refactor: centralize service helpers and sops secrets

.sops.yaml

@@ -1,35 +1,7 @@
 keys:
   - &primary age132m0pg4utk3cjve2lgcjffvz7cevl0fq5krufu9sgud7wu2wgurqk49kgl
 creation_rules:
-  - path_regex: secrets/invidious-db.env
-    key_groups:
-      - age:
-        - *primary
-  - path_regex: secrets/invidious-config.yaml
-    key_groups:
-      - age:
-        - *primary
-  - path_regex: secrets/blarm-restic.yaml
-    key_groups:
-      - age:
-        - *primary
-  - path_regex: secrets/blarm-linkwarden.env
-    key_groups:
-      - age:
-        - *primary
-  - path_regex: secrets/blarm-searxng.env
-    key_groups:
-      - age:
-        - *primary
-  - path_regex: secrets/blarm-acme.env
-    key_groups:
-      - age:
-        - *primary
-  - path_regex: secrets/blarm-immich.env
-    key_groups:
-      - age:
-        - *primary
-  - path_regex: secrets/aquarius-newt.env
+  - path_regex: secrets/.*\.(env|yaml)$
     key_groups:
       - age:
         - *primary

lib/module/default.nix

@@ -40,6 +40,74 @@ rec {
   #@ Type -> Any -> String
   mkBoolOpt' = mkOpt' types.bool;
 
+  ## Create an enable option that defaults to true.
+  #@ String -> Option
+  mkEnabledOption = description: mkEnableOption description // { default = true; };
+
+  ## Create a common TLS nginx proxy virtual host.
+  #@ Attrs -> Attrs
+  mkNginxProxyHost =
+    {
+      acmeHost ? "stahl.sh",
+      proxyPass,
+      location ? { },
+      ...
+    }@attrs:
+    removeAttrs attrs [
+      "acmeHost"
+      "proxyPass"
+      "location"
+    ]
+    // {
+      forceSSL = true;
+      useACMEHost = acmeHost;
+      locations."/" = {
+        inherit proxyPass;
+      }
+      // location;
+    };
+
+  ## Create a common TLS nginx static-file virtual host.
+  #@ Attrs -> Attrs
+  mkNginxStaticHost =
+    {
+      acmeHost ? "stahl.sh",
+      root,
+      location ? { },
+      ...
+    }@attrs:
+    removeAttrs attrs [
+      "acmeHost"
+      "root"
+      "location"
+    ]
+    // {
+      forceSSL = true;
+      useACMEHost = acmeHost;
+      locations."/" = {
+        inherit root;
+      }
+      // location;
+    };
+
+  ## Create a sops-nix secret backed by a file below the configured secrets
+  ## directory.
+  ##
+  ## ```nix
+  ## sops.secrets.example = mkSopsSecret cfg.secretsDir "example.yaml" {
+  ##   key = "example/password";
+  ## };
+  ## ```
+  ##
+  #@ Path -> String -> Attrs -> Attrs
+  mkSopsSecret =
+    secretsDir: file: attrs:
+    attrs // { sopsFile = secretsDir + "/${file}"; };
+
+  ## Create a dotenv sops-nix secret from the configured secrets directory.
+  #@ Path -> String -> Attrs
+  mkSopsDotenvSecret = secretsDir: file: mkSopsSecret secretsDir file { format = "dotenv"; };
+
   enabled = {
     ## Quickly enable an option.
     ##

modules/nixos/services/acme/default.nix

@@ -8,6 +8,7 @@ with lib;
 with lib.${namespace};
 let
   cfg = config.${namespace}.services.acme;
+  sopsCfg = config.${namespace}.system.sops;
 in
 {
   options.${namespace}.services.acme = {
@@ -15,6 +16,8 @@ in
   };
 
   config = mkIf cfg.enable {
+    ${namespace}.system.sops = enabled;
+
     security.acme = {
       acceptTerms = true;
       defaults.email = "admin+acme@stahl.sh";
@@ -23,16 +26,13 @@ in
         extraDomainNames = [ "*.stahl.sh" ];
         dnsProvider = "infomaniak";
         dnsPropagationCheck = true;
-        environmentFile = "/run/secrets/acme";
+        environmentFile = config.sops.secrets.acme.path;
       };
     };
 
     users.users.nginx.extraGroups = [ "acme" ];
 
