-            a1A5RHR2VlMyZTJnbGtGNnVQMUdPa2cwcGswCmlJMTNzek55NGxNRjFMS2pVWGUw
-            ZmJ0cXlhbWtNZ0J6K2tLUW1PVGZvcE0KLS0tIG4wMTgzRmdWcmNOaVdyTEFyaStp
-            dXlkWFlqWUsrci9aQ0hCaVJXMU1XeEUK5N1oXd7+s4pWyGhcQ2zkFVrasFNxznZz
-            w+fb54LkD7kE86HSk5s4O8YuUXfrgBVtnImOTyETpuusCkbsfjczkQ==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1qg7tfjwzp6dxwkw9vej6knkhdvqre3fu7ryzsdk5ggvtdx854ycqevlwnq
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwanprVHFHaWlZWDhKQzhr
-            bXNLL1RHL1EwUi9YNkhadURWYTcvbGRzcGpVCjQyeGhDK0JMdzBOY0lxMW9BVEly
-            R0pFQ1FMMVZtVVJtamlPamdwTWdyR3cKLS0tIEFvZmlDUmtKT1h1aXJBZ25yM0Zz
-            RDNKZC9JTmVGczkvTFFSTDZvcmtnam8KNelR9AzIW197HwLBDAczqnqeFDLbLi2Q
-            xu90gyz5caeaCUDMchXPqUZFwMw4r4imxiZEx4NmJnS4k/but3uHjg==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1r464z5e2shvnh9ekzapgghevr9wy7spd4d7pt5a89ucdk6kr6yhqzv5gkj
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNL1MwVzNOLzNSZ3djbWFB
-            WlYveXR0VjZRc01PdnV3cWxlbXlXREFJVDFJCkVtVFFmd1JRRkJ4Q1kreWpuWk9F
-            djdPWGpHaitGTXdIVDlrRW5pMUlnbEUKLS0tIGUrQ08vWUw4YkVaNStiTGQzQUth
-            TzNMZDZiZXRUUDlZM0JDeEhTT0k4bUUKlBZ2tDj8xKYmd1etzclVq1x8q05SCxL0
-            oE/PrwxnMClgcfEdDLyv/RbdKcC3Q5RfrzhFhsOgf4KwnnCx4kFflA==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age17n64ahe3wesh8l8lj0zylf4nljdmqn28hvqns2g7hgm9mdkhlsvsjuvkxz
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuWGFoWjhvYmxsaVVXNEZ4
-            MFA2U1RhVlNEbmZwM3JWYWNZL0pnWTZsb200CkY5bGw5Z3h3dE1jdkJmTTd6ckVS
-            VnU0MHlnZ0VzcjRXdjlJK251RzJIbGsKLS0tIHM2ZzJXOHZTNFJpeEFDRk5LZFNs
-            NnJIWGhUaU04ZWYrOFM2cWRZTHVSQUUKTnxjbYm0chPqepCQkqTibUJIP88AzT/D
-            fGyl6BFY9vD1lhIiHjjCuHcsOGCgp1ADxbjwKRZp5nViFMW7qVmvzA==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1d87z3zqlv6ullnzyng8l722xzxwqr677csacf3zf3l28dau7avfs6pc7ay
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOZlQ2M2hrZng2MWg3RzJL
-            MGNJa29Na2VYZE5sMmVCVU1nTkkxcUw5R1dnCjBFaHZBdkNpV3JZU1ZQdjI2ZzRP
-            ZGRUUFU3SVNiYk1OdjBaZ3FsQk0yQkkKLS0tIGwvcENuY2hJMnVoejFCcHZlQUVl
-            cmlTR214WVZJWGc3ZFNCamlZL0I5UW8KfxIwdGCM3LZ4SHgCBLC3YSfqzn40ruam
-            8+2Lw39j5TrVAjWevT+rDXNZ9qInJA6EFFNIytxuSHQt5rYL22ZX+A==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1jrh8yyq3swjru09s75s4mspu0mphh7h6z54z946raa9wx3pcdegq0x8t4h
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSUU81RUZSc2UveURnZXo3
-            c2ltOEVPYnhaYkRXSFJSanppekwwTnFXYjJRCkFaYjN1K2RaTU5wYUZsSVRzZWYw
-            ZG40ZUNBN3RUdCtKcmF4cGEyZVBWenMKLS0tIFJKdmxHNnZrNTJoN1hyNUdsQnh4
-            QXYyVDdSandaU3ZBT1pkdlk3bE1HcmcKhmtkHXeDB+j9oLbEv6mhcttPQLaftv5S
-            171hn6nE4hCGELhX0gEvaq/9vOi++c8QTQsJPhrPPz19N//cIcBWlA==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1m7xhem3qll35d539f364pm6txexvnp6k0tk34d8jxu4ry3pptv7smm0k5n
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHSWNPOXBSeGxWUXRDM2tl
-            OUY2T3g2MXdCc1E5NGljdDJkVEtxTU8yS1JRCkJaRjdGYUdJclVuSEMvTUZDQzhv
-            K3pPL053MTBZNm1jYk5KZWpXcHFjOFUKLS0tIFBEL0o0YXVVb3ZTRnR1c1JkMFhH
-            NHdPUk5OWnlxWllHZmJKVkF6VWZMOEkKLOp3GuszVag+8m516594WwIZLMAilpGr
-            HBchG4cbturlpwFLdEXfvOxoCWTYD2eRCBLcfefalvVmJkF6x04AAA==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1dzvjjum2p240qtdt2qcxpm7pl2s5w36mh4fs3q9dhhq0uezvdqaq9vrgfy
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0cmhKTnh1c3hVd252elFN
-            Mmw2VkZJSnVkUHlQU0ZCU001dHpkc2lHZmkwCkpvcHMzQ0kvbHBQMW4zN3d5Nllt
-            ZkpXRFZDSEdyU3ZIUHNCQ1g3K1RpREEKLS0tIG1yYU11Skh2SkduYW5Zd0lybXZq
-            OWp3ZTRDaUF5Q09ldGFSNExtNGZzaXMKEJyh5VWp+wMSTvBnILtWp41SNr2vcI69
-            WkjzSoPQ+sdXpyG5LR/8o13Uys8XnUisLd5zgu3u5gMoC27HHaMGWA==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-04-11T22:25:24Z"
-    mac: ENC[AES256_GCM,data:wW9ilTzHroIfRARpTFdWJTgeTVxc6ike59vik6+kWQ88LQ+FOEivRidcN6GBs11CZIrPZ0bdIdGoBAU3ITCBFT86kzZarXp5UA9gldsHHHy4AJGnf8AtS+xy2pttHHwcal8xG6xjMM9mON0GTsSZT1DUCWBXjTZgfO3Ffr6D8q0=,iv:3/CjqY8GoIzJXfhJcArxHeS+EFMWs7LrMDGeZIcl7MA=,tag:A0qqPDNYfMcivyTqNiA45g==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.7.3

modules/nixos/watch-store.nix

@@ -1,7 +1,7 @@
 { config, ... }:
 
 {
-  sops.secrets.watch-store-token.sopsFile = ./secrets.yaml;
+  sops.secrets.watch-store-token = { };
 
   services.cachix-watch-store = {
     enable = true;