# sops-nix plumbing — applied to every machine.
# See docs/secrets.md for the day-to-day workflow.
{
  config,
  lib,
  pkgs,
  ...
}:
{
  # Each host defaults to its own secrets/<hostname>.yaml. Override per-secret
  # with sops.secrets.<name>.sopsFile for shared files.
  sops.defaultSopsFile = lib.mkDefault (../../secrets + "/${config.networking.hostName}.yaml");
  sops.defaultSopsFormat = "yaml";
  sops.validateSopsFiles = true;

  # Decrypt with the host's own SSH host key, converted to age.
  # Explicit rather than inheriting the openssh-derived default, so this does
  # not silently break if services.openssh is ever disabled.
  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
  sops.age.generateKey = false;

  # Age only. The default here is the RSA host key imported as a GPG key,
  # which is deprecated and an extra failure surface.
  sops.gnupg.sshKeyPaths = [ ];

  environment.systemPackages = with pkgs; [
    sops
    age
    ssh-to-age
  ];
}