sops

modules/system/sops.nix

@@ -0,0 +1,41 @@
+{
+  inputs,
+  pkgs,
+  ...
+}:
+{
+  imports = [
+    inputs.sops-nix.nixosModules.sops
+  ];
+
+  environment.systemPackages = with pkgs; [
+    # sops / age
+    sops
+    age
+    ssh-to-age
+
+    # YubiKey edit key
+    age-plugin-yubikey
+    yubikey-manager
+    pcsc-tools
+
+    # password hash generation
+    mkpasswd
+  ];
+
+  # age-plugin-yubikey depend
+  services.pcscd.enable = true;
+
+  services.openssh.enable = true;
+
+  sops = {
+    defaultSopsFormat = "yaml";
+
+    age = {
+      # system keys
+      sshKeyPaths = [
+        "/etc/ssh/ssh_host_ed25519_key"
+      ];
+    };
+  };
+}