deepak/nixconf
1
0
Fork 0
Code Issues Pull Requests Actions Projects Releases Wiki Activity

better secrets handling no need for env var

Browse Source
This commit is contained in:
Deepak Mallubhotla 2025-03-05 21:24:35 +00:00
parent 7b1ca01cf1
commit 5e2c22d314
Signed by: deepak
GPG Key ID: 47831B15427F5A55
3 changed files with 10 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
home/deepak/home.nix
View File

@ -125,7 +125,7 @@ in
# syntax highlighting # syntax highlighting
vim-just vim-just
]; ];
extraConfig = import ./neovim/init-vim.nix; extraConfig = import ./neovim/init-vim.nix { inherit config; };
}; };
programs.thefuck.enable = true; programs.thefuck.enable = true;
@ -174,6 +174,7 @@ in
]; ];
initExtra = '' initExtra = ''
eval "$(${pkgs.direnv}/bin/direnv hook zsh)" eval "$(${pkgs.direnv}/bin/direnv hook zsh)"
export ANTHROPIC_API_KEY=$(cat ${config.sops.secrets.anthropic_api_key.path})
''; '';
}; };
@ -182,13 +183,9 @@ in
# It's also possible to use a ssh key, but only when it has no password: # It's also possible to use a ssh key, but only when it has no password:
#age.sshKeyPaths = [ "/home/user/path-to-ssh-key" ]; #age.sshKeyPaths = [ "/home/user/path-to-ssh-key" ];
defaultSopsFile = ./secrets.yaml; defaultSopsFile = ./secrets.yaml;
secrets.test = { secrets = {
# sopsFile = ./secrets.yml.enc; # optionally define per-secret files anthropic_api_key = {
};
# %r gets replaced with a runtime directory, use %% to specify a '%'
# sign. Runtime dir is $XDG_RUNTIME_DIR on linux and $(getconf
# DARWIN_USER_TEMP_DIR) on darwin.
path = "%r/test.txt";
}; };
}; };

4
home/deepak/neovim/init-vim.nix
View File

@ -1,3 +1,4 @@
{ config }:
'' ''
inoremap jj <Esc> inoremap jj <Esc>
inoremap kk <Esc> inoremap kk <Esc>
@ -61,9 +62,8 @@ vim.api.nvim_set_keymap('n', '<leader>or', '<cmd>OverseerRun<CR>', { noremap = t
require("parrot").setup({ require("parrot").setup({
providers = { providers = {
anthropic = { anthropic = {
api_key = os.getenv "ANTHROPIC_API_KEY", api_key = { "cat", "${ config.sops.secrets.anthropic_api_key.path }" },
}, },
ollama = {},
}, },
}) })

