From c186e96840ce765d75ee293552092fc021a85b9a Mon Sep 17 00:00:00 2001
From: isabel <isabel@isabelroses.com>
Date: Sun, 21 Dec 2025 12:19:14 +0000
Subject: [PATCH] various: mkSystemSecret -> mkSecret

---
 modules/flake/lib/default.nix              |  2 +-
 modules/flake/lib/secrets.nix              |  8 ++++----
 modules/nixos/services/attic.nix           |  4 ++--
 modules/nixos/services/blahaj.nix          |  4 ++--
 modules/nixos/services/borgbackup.nix      |  4 ++--
 modules/nixos/services/buildbot.nix        | 16 ++++++++--------
 modules/nixos/services/cloudflared.nix     |  4 ++--
 modules/nixos/services/forgejo.nix         |  6 +++---
 modules/nixos/services/immich.nix          |  6 +++---
 modules/nixos/services/kanidm.nix          | 14 +++++++-------
 modules/nixos/services/lego.nix            |  6 +++---
 modules/nixos/services/mailserver.nix      | 20 ++++++++++----------
 modules/nixos/services/matrix.nix          |  4 ++--
 modules/nixos/services/nixpkgs-prs-bot.nix |  6 +++---
 modules/nixos/services/pds/default.nix     |  6 +++---
 modules/nixos/services/piper.nix           |  4 ++--
 modules/nixos/services/vaultwarden.nix     |  4 ++--
 modules/nixos/services/wakapi.nix          |  8 ++++----
 18 files changed, 63 insertions(+), 63 deletions(-)

diff --git a/modules/flake/lib/default.nix b/modules/flake/lib/default.nix
index 7f6f8924..653ecb99 100644
--- a/modules/flake/lib/default.nix
+++ b/modules/flake/lib/default.nix
@@ -28,7 +28,7 @@ let
       indexOf
       intListToStringList
       ;
-    inherit (final.secrets) mkSystemSecret;
+    inherit (final.secrets) mkSecret;
     inherit (final.services) mkGraphicalService mkServiceOption;
     inherit (final.validators)
       ifTheyExist
diff --git a/modules/flake/lib/secrets.nix b/modules/flake/lib/secrets.nix
index 60e3f747..46dd09fd 100644
--- a/modules/flake/lib/secrets.nix
+++ b/modules/flake/lib/secrets.nix
@@ -15,13 +15,13 @@ let
     # Type
 
     ```
-    mkSystemSecret :: (String -> String -> String -> String) -> AttrSet
+    mkSecret :: (String -> String -> String -> String) -> AttrSet
     ```
 
     # Example
 
     ```nix
-    mkSystemSecret { file = "./my-secret.age"; }
+    mkSecret { file = "./my-secret.age"; }
     => {
       file = "./my-secret.age";
       owner = "root";
@@ -30,7 +30,7 @@ let
     }
     ```
   */
-  mkSystemSecret =
+  mkSecret =
     {
       file,
       owner ? "root",
@@ -53,5 +53,5 @@ let
     // args';
 in
 {
-  inherit mkSystemSecret;
+  inherit mkSecret;
 }
diff --git a/modules/nixos/services/attic.nix b/modules/nixos/services/attic.nix
index 08d7ac61..ecdcf55c 100644
--- a/modules/nixos/services/attic.nix
+++ b/modules/nixos/services/attic.nix
@@ -6,7 +6,7 @@
 }:
 let
   inherit (lib) mkIf;
-  inherit (self.lib) mkServiceOption mkSystemSecret;
+  inherit (self.lib) mkServiceOption mkSecret;
 
   rdomain = config.networking.domain;
 
@@ -20,7 +20,7 @@ in
   };
 
   config = mkIf config.garden.services.attic.enable {
-    sops.secrets.attic-env = mkSystemSecret {
+    sops.secrets.attic-env = mkSecret {
       file = "attic";
       key = "env";
     };
diff --git a/modules/nixos/services/blahaj.nix b/modules/nixos/services/blahaj.nix
index ed0b1e9e..fb9f12fc 100644
--- a/modules/nixos/services/blahaj.nix
+++ b/modules/nixos/services/blahaj.nix
@@ -6,13 +6,13 @@
 }:
 let
   inherit (lib) mkIf;
-  inherit (self.lib) mkServiceOption mkSystemSecret;
+  inherit (self.lib) mkServiceOption mkSecret;
 in
 {
   options.garden.services.blahaj = mkServiceOption "blahaj" { };
 