-    sops.secrets.acme = {
-      format = "dotenv";
-      sopsFile = ../../../../secrets/blarm-acme.env;
-    };
+    sops.secrets.acme = mkSopsDotenvSecret sopsCfg.secretsDir "blarm-acme.env";
   };
 
 }

modules/nixos/services/cinny/default.nix

@@ -14,41 +14,36 @@ in
   options.${namespace}.services.cinny = {
     enable = mkEnableOption "Cinny";
     nginx = {
-      enable = mkEnableOption "Enable nginx for this service." // {
-        default = true;
-      };
+      enable = mkEnabledOption "Enable nginx for this service.";
     };
 
     package = mkOption {
       description = "The package of Cinny to use.";
       type = types.package;
-      #default = pkgs.awesome-flake.cinny;
       default = pkgs.cinny-unwrapped;
     };
 
     domain = mkOption {
       description = "The domain to serve Cinny on.";
-      type = types.nullOr types.str;
+      type = types.str;
       default = "cinny.stahl.sh";
     };
 
   };
   config = mkIf cfg.enable {
-    networking.firewall.allowedTCPPorts = [
+    networking.firewall.allowedTCPPorts = mkIf cfg.nginx.enable [
       80
       443
     ];
 
-    awesome-flake.services.acme.enable = mkIf cfg.nginx.enable true;
+    ${namespace}.services.acme.enable = mkIf cfg.nginx.enable true;
 
     services.nginx = mkIf cfg.nginx.enable {
       enable = true;
 
-      virtualHosts."${cfg.domain}" = {
-        forceSSL = true;
-        useACMEHost = "stahl.sh";
-        locations."/" = {
-          root = "${cfg.package}";
+      virtualHosts."${cfg.domain}" = mkNginxStaticHost {
+        root = "${cfg.package}";
+        location = {
           extraConfig = ''
             rewrite ^/config.json$ /config.json break;
             rewrite ^/manifest.json$ /manifest.json break;

modules/nixos/services/ente-auth/default.nix

@@ -24,19 +24,17 @@ in
     package = mkOption {
       description = "The package of Ente-Auth to use.";
       type = types.package;
-      default = pkgs.awesome-flake.ente-web-auth;
+      default = pkgs.${namespace}.ente-web-auth;
     };
 
     domain = mkOption {
       description = "The domain to serve ente-auth on.";
-      type = types.nullOr types.str;
+      type = types.str;
       default = "ente.stahl.sh";
     };
 
     nginx = {
-      enable = mkEnableOption "Enable nginx for this service." // {
-        default = true;
-      };
+      enable = mkEnabledOption "Enable nginx for this service.";
     };
 
   };
@@ -47,16 +45,14 @@ in
       443
     ];
 
-    awesome-flake.services.acme.enable = mkIf cfg.nginx.enable true;
+    ${namespace}.services.acme.enable = mkIf cfg.nginx.enable true;
 
     services.nginx = mkIf cfg.nginx.enable {
       enable = true;
 
-      virtualHosts."${cfg.domain}" = {
-        forceSSL = true;
-        useACMEHost = "stahl.sh";
-        locations."/" = {
-          root = enteApp;
+      virtualHosts."${cfg.domain}" = mkNginxStaticHost {
+        root = enteApp;
+        location = {
           extraConfig = ''
             try_files $uri $uri/ /index.html;
           '';

modules/nixos/services/forgejo/default.nix

@@ -9,14 +9,13 @@ with lib;
 with lib.${namespace};
 let
   cfg = config.${namespace}.services.forgejo;
+  codebergThemes = pkgs.${namespace}.codeberg-themes;
 in
 {
   options.${namespace}.services.forgejo = {
     enable = mkEnableOption "Forgejo";
     nginx = {
-      enable = mkEnableOption "Enable nginx for this service." // {
-        default = true;
-      };
+      enable = mkEnabledOption "Enable nginx for this service.";
     };
 
     package = mkOption {
@@ -27,56 +26,69 @@ in
 
     port = mkOption {
       description = "The port to serve Forgejo on.";
-      type = types.nullOr types.int;
+      type = types.port;
       default = 3001;
     };
 
     domain = mkOption {
       description = "The domain to serve Forgejo on.";
-      type = types.nullOr types.str;
+      type = types.str;
       default = "git.stahl.sh";
     };
 
     ssh_domain = mkOption {
       description = "The domain to serve Forgejo on.";
-      type = types.nullOr types.str;
+      type = types.str;
       default = "stahl.sh";
     };
 
     user = mkOption {
       description = "The user to run Forgejo as.";
-      type = types.nullOr types.str;
+      type = types.str;
       default = "forgejo";
     };
 
