refactor(hosts): share API secrets across systems

Move the Pi web-search credentials to a host-wide SOPS file and declare them for both NixOS and System Manager users. Leave mgc's age recipient disabled until Ubuntu is reinstalled.

Assisted-by: pi (gpt-5.6-sol)

.gitattributes

@@ -1,3 +1,3 @@
-hosts/nixos/**/secrets.yaml diff=sopsdiffer
+hosts/**/secrets.yaml diff=sopsdiffer
 home/gabriel/**/*/*.yaml diff=sopsdiffer
 nix linguist-generated=true

.sops.yaml

@@ -11,7 +11,24 @@ keys:
     - &taygeta age1szxq4pz3wuxrs5ynqt3gys4wxslg27lr67smsqvg5guhap800szs3y73vd
     - &maia age150kp4hx4qzfpcxayyfh8xcv8nf0uudppsknwgzgj724djqup2qvqz2gwj5
     - &pleione age1mhlh8lj8jv58xy9mdhsarfyanckyx8c2xdu09xrn23nrc56e94xserztxx
+    # Replace after reinstalling mgc:
+    # - &mgc age1...
 creation_rules:
+  - path_regex: hosts/secrets.ya?ml$
+    key_groups:
+    - age:
+      - *atlas
+      - *merope
+      - *alcyone
+      - *celaeno
+      - *taygeta
+      - *maia
+      - *pleione
+      # Enable after adding mgc's recipient above:
+      # - *mgc
+      pgp:
+      - *misterio
+
   - path_regex: hosts/nixos/taygeta/secrets.ya?ml$
     key_groups:
     - age:

hosts/nixos/common/secrets.yaml

@@ -1,8 +1,6 @@
 gabriel-password: ENC[AES256_GCM,data:Z7yJrQxWHScmbKHuDb768A7AU4Won0pGPYfGIWvI+CyWWDEmGRuh/EmU+uf/Oqo0tQj+aqEz81R5Sv/BNJrpXl0XvJROcl9+qblE0jAVnnXftuZKLeVs+3ArHNkJ/Z2ZGotUbXeLSgZH3g==,iv:4FHgMp/Byfavw6iT0csouw9joV1/UGyty5TfVgofcJ0=,tag:vwaFuuGKCijgPXgG+aeSog==,type:str]
 layla-password: ENC[AES256_GCM,data:GSfztXWS5+oVRH0WMFsbuCcuU16OF/aWNTlba8+mL5zGGIBfBBqUnYbmprUIn345L+zH7620BaywhYvYkT7PRr1ZOizOItZACE2sDDcaJuTo14lPuxh9WgbLHgpaEG15utNtrVglb/nCrA==,iv:F2gOedMcFce/JFEY2RPAWEqQxSFsSGU4cmcTRU1+5R4=,tag:CV1InGjSwAdirjvKMZl+dA==,type:str]