   config = mkIf config.garden.services.blahaj.enable {
-    sops.secrets.blahaj-env = mkSystemSecret {
+    sops.secrets.blahaj-env = mkSecret {
       file = "blahaj";
       key = "env";
     };
diff --git a/modules/nixos/services/borgbackup.nix b/modules/nixos/services/borgbackup.nix
index 122f66f1..c12b2436 100644
--- a/modules/nixos/services/borgbackup.nix
+++ b/modules/nixos/services/borgbackup.nix
@@ -5,7 +5,7 @@
   ...
 }:
 let
-  inherit (self.lib) mkServiceOption mkSystemSecret;
+  inherit (self.lib) mkServiceOption mkSecret;
 
   cfg = config.garden.services.borgbackup;
 in
@@ -13,7 +13,7 @@ in
   options.garden.services.borgbackup = mkServiceOption "borgbackup" { };
 
   config = lib.mkIf cfg.enable {
-    sops.secrets.borg-sshkey = mkSystemSecret {
+    sops.secrets.borg-sshkey = mkSecret {
       file = "borg";
       key = "sshkey";
     };
diff --git a/modules/nixos/services/buildbot.nix b/modules/nixos/services/buildbot.nix
index 563cda3f..eb563029 100644
--- a/modules/nixos/services/buildbot.nix
+++ b/modules/nixos/services/buildbot.nix
@@ -8,7 +8,7 @@
 }:
 let
   inherit (lib) mkIf mkMerge;
-  inherit (self.lib) mkServiceOption mkSystemSecret;
+  inherit (self.lib) mkServiceOption mkSecret;
 
   inherit (config.sops) secrets;
 
@@ -27,23 +27,23 @@ in
   config = mkIf cfg.enable (mkMerge [
     {
       sops.secrets = {
-        buildbot-worker = mkSystemSecret {
+        buildbot-worker = mkSecret {
           file = "buildbot";
           key = "worker";
         };
-        buildbot-workers = mkSystemSecret {
+        buildbot-workers = mkSecret {
           file = "buildbot";
           key = "workers";
         };
-        buildbot-gh-webhook-secret = mkSystemSecret {
+        buildbot-gh-webhook-secret = mkSecret {
           file = "buildbot";
           key = "gh-webhook-secret";
         };
-        buildbot-gh-private-key = mkSystemSecret {
+        buildbot-gh-private-key = mkSecret {
           file = "buildbot";
           key = "gh-private-key";
         };
-        buildbot-gh-oauth = mkSystemSecret {
+        buildbot-gh-oauth = mkSecret {
           file = "buildbot";
           key = "gh-oauth";
         };
@@ -93,8 +93,8 @@ in
 
     (mkIf config.garden.services.attic.enable {
       age.secrets = {
-        attic-prod-auth-token = mkSystemSecret { file = "attic/prod-auth-token"; };
-        attic-netrc = mkSystemSecret { file = "attic/netrc"; };
+        attic-prod-auth-token = mkSecret { file = "attic/prod-auth-token"; };
+        attic-netrc = mkSecret { file = "attic/netrc"; };
       };
 
       # Add netrc file for this machine to do its normal thing with the cache, as a machine.
diff --git a/modules/nixos/services/cloudflared.nix b/modules/nixos/services/cloudflared.nix
index 907b3504..1365581a 100644
--- a/modules/nixos/services/cloudflared.nix
+++ b/modules/nixos/services/cloudflared.nix
@@ -6,7 +6,7 @@
 }:
 let
   inherit (lib) mkIf;
-  inherit (self.lib) mkServiceOption mkSystemSecret;
+  inherit (self.lib) mkServiceOption mkSecret;
 
   cfg = config.garden.services.cloudflared;
 in
@@ -16,7 +16,7 @@ in
   };
 
   config = mkIf cfg.enable {
-    sops.secrets.cloudflared-athena = mkSystemSecret {
+    sops.secrets.cloudflared-athena = mkSecret {
       file = "cloudflare";
       key = "athena";
     };
diff --git a/modules/nixos/services/forgejo.nix b/modules/nixos/services/forgejo.nix
index 8a8d3be8..751436d9 100644
--- a/modules/nixos/services/forgejo.nix
+++ b/modules/nixos/services/forgejo.nix
@@ -10,7 +10,7 @@ let
   rdomain = config.networking.domain;
 