   };
   config = mkIf cfg.enable {
-    networking.firewall.allowedTCPPorts = [
+    networking.firewall.allowedTCPPorts = mkIf cfg.nginx.enable [
       80
       443
     ];
 
     systemd.services.codeberg-themes = {
       description = "Codeberg Themes Setup";
-      wantedBy = [ "multi-user.target" ];
+      wantedBy = [ "forgejo.service" ];
+      before = [ "forgejo.service" ];
+      path = [ pkgs.coreutils ];
 
-      environment.PATH = lib.mkDefault "${pkgs.coreutils}/bin:${pkgs.bash}/bin";
+      serviceConfig = {
+        Type = "oneshot";
+        ExecStart = pkgs.writeShellScript "setup-codeberg-themes" ''
+          set -euo pipefail
 
-      serviceConfig.ExecStart = ''
-        ${pkgs.bash}/bin/bash -c "mkdir -p /var/lib/forgejo/custom/public/assets/css /var/lib/forgejo/custom/public/assets/img && \
-          cp -r ${pkgs.awesome-flake.codeberg-themes}/var/lib/forgejo/custom/public/assets/css/* /var/lib/forgejo/custom/public/assets/css/ && \
-          cp ${pkgs.awesome-flake.codeberg-themes}/var/lib/forgejo/custom/public/assets/img/*logo.svg /var/lib/forgejo/custom/public/assets/img/logo.svg && \
-          chown -R ${cfg.user}:${cfg.user} /var/lib/forgejo/custom"
-      '';
+          install -d -o ${cfg.user} -g ${cfg.user} \
+            /var/lib/forgejo/custom/public/assets/css \
+            /var/lib/forgejo/custom/public/assets/img
+
+          cp -r ${codebergThemes}/var/lib/forgejo/custom/public/assets/css/* \
+            /var/lib/forgejo/custom/public/assets/css/
+          cp ${codebergThemes}/var/lib/forgejo/custom/public/assets/img/*logo.svg \
+            /var/lib/forgejo/custom/public/assets/img/logo.svg
+
+          chown -R ${cfg.user}:${cfg.user} /var/lib/forgejo/custom
+        '';
+      };
     };
 
     services.forgejo = {
-      user = cfg.user;
       enable = true;
-      package = cfg.package;
+      inherit (cfg)
+        package
+        user
+        ;
 
       database = {
-        user = cfg.user;
+        inherit (cfg) user;
         type = "postgres";
       };
 
@@ -96,15 +108,13 @@ in
 
     virtualisation.docker.enable = true;
 
-    awesome-flake.services.acme.enable = mkIf cfg.nginx.enable true;
+    ${namespace}.services.acme.enable = mkIf cfg.nginx.enable true;
 
     services.nginx = mkIf cfg.nginx.enable {
       enable = true;
 
-      virtualHosts."${cfg.domain}" = {
-        forceSSL = true;
-        useACMEHost = "stahl.sh";
-        locations."/".proxyPass = "http://127.0.0.1:${builtins.toString cfg.port}";
+      virtualHosts."${cfg.domain}" = mkNginxProxyHost {
+        proxyPass = "http://127.0.0.1:${builtins.toString cfg.port}";
       };
     };
   };

modules/nixos/services/gns3/default.nix

@@ -16,9 +16,11 @@ in
   };
 
   config = mkIf cfg.enable {
-    services.gns3-server.enable = true;
-    services.gns3-server.ubridge.enable = true;
-    services.gns3-server.dynamips.enable = true;
+    services.gns3-server = {
+      enable = true;
+      ubridge.enable = true;
+      dynamips.enable = true;
+    };
 
     environment.systemPackages = with pkgs; [
       dynamips

modules/nixos/services/immich/default.nix

@@ -8,47 +8,63 @@ with lib;
 with lib.${namespace};
 let
   cfg = config.${namespace}.services.immich;
+  sopsCfg = config.${namespace}.system.sops;
 in
 {
   options.${namespace}.services.immich = {
     enable = mkBoolOpt false "Immich";
 
