feat: add agenix for secrets management

flake.nix

@@ -3,18 +3,51 @@
 
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
-    impermanence.url = "github:nix-community/impermanence";
+    impermanence = {
-    agenix.url = "github:ryantm/agenix";
+      url = "github:nix-community/impermanence";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    agenix = {
+      url = "github:ryantm/agenix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
-  outputs = inputs @ { self, nixpkgs, impermanence, agenix, ... }: rec {
+
-    imports = [
+  outputs = inputs @ { self, nixpkgs, impermanence, agenix, ... }:
-      ./configuration.nix
+    let
+      inputs.secrets = ./secrets;
+      defaults = {
+        config = {
+          environment.persistence = {
+            "/nix/persist" = {
+              hideMounts = true;
+              directories = [
+                "/var/lib"
+                "/var/log"
+                "/etc/nixos"
+                "/opt"
+                "/persist"
               ];
+              files = [
+                "/etc/machine-id"
+                "/etc/nix/id_rsa"
+              ];
+            };
+          };
+
+          age.identityPaths = [
+            "/persist/nix.key"
+          ];
+        };
+      };
+    in
+    {
       nixosConfigurations.orion = nixpkgs.lib.nixosSystem {
         system = "x86_64-linux";
         specialArgs = inputs;
         modules = [
+          defaults
           ./hosts/orion
           impermanence.nixosModules.impermanence
           agenix.nixosModules.default
@@ -24,6 +57,7 @@
         system = "x86_64-linux";
         specialArgs = inputs;
         modules = [
+          defaults
           ./hosts/luna
           impermanence.nixosModules.impermanence
           agenix.nixosModules.default

hosts/luna/default.nix

@@ -1,5 +1,6 @@
 { config, lib, nixpkgs, ... }:
 {
+
   imports = [
     ./modules
     ./os

hosts/luna/modules/impermanence.nix

@@ -1,18 +1,4 @@
 { ... }:
 {
-  environment.persistence = {
+  environment.persistence = { };
-    "/nix/persist" = {
-      hideMounts = true;
-      directories = [
-        "/var/lib"
-        "/var/log"
-        "/etc/nixos"
-        "/opt"
-      ];
-      files = [
-        "/etc/machine-id"
-        "/etc/nix/id_rsa"
-      ];
-    };
-  };
 }

secrets/secrets.nix

@@ -0,0 +1,15 @@
+let
+  keys = rec {
+    master = "age1yubikey1qdpckyaqwxptfhsnwe5p40wggvlmu67tgx8t5yyf38g8k6xjj6cp7wtvg2s";
+    orion-tech = {
+      luna = [
+        "age1jgwqs04tphuuklx4g3gjdg42mchagn2gu7sftknerh8y8l9n7v7s27wqgu"
+        master
+      ];
+    };
+  };
+in
+
+{
+  "gitlab-runner-reg-config.age".publicKeys = keys.orion-tech.luna;
+}