 wireless: ENC[AES256_GCM,data:0/crLOc3W4K6rEIji4G64mCMkgvy9CkFmp+EfZ+QxSjiGASbOHKnbbapuYIOr/ouFWLGNlsHWP0zosWEfaldg6xeyCx1QYH+j2NYbqX+QYu2aOW6jz8+9BhmBvmMHE5m8/5GLWoFUFcAw4H4zvj+0a6IADAOPjnjtXNMAKjxS5kGMBhNh/TOwK2Jtvxo/LiIIs5vCt6BKe0LKeNEhZInIPqYpHBgthEPRE5sr80ZeQnXQAZOZj+7c+7j6RymT3N2pOAg2BYHo/HeMkIp6wE1XYirh93plblETpzG/p+mh5KcEaaHQuRI4uRvgsN9C/BBqOYvwonBGQPQt6RQXcmazLRRald1c07FFGYtb20MBtfZ8K1OcLE4G5hirF3wCYZ1pUuG1k7BWyL6Tw/r3qWitRiMZS5MEb8YsfIUmxGXUa1Gc8r3gs7XG//PGba+jmMweNowEJmfBT+Q0c+dkac8F0JIbws9hJyiovOcSjjM6uAC+hEYsm5dXQ4MHp/+ugifK4kuKR6qf36MusWqtjwoXTHENw8WTvqTf97TWNKF4a0+GhiWwtwuZgriyjqRuw77ep/T/q1EHs2Ba5oeO851OjW3la+eYnGycxpoEcD63HQho+n0EVyRNanaP42O,iv:5SrkclwFYNpYR16fYbAnDnKS/N5We4Oy2966ywnWJWw=,tag:6KgxjpbWxLjIGOdC6N97vw==,type:str]
-brave_api_key: ENC[AES256_GCM,data:AN16nQQwdqKp+L2XPP9GKJulEXIoT32TmDD2nohPTA==,iv:1vjVA+tFVh1+stW/S9IBtpeAYteb/hyGxDcF4+dc07A=,tag:4kpf73bEYX7KbKas2l3iJQ==,type:str]
-kagi_session_token: ENC[AES256_GCM,data:X8uPQYehrAKfshJCz2sSxz5NY5Ab4N+IVsT2zrwxYQmuHy2CYlMbLZkx5ssolzlW9CEivH65mdzsiyMqXnr987KpwWZWZqr+8sPDS/lvZ2/vzSihYf5+,iv:CdIhSFhfjNdNVgesKnmycmRKVldgv7BGlveubWug620=,tag:drw73skWYc1dKW/GLWE3Kg==,type:str]
 sops:
     age:
         - enc: |
@@ -68,8 +66,8 @@ sops:
             /vIUXyaug3bAVvDk2zVQFLGE7JSUN3qI2ayczv/ogGnIX3/bwrgrJw==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1mhlh8lj8jv58xy9mdhsarfyanckyx8c2xdu09xrn23nrc56e94xserztxx
-    lastmodified: "2026-08-06T13:29:51Z"
-    mac: ENC[AES256_GCM,data:/XLNR9O9WUuMdXurg6c+QFRpeU8Gb9XyjUARWzUBrcweEtsxeI/PcrtywGbwFKWh/Ls8TNP3RlvPTwzWpLLoHAOElA5kFrKN3K9JY5xX9JogPKzBv6BgzZ7Ud8UrwvKJXUPYMGbqLp2LMcJerTePItZCOWfquHE//l01lONv2Ho=,iv:CoTmWiimA3xcOUxEn6OR/7hoYL9Zn+mPu2EwoQ/nfO0=,tag:LL+ggv8Wr+JObHarY+1qwA==,type:str]
+    lastmodified: "2026-08-06T13:49:47Z"
+    mac: ENC[AES256_GCM,data:ZkfIkYf+memATzA22XZhMzPKSGkGAZfnekCJix0NgH24Uux9676X44c9teRThcZ9afoaZ4esvWICrQj9sLc/mbamcp4XuL4f3g3yzfCeXKPLWk4T1r8ECBwd4ROAbugdYqfmTHkJIkc004Xby9RpJfGNijMJ1v3dGo4z6/FvRmk=,iv:gXMPfrDJI/RCfU8AI2sjDrYHBynPvBDx0qGMyxk259s=,tag:IfqFCbgQRYUBYMKBqt+T0A==,type:str]
     pgp:
         - created_at: "2025-09-22T16:23:03Z"
           enc: |-