     nginx = {
-      enable = mkEnableOption "Enable nginx for this service." // {
-        default = true;
-      };
+      enable = mkEnabledOption "Enable nginx for this service.";
     };
 
     domain = mkOption {
       description = "The domain to serve Immich on.";
-      type = types.nullOr types.str;
+      type = types.str;
       default = "immich.stahl.sh";
     };
 
     port = mkOption {
+      description = "The port that Immich will listen on.";
       type = types.port;
       default = 2283;
-      description = "The port that Immich will listen on.";
     };
   };
 
   config = mkIf cfg.enable {
-
-    services.immich = {
-      enable = true;
-      mediaLocation = "/data/immich";
-      host = "0.0.0.0";
-      port = cfg.port;
-      secretsFile = "/run/secrets/immich";
-      redis.enable = true;
-      machine-learning.enable = true;
-      database = {
-        enable = true;
-        createDB = false;
-      };
+    ${namespace} = {
+      system.sops = enabled;
+      services.acme.enable = mkIf cfg.nginx.enable true;
     };
 
-    services.postgresql.extensions = ps: with ps; [ pgvector ]; # Ensure pgvector is available
+    services = {
+      immich = {
+        enable = true;
+        mediaLocation = "/data/immich";
+        host = "0.0.0.0";
+        inherit (cfg) port;
+        secretsFile = config.sops.secrets.immich.path;
+        redis.enable = true;
+        machine-learning.enable = true;
+        database = {
+          enable = true;
+          createDB = false;
+        };
+      };
+
+      postgresql.extensions = ps: with ps; [ pgvector ];
+
+      nginx = mkIf cfg.nginx.enable {
+        enable = true;
+
+        virtualHosts."${cfg.domain}" = mkNginxProxyHost {
+          proxyPass = "http://127.0.0.1:${builtins.toString cfg.port}";
+          location = {
+            proxyWebsockets = true;
+          };
+        };
+      };
+    };
 
     networking.firewall.allowedTCPPorts = mkIf cfg.nginx.enable [
       cfg.port
@@ -56,25 +72,7 @@ in
       443
     ];
 
-    awesome-flake.services.acme.enable = mkIf cfg.nginx.enable true;
-
-    services.nginx = mkIf cfg.nginx.enable {
-      enable = true;
-
-      virtualHosts."${cfg.domain}" = {
-        forceSSL = true;
-        useACMEHost = "stahl.sh";
-        locations."/" = {
-          proxyPass = "http://127.0.0.1:${builtins.toString cfg.port}";
-          proxyWebsockets = true;
-        };
-      };
-    };
-
-    sops.secrets.immich = {
-      format = "dotenv";
-      sopsFile = ../../../../secrets/blarm-immich.env;
-    };
+    sops.secrets.immich = mkSopsDotenvSecret sopsCfg.secretsDir "blarm-immich.env";
   };
 
 }

modules/nixos/services/linkwarden/default.nix

@@ -7,6 +7,7 @@
 }:
 let
   cfg = config.${namespace}.services.linkwarden;
+  sopsCfg = config.${namespace}.system.sops;
 
   inherit (lib)
     types
@@ -14,20 +15,24 @@ let
     mkOption
     mkEnableOption
     ;
+  inherit (lib.${namespace})
+    enabled
+    mkEnabledOption
+    mkNginxProxyHost
+    mkSopsDotenvSecret
+    ;
 in
 {
   options.${namespace}.services.linkwarden = {
     enable = mkEnableOption "Linkwarden";
     package = lib.mkPackageOption pkgs "linkwarden" { };
     nginx = {
-      enable = mkEnableOption "Enable nginx for this service." // {
-        default = true;
-      };
+      enable = mkEnabledOption "Enable nginx for this service.";
     };
 
     domain = mkOption {
       description = "The domain to serve linkwarden on.";
-      type = types.nullOr types.str;
+      type = types.str;
       default = "link.stahl.sh";
     };
 
@@ -46,27 +51,31 @@ in
   };
 
   config = mkIf cfg.enable {
+    ${namespace}.system.sops = enabled;
+
+    networking.firewall.allowedTCPPorts = mkIf cfg.nginx.enable [
+      80
+      443
+    ];
+
     services.linkwarden = {
       enable = true;
-      host = cfg.host;
-      port = cfg.port;
-      environmentFile = "/run/secrets/linkwarden";
+      inherit (cfg)
+        host
+        port
+        ;
+      environmentFile = config.sops.secrets.linkwarden.path;
     };
 
     services.nginx = mkIf cfg.nginx.enable {
       enable = true;
 
