refactor: ponytail audit

modules/secrets/.sops.yaml

@@ -1,9 +1,5 @@
-keys:
-  - &admin age122w85pqj508ukv0rd388mahecgfckmpgnsgz0zcyec37ljae2epsdnvxpl
-  - &orion age1upsxyevxdv3xax8jhnffclryuve70k63cjrca69ffds4h2m3nvuql59ufw
 creation_rules:
   - path_regex: secrets.yaml$
-    key_groups:
-      - age:
-        - *admin
-        - *orion
+    age: >-
+      age122w85pqj508ukv0rd388mahecgfckmpgnsgz0zcyec37ljae2epsdnvxpl,
+      age1upsxyevxdv3xax8jhnffclryuve70k63cjrca69ffds4h2m3nvuql59ufw

modules/secrets/sops-password.nix

@@ -1,16 +0,0 @@
-{ config, ... }:
-let
-  account = config.facts.account;
-  nixosModules = config.flake.modules.nixos;
-in
-{
-  flake.modules.nixos.sops-password =
-    { config, ... }:
-    {
-      imports = [ nixosModules.sops ];
-
-      sops.secrets.hashed-password.neededForUsers = true;
-
-      users.users.${account.name}.hashedPasswordFile = config.sops.secrets.hashed-password.path;
-    };
-}

modules/secrets/sops.nix

@@ -15,23 +15,18 @@ in
     sops.defaultSopsFile = ./secrets.yaml;
   };
 
-  flake.modules.nixos.sops-admin-key-file =
-    { lib, ... }:
-    let
-      adminKeyDir = builtins.dirOf sopsAdminKeyPath;
-    in
-    {
-      imports = [ nixosModules.sops ];
+  flake.modules.nixos.sops-admin-key-file = {
+    imports = [ nixosModules.sops ];
 
-      home-manager.sharedModules = [ hmModules.sops ];
+    home-manager.sharedModules = [ hmModules.sops ];
 
-      sops.age.keyFile = sopsAdminKeyPath;
+    sops.age.keyFile = sopsAdminKeyPath;
 
-      systemd.tmpfiles.rules = [
-        "d ${adminKeyDir} 0750 root wheel -"
-        "z ${sopsAdminKeyPath} 0640 root wheel -"
-      ];
-    };
+    systemd.tmpfiles.rules = [
+      "d ${builtins.dirOf sopsAdminKeyPath} 0750 root wheel -"
+      "z ${sopsAdminKeyPath} 0640 root wheel -"
+    ];
+  };
 
   flake.modules.nixos.sops-host-ssh-key = {
     imports = [ nixosModules.sops ];