3 files changed, 51 insertions, 4 deletions
diff --git a/modules/secrets/nixos/default.nix b/modules/secrets/nixos/default.nix
new file mode 100644
index 0000000..e5e6662
--- /dev/null
+++ b/modules/secrets/nixos/default.nix
@@ -0,0 +1,17 @@
+{
+  inputs,
+  config,
+  ...
+}: let
+  cfg = config.collinux.secrets;
+in {
+  imports = [
+    inputs.agenix.nixosModules.default
+  ];
+
+  age = {
+    identityPaths = ["/etc/ssh/ssh_host_ed25519_key"];
+    secretsDir = "/run/secrets.d";
+    secrets = cfg;
+  };
+}
diff --git a/modules/secrets/options.nix b/modules/secrets/options.nix
new file mode 100644
index 0000000..de15f50
--- /dev/null
+++ b/modules/secrets/options.nix
@@ -0,0 +1,32 @@
+{lib, ...}: let
+  inherit (lib) mkOption;
+in {
+  options = {
+    collinux.secrets = lib.mkOption {
+      type = lib.types.attrsOf (
+        lib.types.submodule ({config, ...}: {
+          options = {
+            name = mkOption {
+              type = lib.types.str;
+              default = config._module.args.name;
+            };
+            file = mkOption {type = lib.types.path;};
+            mode = mkOption {
+              type = lib.types.str;
+              default = "0400";
+            };
+            owner = mkOption {
+              type = lib.types.str;
+              default = "0";
+            };
+            path = mkOption {
+              type = lib.types.str;
+              default = "/run/secrets.d/${config.name}";
+            };
+          };
+        })
+      );
+      default = {};
+    };
+  };
+}
diff --git a/modules/services/nixos/selfhost/caddy.nix b/modules/services/nixos/selfhost/caddy.nix
index 367585d..85a840a 100644
--- a/modules/services/nixos/selfhost/caddy.nix
+++ b/modules/services/nixos/selfhost/caddy.nix
@@ -8,9 +8,7 @@
 in
   lib.mkIf cfg.enable (lib.mkMerge [
     {
-      services.caddy = {
-        enable = true;
-      };
+      services.caddy.enable = true;
       networking.firewall.allowedTCPPorts = [80 443];
       environment.systemPackages = with pkgs; [nss]; # required for caddy https stuff
     }
@@ -22,7 +20,7 @@ in
           ];
           hash = "sha256-cK7C5ISsTwX0FMf891s/Vr22JvRqYEC8GkLfP1L1Mus=";
         };
-        environmentFile = config.age.secrets."caddy-tailscale-authkey".path;
+        environmentFile = cfg.envFile;
       };
     })
   ])