-      virtualHosts."${cfg.domain}" = {
-        forceSSL = true;
-        useACMEHost = "stahl.sh";
-        locations."/".proxyPass = "http://${cfg.host}:${builtins.toString cfg.port}";
+      virtualHosts."${cfg.domain}" = mkNginxProxyHost {
+        proxyPass = "http://${cfg.host}:${builtins.toString cfg.port}";
       };
     };
 
-    sops.secrets.linkwarden = {
-      format = "dotenv";
-      sopsFile = ../../../../secrets/blarm-linkwarden.env;
-    };
+    sops.secrets.linkwarden = mkSopsDotenvSecret sopsCfg.secretsDir "blarm-linkwarden.env";
 
     meta.maintainers = with lib.maintainers; [ jvanbruegge ];
   };

modules/nixos/services/newt/default.nix

@@ -1,6 +1,5 @@
 {
   lib,
-  pkgs,
   config,
   namespace,
   ...
@@ -9,6 +8,7 @@ with lib;
 with lib.${namespace};
 let
   cfg = config.${namespace}.services.newt;
+  sopsCfg = config.${namespace}.system.sops;
 in
 {
   options.${namespace}.services.newt = {
@@ -16,15 +16,14 @@ in
   };
 
   config = mkIf cfg.enable {
+    ${namespace}.system.sops = enabled;
+
     services.newt = {
       enable = true;
-      environmentFile = "/run/secrets/aquarius-newt.env";
+      environmentFile = config.sops.secrets."aquarius-newt.env".path;
     };
 
-    sops.secrets."aquarius-newt.env" = {
-      format = "dotenv";
-      sopsFile = ../../../../secrets/aquarius-newt.env;
-    };
+    sops.secrets."aquarius-newt.env" = mkSopsDotenvSecret sopsCfg.secretsDir "aquarius-newt.env";
 
   };
 }

modules/nixos/services/paperless/default.nix

@@ -14,9 +14,7 @@ in
   options.${namespace}.services.paperless = {
     enable = mkEnableOption "Paperless";
     nginx = {
-      enable = mkEnableOption "Enable nginx for this service." // {
-        default = true;
-      };
+      enable = mkEnabledOption "Enable nginx for this service.";
     };
 
     package = mkOption {
@@ -27,53 +25,55 @@ in
 
     port = mkOption {
       description = "The port to serve Paperless on.";
-      type = types.nullOr types.int;
+      type = types.port;
       default = 28981;
     };
 
     domain = mkOption {
       description = "The domain to serve Paperless on.";
-      type = types.nullOr types.str;
+      type = types.str;
       default = "paperless.stahl.sh";
     };
 
   };
   config = mkIf cfg.enable {
-    networking.firewall.allowedTCPPorts = [
+    networking.firewall.allowedTCPPorts = mkIf cfg.nginx.enable [
       80
       443
     ];
 
-    services.paperless = {
-      enable = true;
-      port = cfg.port;
-      package = cfg.package;
-      dataDir = "/data/paperless";
-      consumptionDirIsPublic = true;
-      settings = {
-        PAPERLESS_OCR_LANGUAGE = "deu+eng";
-        PAPERLESS_OCR_USER_ARGS = {
-          optimize = 1;
-          pdfa_image_compression = "lossless";
+    services = {
+      paperless = {
+        enable = true;
+        inherit (cfg)
+          package
+          port
+          ;
+        dataDir = "/data/paperless";
+        consumptionDirIsPublic = true;
+        settings = {
+          PAPERLESS_OCR_LANGUAGE = "deu+eng";
+          PAPERLESS_OCR_USER_ARGS = {
+            optimize = 1;
+            pdfa_image_compression = "lossless";
+          };
+          PAPERLESS_DBHOST = ""; # Ensure sqlite database
+          PAPERLESS_URL = "https://${cfg.domain}";
         };
-        PAPERLESS_DBHOST = ""; # Ensure sqlite database
-        PAPERLESS_URL = "https://${cfg.domain}";
       };
-    };
 