   inherit (lib) mkIf mkForce;
-  inherit (self.lib) mkServiceOption mkSystemSecret;
+  inherit (self.lib) mkServiceOption mkSecret;
 in
 {
   options.garden.services.forgejo = mkServiceOption "forgejo" {
@@ -20,14 +20,14 @@ in
 
   config = mkIf cfg.enable {
     sops.secrets = {
-      mailserver-git-nohash = mkSystemSecret {
+      mailserver-git-nohash = mkSecret {
         file = "mailserver";
         key = "git-nohash";
         owner = "forgejo";
         group = "forgejo";
       };
 
-      anubis-forgejo = mkSystemSecret {
+      anubis-forgejo = mkSecret {
         file = "anubis";
         key = "forgejo";
         owner = "anubis";
diff --git a/modules/nixos/services/immich.nix b/modules/nixos/services/immich.nix
index d7d7eb28..d75c9ac4 100644
--- a/modules/nixos/services/immich.nix
+++ b/modules/nixos/services/immich.nix
@@ -9,7 +9,7 @@ let
   rdomain = config.networking.domain;
 
   inherit (lib) mkIf;
-  inherit (self.lib) mkServiceOption mkSystemSecret;
+  inherit (self.lib) mkServiceOption mkSecret;
 in
 {
   options.garden.services.immich = mkServiceOption "immich" {
@@ -22,11 +22,11 @@ in
     garden.services.postgresql.enable = true;
 
     sops.secrets = {
-      immich-clientid = mkSystemSecret {
+      immich-clientid = mkSecret {
         file = "immich";
         key = "clientid";
       };
-      borg-immich-pass = mkSystemSecret {
+      borg-immich-pass = mkSecret {
         file = "borg";
         key = "immich-passphrase";
       };
diff --git a/modules/nixos/services/kanidm.nix b/modules/nixos/services/kanidm.nix
index 184089d1..bb7113a7 100644
--- a/modules/nixos/services/kanidm.nix
+++ b/modules/nixos/services/kanidm.nix
@@ -10,7 +10,7 @@
 }:
 let
   inherit (lib) mkIf;
-  inherit (self.lib) mkServiceOption mkSystemSecret;
+  inherit (self.lib) mkServiceOption mkSecret;
 
   rdomain = config.networking.domain;
   certs = config.security.acme.certs.${rdomain};
@@ -31,42 +31,42 @@ in
     };
 
     sops.secrets = {
-      kanidm-admin-password = mkSystemSecret {
+      kanidm-admin-password = mkSecret {
         file = "kanidm";
         key = "admin-password";
         owner = "kanidm";
         group = "kanidm";
         mode = "440";
       };
-      kanidm-idm-admin-password = mkSystemSecret {
+      kanidm-idm-admin-password = mkSecret {
         file = "kanidm";
         key = "idm-admin-password";
         owner = "kanidm";
         group = "kanidm";
         mode = "440";
       };
-      kanidm-oauth2-forgejo = mkSystemSecret {
+      kanidm-oauth2-forgejo = mkSecret {
         file = "kanidm";
         key = "oauth2-forgejo";
         owner = "kanidm";
         group = "kanidm";
         mode = "440";
       };
-      kanidm-oauth2-linkwarden = mkSystemSecret {
+      kanidm-oauth2-linkwarden = mkSecret {
         file = "kanidm";
         key = "oauth2-linkwarden";
         owner = "kanidm";
         group = "kanidm";
         mode = "440";
       };
-      kanidm-oauth2-wakapi = mkSystemSecret {
+      kanidm-oauth2-wakapi = mkSecret {
         file = "kanidm";
         key = "oauth2-linkwarden";
         owner = "kanidm";
         group = "kanidm";
         mode = "440";
       };
-      kanidm-oauth2-immich = mkSystemSecret {
+      kanidm-oauth2-immich = mkSecret {
         file = "kanidm";
         key = "oauth2-immich";
         owner = "kanidm";
diff --git a/modules/nixos/services/lego.nix b/modules/nixos/services/lego.nix
index 12df9431..3a94b591 100644
--- a/modules/nixos/services/lego.nix
+++ b/modules/nixos/services/lego.nix
@@ -6,7 +6,7 @@
 }:
 let
   inherit (lib) mkIf;
-  inherit (self.lib) mkSystemSecret;
+  inherit (self.lib) mkSecret;
 in
 {
   # FIXME: this seems to fail to fail on certain systems
@@ -29,14 +29,14 @@ in
 
   config = mkIf config.garden.services.nginx.enable {
     sops.secrets = {
-      lego-cloudflare = mkSystemSecret {
+      lego-cloudflare = mkSecret {
         file = "lego";
         key = "cloudflare";
         owner = "nginx";
         group = "nginx";
       };
 
