42 lines
1.2 KiB
Nix
42 lines
1.2 KiB
Nix
{ inputs, config, lib, ... }:
|
|
|
|
let
|
|
# Both pi and opencode talk to Langdock on work machines and expect the API
|
|
# key in the environment, so the secret is managed here rather than in the
|
|
# individual agent modules.
|
|
needsLangdock = config.dot.llm.pi.workMode || config.dot.llm.opencode.workMode;
|
|
in
|
|
{
|
|
imports = [
|
|
inputs.sops-nix.homeManagerModules.sops
|
|
];
|
|
|
|
sops = {
|
|
defaultSopsFile = ../../secrets/secrets.yaml;
|
|
defaultSopsFormat = "yaml";
|
|
|
|
age = {
|
|
keyFile = "${config.home.homeDirectory}/.config/sops/age/keys.txt";
|
|
};
|
|
|
|
secrets = lib.mkIf needsLangdock {
|
|
langdock_api_key = {
|
|
# Uses defaultSopsFile from secrets.nix
|
|
};
|
|
};
|
|
};
|
|
|
|
home.sessionVariables = {
|
|
SOPS_AGE_KEY_FILE = config.sops.age.keyFile;
|
|
};
|
|
|
|
# Export the decrypted langdock API key as an env var. The secret lives in a
|
|
# runtime file, so it is read at shell startup rather than baked into the Nix
|
|
# store via home.sessionVariables.
|
|
programs.zsh.initContent = lib.mkIf needsLangdock ''
|
|
if [ -r "${config.sops.secrets.langdock_api_key.path}" ]; then
|
|
export LANGDOCK_API_KEY="$(cat "${config.sops.secrets.langdock_api_key.path}")"
|
|
fi
|
|
'';
|
|
}
|