-    awesome-flake.services.acme.enable = mkIf cfg.nginx.enable true;
+      nginx = mkIf cfg.nginx.enable {
+        enable = true;
 
-    services.nginx = mkIf cfg.nginx.enable {
-      enable = true;
-
-      virtualHosts."${cfg.domain}" = {
-        forceSSL = true;
-        useACMEHost = "stahl.sh";
-        locations."/" = {
+        virtualHosts."${cfg.domain}" = mkNginxProxyHost {
           proxyPass = "http://127.0.0.1:${builtins.toString cfg.port}";
-          recommendedProxySettings = true;
+          location = {
+            recommendedProxySettings = true;
+          };
         };
       };
     };
+
+    ${namespace}.services.acme.enable = mkIf cfg.nginx.enable true;
   };
 }

modules/nixos/services/restic/default.nix

@@ -9,6 +9,7 @@ with lib;
 with lib.${namespace};
 let
   cfg = config.${namespace}.services.restic;
+  sopsCfg = config.${namespace}.system.sops;
 in
 {
   options.${namespace}.services.restic = {
@@ -16,14 +17,14 @@ in
   };
 
   config = mkIf cfg.enable {
-    sops.secrets.restic_url = {
+    ${namespace}.system.sops = enabled;
+
+    sops.secrets.restic_url = mkSopsSecret sopsCfg.secretsDir "blarm-restic.yaml" {
       format = "yaml";
-      sopsFile = ../../../../secrets/blarm-restic.yaml;
       key = "restic/url";
     };
-    sops.secrets.restic_password = {
+    sops.secrets.restic_password = mkSopsSecret sopsCfg.secretsDir "blarm-restic.yaml" {
       format = "yaml";
-      sopsFile = ../../../../secrets/blarm-restic.yaml;
       key = "restic/password";
     };
     services.restic.backups = {
@@ -32,8 +33,8 @@ in
         exclude = [
           "/home/*/.cache"
         ];
-        passwordFile = "/run/secrets/restic_password";
-        repositoryFile = "/run/secrets/restic_url";
+        passwordFile = config.sops.secrets.restic_password.path;
+        repositoryFile = config.sops.secrets.restic_url.path;
         paths = [
           "/home"
           "/var/lib"

modules/nixos/services/searxng/default.nix

@@ -9,6 +9,7 @@ with lib;
 with lib.${namespace};
 let
   cfg = config.${namespace}.services.searxng;
+  sopsCfg = config.${namespace}.system.sops;
 in
 {
   options.${namespace}.services.searxng = with types; {
@@ -16,91 +17,83 @@ in
 
     domain = mkOption {
       description = "The domain to serve searxng on.";
-      type = types.nullOr types.str;
+      type = types.str;
       default = "search.stahl.sh";
     };
 
     nginx = {
-      enable = mkEnableOption "Enable nginx for this service." // {
-        default = true;
-      };
+      enable = mkEnabledOption "Enable nginx for this service.";
     };
 
     redlib = {
-      enable = mkEnableOption "Whether or not to enable redlib." // {
-        default = true;
-      };
+      enable = mkEnabledOption "Whether or not to enable redlib.";
 
       domain = mkOption {
         description = "The domain to serve reddit on.";
-        type = types.nullOr types.str;
+        type = types.str;
         default = "reddit.stahl.sh";
       };
     };
   };
 
   config = mkIf cfg.enable {
+    ${namespace} = {
+      system.sops = enabled;
+      services.acme.enable = mkIf cfg.nginx.enable true;
+    };
+
     networking.firewall.allowedTCPPorts = mkIf cfg.nginx.enable [
       80
       443
     ];
 