-      lego-bunny = mkSystemSecret {
+      lego-bunny = mkSecret {
         file = "lego";
         key = "bunny";
         owner = "nginx";
diff --git a/modules/nixos/services/mailserver.nix b/modules/nixos/services/mailserver.nix
index dc8034f2..c54e1122 100644
--- a/modules/nixos/services/mailserver.nix
+++ b/modules/nixos/services/mailserver.nix
@@ -8,7 +8,7 @@
 }:
 let
   inherit (lib) mkIf mkForce;
-  inherit (self.lib) mkServiceOption mkSystemSecret;
+  inherit (self.lib) mkServiceOption mkSecret;
 
   rdomain = config.networking.domain;
   cfg = config.garden.services.mailserver;
@@ -25,39 +25,39 @@ in
     };
 
     sops.secrets = {
-      mailserver-isabel = mkSystemSecret {
+      mailserver-isabel = mkSecret {
         file = "mailserver";
         key = "isabel";
       };
-      mailserver-jobs = mkSystemSecret {
+      mailserver-jobs = mkSecret {
         file = "mailserver";
         key = "jobs";
       };
-      mailserver-robin = mkSystemSecret {
+      mailserver-robin = mkSecret {
         file = "mailserver";
         key = "robin";
       };
-      mailserver-vaultwarden = mkSystemSecret {
+      mailserver-vaultwarden = mkSecret {
         file = "mailserver";
         key = "vaultwarden";
       };
-      mailserver-database = mkSystemSecret {
+      mailserver-database = mkSecret {
         file = "mailserver";
         key = "database";
       };
-      mailserver-grafana = mkSystemSecret {
+      mailserver-grafana = mkSecret {
         file = "mailserver";
         key = "grafana";
       };
-      mailserver-git = mkSystemSecret {
+      mailserver-git = mkSecret {
         file = "mailserver";
         key = "git";
       };
-      mailserver-noreply = mkSystemSecret {
+      mailserver-noreply = mkSecret {
         file = "mailserver";
         key = "noreply";
       };
-      mailserver-spam = mkSystemSecret {
+      mailserver-spam = mkSecret {
         file = "mailserver";
         key = "spam";
       };
diff --git a/modules/nixos/services/matrix.nix b/modules/nixos/services/matrix.nix
index 93b4a8ad..8de15ccf 100644
--- a/modules/nixos/services/matrix.nix
+++ b/modules/nixos/services/matrix.nix
@@ -7,7 +7,7 @@
 }:
 let
   inherit (lib.modules) mkIf;
-  inherit (self.lib) mkServiceOption mkSystemSecret;
+  inherit (self.lib) mkServiceOption mkSecret;
 
   rdomain = config.networking.domain;
 
@@ -35,7 +35,7 @@ in
   };
 
   config = mkIf cfg.enable {
-    sops.secrets.matrix = mkSystemSecret {
+    sops.secrets.matrix = mkSecret {
       file = "matrix";
       owner = "matrix-synapse";
     };
diff --git a/modules/nixos/services/nixpkgs-prs-bot.nix b/modules/nixos/services/nixpkgs-prs-bot.nix
index dacc9a3d..3a401256 100644
--- a/modules/nixos/services/nixpkgs-prs-bot.nix
+++ b/modules/nixos/services/nixpkgs-prs-bot.nix
@@ -6,7 +6,7 @@
 }:
 let
   inherit (lib) mkIf mkMerge mkEnableOption;
-  inherit (self.lib) mkServiceOption mkSystemSecret;
+  inherit (self.lib) mkServiceOption mkSecret;
 
   cfg = config.garden.services.nixpkgs-prs-bot;
 in
@@ -24,7 +24,7 @@ in
     }
 
     (mkIf cfg.fedi.enable {
-      sops.secrets.nixpkgs-prs-bot-fedi = mkSystemSecret {
+      sops.secrets.nixpkgs-prs-bot-fedi = mkSecret {
         file = "nixpkgs-prs-bot";
         key = "fedi";
       };
@@ -36,7 +36,7 @@ in
     })
 