6
home/deepak/secrets.yaml
View File

@ -1,6 +1,6 @@
hello: ENC[AES256_GCM,data:mdwrgkzAvxazg319XbXnHTMUOJLO5ybx7iK0HfRHn0tYj+5q8EQB7XxQThF7Xw==,iv:XJIl2Idal+O61ONAKCaCGaGvB7mwyBMtd2+THsaeqdg=,tag:/vN0rkCNMPe62uMxwMg75Q==,type:str] hello: ENC[AES256_GCM,data:mdwrgkzAvxazg319XbXnHTMUOJLO5ybx7iK0HfRHn0tYj+5q8EQB7XxQThF7Xw==,iv:XJIl2Idal+O61ONAKCaCGaGvB7mwyBMtd2+THsaeqdg=,tag:/vN0rkCNMPe62uMxwMg75Q==,type:str]
#ENC[AES256_GCM,data:XQeqeSMpzA/awNfbiWdq0GhfreE+0a5t1dmd5Ic=,iv:Tv0uGl9LtoF+F5o2HBGMnPCU05eHmekSn51HNxzlRWw=,tag:fQdevcwTK0oI3EzRZik0XA==,type:comment] #ENC[AES256_GCM,data:XQeqeSMpzA/awNfbiWdq0GhfreE+0a5t1dmd5Ic=,iv:Tv0uGl9LtoF+F5o2HBGMnPCU05eHmekSn51HNxzlRWw=,tag:fQdevcwTK0oI3EzRZik0XA==,type:comment]
anthropic_key: ENC[AES256_GCM,data:tcuddpeu3PKPXrf8EgmSfjd12d7ptLok/DlumQC/oIzTGG7sYsvxseZrDElsYT4AGmkWPNVVhac+3PmKfGFL4rV16u+6G+weMgTCYsDHyg0KaWM5a01MB3GMf2HyA65RYUxaRW4kP+6UlOXO,iv:dyD6lxxLa99HP9NXf/ewZu1h6Sm6KBYPJqwM3l6SX88=,tag:23+3ad8o67Niyil9M+B4ag==,type:str] anthropic_api_key: ENC[AES256_GCM,data:SgDnPjIGmoB7YAqSYMD8jmeGlK0mvZokHQ4bt1dT6zF/cX31fW7V+oRovPowFxgYfz8xXMHbNquUU7TlUebKFRVMeNhbnJmosLoUQj8JnxFZnKWRk4OwE4w/oTIdjjWh5OSo/GsDprm+XcMF,iv:/GVhGWpUqe6NF2ZpdNb7qTbrXcZr7pj219xkAv3AnQM=,tag:W9yZpFCsEyIYhUuvoJuBtw==,type:str]
sops: sops:
kms: [] kms: []
gcp_kms: [] gcp_kms: []
@ -16,8 +16,8 @@ sops:
OENPOXBEZ3ZrU1k1bGk2Tko0VzcyME0Kc+d+9WO9Yv7wbg56cnGyklaeoQTfKqYr OENPOXBEZ3ZrU1k1bGk2Tko0VzcyME0Kc+d+9WO9Yv7wbg56cnGyklaeoQTfKqYr
7sycCyJFzlihyfiPxkHzGFkAudmakuwKo4cj+L4V7pDLta1leA4X+w== 7sycCyJFzlihyfiPxkHzGFkAudmakuwKo4cj+L4V7pDLta1leA4X+w==
-----END AGE ENCRYPTED FILE----- -----END AGE ENCRYPTED FILE-----
lastmodified: "2025-03-05T20:08:03Z" lastmodified: "2025-03-05T21:03:16Z"
mac: ENC[AES256_GCM,data:he/4cI1SH0uloLOWd7Qi4wtrOrFQKE3xy6doDg0Uv0mp7ViScYiYbIq8r1bM/zH0X8aTKyYj9O75b+rm+vS3Q8sG8PFj6vHvF4bwduO1jobNnLnUjJDgpSmpLneGAPJyyV2UBFXRCQOJ0anshmNCD0bFPyV9SnSaf5NgBdBpkeI=,iv:7PmJ6zuY+tMzectAuDp6uCUpxbDp0CWqCCQzpq2evjY=,tag:OIwFQ96feI75ld9feB25Og==,type:str] mac: ENC[AES256_GCM,data:M1BQIakQtcK3OHrsLQ/SadQeVl9soVbAd4XRCdTp+/way3v3CPo3JqElybRiG7xAEifULmQXOUkw84u4mv+QM4YmvP94zcugiSLJ/FA6mcRvC8GlmjhNbtriLgTedB6GoZ23j1jdA9L9V8AnNYNLroXMVrMwkSwAd7HBYec0QHI=,iv:b1u+9P1QrP9UVP3woTeWDzH+cS83Pt8YSg7fScQjEp4=,tag:GNRfzG9a+U3J/ZKr7iqigQ==,type:str]
pgp: [] pgp: []
unencrypted_suffix: _unencrypted unencrypted_suffix: _unencrypted
version: 3.8.1 version: 3.8.1