-    services.searx = {
-      enable = true;
-      environmentFile = "/run/secrets/searxng";
-      settings = {
-        server = {
-          port = "1340";
-          bind_address = "127.0.0.1";
-          use_default_settings = true;
-          secret_key = "@secret_key@";
+    services = {
+      searx = {
+        enable = true;
+        environmentFile = config.sops.secrets.searxng.path;
+        settings = {
+          server = {
+            port = "1340";
+            bind_address = "127.0.0.1";
+            use_default_settings = true;
+            secret_key = "@secret_key@";
+          };
+          search = {
+            safe_search = 0;
+            autocomplete = "google";
+          };
+          searx = mkIf cfg.redlib.enable {
+            plugins.hostnames.SXNGPlugin.active = true;
+          };
+          hostnames.replace = mkIf cfg.redlib.enable {
+            "(.*\.)?reddit\.com$" = cfg.redlib.domain;
+            "(.*\.)?redd\.it$" = cfg.redlib.domain;
+          };
         };
-        search = {
-          safe_search = 0;
-          autocomplete = "google";
+      };
+
+      redlib = mkIf cfg.redlib.enable {
+        package = pkgs.redlib;
+        enable = true;
+        address = "127.0.0.1";
+        port = 1341;
+      };
+
+      nginx = mkIf cfg.nginx.enable {
+        enable = true;
+
+        virtualHosts = {
+          "${cfg.domain}" = mkNginxProxyHost {
+            proxyPass = "http://127.0.0.1:1340";
+          };
+          "${cfg.redlib.domain}" = mkIf cfg.redlib.enable (mkNginxProxyHost {
+            proxyPass = "http://127.0.0.1:1341";
+          });
         };
       };
     };
 
-    services.redlib = mkIf cfg.redlib.enable {
-      package = pkgs.redlib;
-      enable = true;
-      address = "127.0.0.1";
-      port = 1341;
-    };
-
-    services.searx.settings.searx = mkIf cfg.redlib.enable {
-      plugins.hostnames.SXNGPlugin.active = true;
-    };
-
-    services.searx.settings.hostnames.replace = mkIf cfg.redlib.enable {
-      "(.*\.)?reddit\.com$" = cfg.redlib.domain;
-      "(.*\.)?redd\.it$" = cfg.redlib.domain;
-    };
-
-    awesome-flake.services.acme.enable = mkIf cfg.nginx.enable true;
-
-    services.nginx = mkIf cfg.nginx.enable {
-      enable = true;
-
-      virtualHosts = {
-        "${cfg.domain}" = {
-          forceSSL = true;
-          useACMEHost = "stahl.sh";
-          locations."/".proxyPass = "http://127.0.0.1:1340";
-        };
-        "${cfg.redlib.domain}" = mkIf cfg.redlib.enable {
-          forceSSL = true;
-          useACMEHost = "stahl.sh";
-          locations."/".proxyPass = "http://127.0.0.1:1341";
-        };
-      };
-    };
-
-    sops.secrets.searxng = {
-      format = "dotenv";
-      sopsFile = ../../../../secrets/blarm-searxng.env;
-    };
+    sops.secrets.searxng = mkSopsDotenvSecret sopsCfg.secretsDir "blarm-searxng.env";
 
   };
 

modules/nixos/services/syncthing/default.nix

@@ -1,6 +1,5 @@
 {
   lib,
-  pkgs,
   config,
   namespace,
   ...
@@ -16,13 +15,13 @@ in
 
     port = mkOption {
       description = "The port to serve Syncthing on.";
-      type = types.nullOr types.int;
+      type = types.port;
       default = 8384;
     };
 
     ip = mkOption {
       description = "The ip to serve Syncthing on.";
-      type = types.nullOr types.str;
+      type = types.str;
       default = "192.168.10.3";
     };
 
@@ -37,7 +36,7 @@ in
     services.syncthing = {
       enable = true;
       guiAddress = "${cfg.ip}:${toString cfg.port}";
-      openDefaultPorts = mkIf cfg.openDefaultPorts true;
+      inherit (cfg) openDefaultPorts;
       dataDir = "/data/syncthing";
     };
   };

modules/nixos/system/sops/default.nix

@@ -3,6 +3,7 @@
   inputs,
   lib,
   namespace,
+  pkgs,
   ...
 }:
 with lib;
@@ -15,10 +16,19 @@ in
 
   options.${namespace}.system.sops = with types; {
     enable = mkBoolOpt false "Whether or not to enable sops support.";
+    secretsDir = mkOpt path ../../../../secrets "Directory containing encrypted sops files.";
+    ageKeyFile =
+      mkOpt str "${config.users.users.philipp.home}/.config/sops/age/keys.txt"
+        "Age identity file used by sops-nix.";
   };
 
   config = mkIf cfg.enable {
-    sops.age.keyFile = "${config.users.users.philipp.home}/.config/sops/age/keys.txt";
+    sops.age.keyFile = cfg.ageKeyFile;
+
+    environment.systemPackages = with pkgs; [
+      age
+      sops
+    ];
   };
 
 }