hosts/nixos/common/users/gabriel/default.nix

@@ -62,11 +62,11 @@ in {
       neededForUsers = true;
     };
     brave_api_key = {
-      sopsFile = ../../secrets.yaml;
+      sopsFile = ../../../../secrets.yaml;
       owner = "gabriel";
     };
     kagi_session_token = {
-      sopsFile = ../../secrets.yaml;
+      sopsFile = ../../../../secrets.yaml;
       owner = "gabriel";
     };
   };

hosts/secrets.yaml

@@ -0,0 +1,90 @@
+brave_api_key: ENC[AES256_GCM,data:1B+E3DBalCvrty6PaZPQOog+dFRkIAeZEhabQNiAnQ==,iv:tw1UC+NGc6H62nX8rfBNcDFPjpYacJPU/plNVSOI1N4=,tag:WIzoNLSZr6uIGGIbbg4C/g==,type:str]
+kagi_session_token: ENC[AES256_GCM,data:WLv/X0Us7qjTDbWWvg5ilxQC+cpV+AuInMO+j97F7t8SYOXfQQD8vi6C6On6Az8rYTGJ03BLIpFVajkvgMqUYn13PTR61x94Ro5NfNNRLHTg2bzM3qFE,iv:KYNFEycx1R5m+HytpjJ118W/fY9sc7hNmQA8qlraNSg=,tag:L3dd+A/Lv+McdZu/PCP4xw==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnVWFkaHNxd1J2Y3JhM3Rn
+            NjNEV3pzODltNTRGVUhDTDlNdUFxazAyT3pFCm9RNDhtSG5heFZxamxyRE40emNJ
+            cU1aWG1ROURSZzhKVExTeDJBazd0b3cKLS0tIE9JTEgvQ3ZGdFdaVVFZQndhVllD
+            TURVZHVNNkJTNkdjUFU2eUhYYlFyOHcKPleTkUR+e4O0YFRArPW/bLngWTVQONvM
+            10PLVKZlfgrXZ6bYyxJ+s7ElEUVG46ciJhvmkIptOpvvy5wSialEyw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1hm5lf4qk84r4wh00atn6hpts7mpdx80adq26wht2e5qh9ewvhyaszfv82d
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXU1ZpU2Fjdm9DaG56MHVZ
+            Q21OODZtRGdWaG94NWNxNVdZdEZOUG12RUdNCk1HcWpaaUhtVHZCelFyK01sa1lZ
+            b0hLY2FTM3FGNDR5VlNtR1VlczJmeFUKLS0tIFJUZ0RZUzIrSklldEV0Vk42dEJF
+            OVF3ZWtUZ1gra011RUdkZFBvVFZ4Y0UKdp9pkV2mOpVL68EVNgNN9IUPqyKKMHnc
+            ruu6ACjs4NPGjYFBKyYP8PAL1Tw8JqN1VW8+44sT/RAsO7WXLSrCGw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1709qfrwglm75v5x8lpuhryt83k6p6c90npplzzec6a5w8ct93ejscpqpc3
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFZjFnb2oxMWFNd2p6U1ZF
+            aGkwcEx0YlF4SkFNYStuVUd5aTdJM3QwaTBZCkdWSkFUc0c4QjlVeGdlaUhFZ21p
+            RzZ0ZCtzQjhRaDBoUWlzbVRlZis2TGsKLS0tIFdsOFBZN1BuVE8xaWVhMnhzTkth
+            WVpoaENIWkxQb25WOEhQblJtdnM4SlUKEV19HXPVeo8QN6kn/yK8o7J3WjJkaep8
+            RS0T8QkcNeaCKihrkx1ePPn48IcSqvpbDCsY5LxO2VEhCeDCdyvtfg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1uxvuygmvwpfjrd9d3ulg6ln8dgvaw4l2c90mw0tr72qg3n8vd9ns3dm000
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUNThiNlFWT2lqbnZMK084
+            N1dudEtsSTFBS0lsRmhHZlhyMlZxOGVQSVM4CldUbXEwMUdjbllWUUx4STVhcnQx
+            MlcvdU42b25ObEpZckNsa21tZ1FCdEUKLS0tIFZkY1pJN1RkZTFmYndFWFgyT3F5
+            bkpRbTlPT1p6U016YW9mR01aa01MMkUKyCPsebSTptNIidsI/m4CKHjKRNcg4Iz5
+            wnVbwAgt7vmCjxV8xx01EDva+Jl2aBqT7TondW/e4qTVTkcAonyhPQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1gxhy9eq38xfplay0kvkeyvsg96g0c4p6rkhajkrj8nc9dswdzqhssgvns0
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4ZmJYTll6a20yVHFzTVJH
+            ZVFGM2VjN2JHR0NyZytoeHpCaThIa0M5K3g0Cnk3dys0bkNGM3JRcFhSbUtGU0dE
+            NGc2dnY2VW5zenYzREQ3WnlUSmgyV3MKLS0tIEo2UmUxelFuSzhRaVZOVDJBR1FQ
+            bHhIMGZqNkhGUktQNm5yWmZOYUZBTFEKFRGT6EjBAQFcrT8NWEumoaGU6JDHIQPZ
+            BvYRAhfdhVMU7BUl/iyhyP0xMjvEAgYj1rPv+gaRBotOHyjntQTIzA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1szxq4pz3wuxrs5ynqt3gys4wxslg27lr67smsqvg5guhap800szs3y73vd