     (mkIf cfg.bsky.enable {
-      sops.secrets.nixpkgs-prs-bot-bsky = mkSystemSecret {
+      sops.secrets.nixpkgs-prs-bot-bsky = mkSecret {
         file = "nixpkgs-prs-bot";
         key = "bsky";
       };
diff --git a/modules/nixos/services/pds/default.nix b/modules/nixos/services/pds/default.nix
index f8554d1b..0ab5a1a8 100644
--- a/modules/nixos/services/pds/default.nix
+++ b/modules/nixos/services/pds/default.nix
@@ -10,7 +10,7 @@ let
   gkCfg = config.garden.services.pds-gatekeeper;
 
   inherit (lib) mkIf concatStringsSep;
-  inherit (self.lib) mkServiceOption mkSystemSecret;
+  inherit (self.lib) mkServiceOption mkSecret;
 in
 {
   options.garden.services = {
@@ -30,13 +30,13 @@ in
 
   config = mkIf cfg.enable {
     sops.secrets = {
-      pds-env = mkSystemSecret {
+      pds-env = mkSecret {
         file = "pds";
         owner = "pds";
         group = "pds";
       };
 
-      pds-dash = mkSystemSecret { file = "pds"; };
+      pds-dash = mkSecret { file = "pds"; };
     };
 
     services = {
diff --git a/modules/nixos/services/piper.nix b/modules/nixos/services/piper.nix
index 9098ebdf..a96c25df 100644
--- a/modules/nixos/services/piper.nix
+++ b/modules/nixos/services/piper.nix
@@ -6,7 +6,7 @@
 }:
 let
   inherit (lib) mkIf;
-  inherit (self.lib) mkServiceOption mkSystemSecret;
+  inherit (self.lib) mkServiceOption mkSecret;
 
   rdomain = config.networking.domain;
 
@@ -20,7 +20,7 @@ in
 
   config = mkIf cfg.enable {
     sops.secrets = {
-      piper = mkSystemSecret {
+      piper = mkSecret {
         file = "piper";
         key = "env";
       };
diff --git a/modules/nixos/services/vaultwarden.nix b/modules/nixos/services/vaultwarden.nix
index cd112d71..47e39aa3 100644
--- a/modules/nixos/services/vaultwarden.nix
+++ b/modules/nixos/services/vaultwarden.nix
@@ -6,7 +6,7 @@
 }:
 let
   inherit (lib) mkIf;
-  inherit (self.lib) mkServiceOption mkSystemSecret;
+  inherit (self.lib) mkServiceOption mkSecret;
 
   rdomain = config.networking.domain;
   cfg = config.garden.services.vaultwarden;
@@ -18,7 +18,7 @@ in
   };
 
   config = mkIf cfg.enable {
-    sops.secrets.vaultwarden-env = mkSystemSecret {
+    sops.secrets.vaultwarden-env = mkSecret {
       file = "vaultwarden";
       key = "env";
       owner = "vaultwarden";
diff --git a/modules/nixos/services/wakapi.nix b/modules/nixos/services/wakapi.nix
index 0230300e..51774cf2 100644
--- a/modules/nixos/services/wakapi.nix
+++ b/modules/nixos/services/wakapi.nix
@@ -7,7 +7,7 @@
 let
   inherit (lib.modules) mkIf;
   inherit (self.lib.services) mkServiceOption;
-  inherit (self.lib) mkSystemSecret;
+  inherit (self.lib) mkSecret;
 
   rdomain = config.networking.domain;
   cfg = config.garden.services.wakapi;
@@ -20,21 +20,21 @@ in
 
   config = mkIf cfg.enable {
     sops.secrets = {
-      wakapi = mkSystemSecret {
+      wakapi = mkSecret {
         file = "wakapi";
         owner = "wakapi";
         group = "wakapi";
         key = "password";
       };
 
-      wakapi-mailer = mkSystemSecret {
+      wakapi-mailer = mkSecret {
         file = "wakapi";
         owner = "wakapi";
         group = "wakapi";
         key = "mailer";
       };
 
-      wakapi-env = mkSystemSecret {
+      wakapi-env = mkSecret {
         file = "wakapi";
         owner = "wakapi";
         group = "wakapi";
-- 
2.51.2