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0QndkdlFWMzN4aFJVK0Vt
+            VVZ3WDI1bTZyeTFlL2hqNUs3NHZUVm1lSEM0ClJBZDhHN2phRFJoTWFGZmZTYjlv
+            d0M1Z3d4RVo0cHkydTkvaTAvZ2s0Q2cKLS0tIFUyVDRFMmovODY2MTRtbEU3Q1o5
+            MTdkVndaM0t0UURYWnhYbzJoU0Y3V1kKZtR7EZz/DBgomEzkYdC8lYDZ8fARJHuI
+            CJhsBcHkSeZmbeoFYcK53xEvFT2tdH/9BYBo/t+bqL5CW73yntVoXg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age150kp4hx4qzfpcxayyfh8xcv8nf0uudppsknwgzgj724djqup2qvqz2gwj5
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUODVLcFpxRFRsWkQwZlhD
+            dTJwVW91VHc2aENOZ01iRTQvNUJtUnFPUHdnCmpiUldaSUY1TkZDZCt0WmR3RGhv
+            YThUTWNKbENxcGx1a1NqTmNiVUpNNUEKLS0tIENzaDlJbkZQb1RuQ1RnWHovakx5
+            UTlXbGwvajd6VGdNUElQQUUxREc1Yk0KaLxzXcEZYhOmB5lsUYhDPcVWipuz+6vE
+            y5GIsgitubiHJwtZEyjzzYBWJObnW2xyzyrDMc1PKxZKOvkjJe90KA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1mhlh8lj8jv58xy9mdhsarfyanckyx8c2xdu09xrn23nrc56e94xserztxx
+    lastmodified: "2026-08-06T13:49:10Z"
+    mac: ENC[AES256_GCM,data:GNqvYv/dYMUH4GjjSbqPENPLET4JA+1n4BpIptpo1q6D8b7pXQLKPXV8WwgZZZtA3usoS5LzBRwvDA9ZClxo0dz0lid08UDIgd+FnY35YfYbhHqoKkrgDvfA+UxGciGf0+M63aFAAknmRq3ojPCzMXzn1f21JSLYoeVo6EV7mng=,iv:dJH5+xs4OblZHAJ2XEGG0egeAp655tQ/ci4wC8fq+jg=,tag:fAJ+jeCwi9NHar94L1dWbw==,type:str]
+    pgp:
+        - created_at: "2026-08-06T13:49:04Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQGMAwa9kVfiDH1CAQwAk6ViDedmhXMFVD6MQqX9/YoklBBJKOIFuk3gsivAFypK
+            UxrcSrbP6jofSKBEjvhkw59cKDTyfFKYSZwIh78lcpN+5SS8QEkxcQuekICi6i/t
+            Sa690uvxKxOGPvM0/P5cyJ7TV+Psc3m/cCWWGp5JZp+qjYqna0Ir92GPWD0iwVow
+            SlqEONUqS3KIzAKQ0s08W341qlRbFqQmD7oj8XDP5z8vDEwmlK8KmeXZus+o4NO4
+            5SDma7AXkUatpoVzu+elCAhiKuLPkXTQLfb1jFT9PZKGvTy7p1fW7uWFGZS7E87x
+            KtH3wQghGTAIVRP6n2jbS3JZ4LcQIjjCSzTt4uM2RKIiq4zYPmtduHNb/WzhHH+R
+            gRz6fbEaNb7cdsTZq+WqG2IgiH9Ji+/qFqm9OxaoJdOg5CAGpM1KSM3L2CeOTKum
+            DqcpHyE5VgbkPgHeZ6Un2KEUJ3Dkjjo1/Rv5+hv3S6pZB0nYJtNkUWfuMZX0txW5
+            hHFePekLqkH9TXa3gC480l4Bu8w07Zh19wi3V1YaBkorjCcYmS08tywZyum0wdbB
+            ZsDzJY0wb9BXgzwEIaprOzXuhg35sZhqHC/ANzcqn/KjCN2CcRnYIKgEhWQs/3ZW
+            s213xG7k6erHFWxA02sG
+            =vCYr
+            -----END PGP MESSAGE-----
+          fp: 7088C7421873E0DB97FF17C2245CAB70B4C225E9
+    unencrypted_suffix: _unencrypted
+    version: 3.13.1

hosts/system-manager/common/global/default.nix

@@ -9,6 +9,7 @@
 
     ./greetd.nix
     ./nix.nix
+    ./sops.nix
   ];
 
   nixpkgs.config.allowUnfree = true;

hosts/system-manager/common/global/sops.nix

@@ -0,0 +1,5 @@
+{inputs, ...}: {
+  imports = [inputs.sops-nix.nixosModules.sops];
+
+  sops.age.sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
+}

hosts/system-manager/common/users/gabriel/default.nix

@@ -23,5 +23,16 @@
     };
   };
 
+  sops.secrets = {
+    brave_api_key = {
+      sopsFile = ../../../../secrets.yaml;
+      owner = "gabriel";
+    };
+    kagi_session_token = {
+      sopsFile = ../../../../secrets.yaml;
+      owner = "gabriel";
+    };
+  };
+
   home-manager.users.gabriel = import ../../../../../home/gabriel/${systemManagerHostName}.nix;
 }