From fc77fdeee8d22d91a7694be6816d8d69f930dd6a Mon Sep 17 00:00:00 2001
From: Adam Hellberg <sharparam@sharparam.com>
Date: Tue, 6 Oct 2026 20:13:56 +0200
Subject: [PATCH] Configure radicle for sif

Signed-off-by: Adam Hellberg <sharparam@sharparam.com>
Change-Id: Ib3ef38f40d5e4763061b5b7ce843c7726a6a6964
---
 .sops.yaml                                |  7 ++++
 modules/hosts/sif/sharparam/secrets.yaml  | 49 +++++++++++++++++++++++
 modules/hosts/sif/sharparam/sharparam.nix | 11 +++++
 modules/hosts/sif/sharparam/sops.nix      | 13 ++++++
 4 files changed, 80 insertions(+)
 create mode 100644 modules/hosts/sif/sharparam/secrets.yaml
 create mode 100644 modules/hosts/sif/sharparam/sharparam.nix
 create mode 100644 modules/hosts/sif/sharparam/sops.nix

diff --git a/.sops.yaml b/.sops.yaml
index 4324201..2662a21 100644
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -39,6 +39,13 @@ creation_rules:
           - *yk_backup_age
           - *yk_5c_main_age
           - *sharparam-melina
+  - path_regex: ^modules/hosts/sif/sharparam/secrets.(ya?ml|json|env|ini)$
+    key_groups:
+      - age:
+        - *yk_main_age
+        - *yk_backup_age
+        - *yk_5c_main_age
+        - *sharparam-sif
   - path_regex: ^modules/hosts/NINETECH-617128/secrets.(ya?ml|json|env|ini)$
     key_groups:
       - age:
diff --git a/modules/hosts/sif/sharparam/secrets.yaml b/modules/hosts/sif/sharparam/secrets.yaml
new file mode 100644
index 0000000..0a033b4
--- /dev/null
+++ b/modules/hosts/sif/sharparam/secrets.yaml
@@ -0,0 +1,49 @@
+radicle:
+    passphrase: ENC[AES256_GCM,data:iqBhVqxcndBJUj5akDt8M6tUCiea,iv:x2wksH0KcXYcHP+Zer42U/cmO3pFgG7dhFZarWfeEg0=,tag:wtAJesvsGO9oxrt48wnBug==,type:str]
+    public-key: ""
+    private-key: ""
+sops:
+    age:
+        - recipient: age1yubikey1qf2pqf4uhz9nhppcvsg0wl6d24nmrc8wthz6rnthkv0s96th8a9mzqhgul5
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IFZiQVNqUSBBaFJLTE8y
+            M0ZVelVkMGZ5eGE1bFIxcFZHd3p4Z2hxQWlTQkRxRGFmR2lqZwpyTm9KTFRCUDBn
+            UXBSQlFnNnpWN1JXNHNha2dTbW5PQ251eW9Jd3JjeTVFCi0tLSBkbk1sT0g3UDg0
+            SThMdjFQOWRRcEUweXU2ZVlUSGZFR1IrQ2VzTGZscC84Cq8ZYR1+RtRvt+G0oz9W
+            TWMALoBxJPWFbCxXm7z7H6ujudMIvCJCACHbgmMcbOLn1AE4GK19gON0Er55Su6s
+            CD0=
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1yubikey1q08fhw5fzt7a24ehl6nk92va6matuqd37h3e294kmum66mucq5wkkfhcjwx
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHVmbU5nUSBBdUp6cTBL
+            Ti9DYUF6T0gxaHNuMi9jUUZ1SGZ1RkxIUzFRa0ZtTW4yUS9SRwo5NnRYclBqeElJ
+            UDU5dW94QzhxU3hEemhHYjRCSU1ZcUpkQXNxLzVLdFRZCi0tLSBlNGQyM1FtdlYr
+            emVMLzdtRkxxRFgzbm9yZ2c5a0h2bXdjUktHbGJ2cTZ3ChZp4k3dmc/uLa/8PsRz
+            +xVXfaPb1XBGoDOtvq5AVUUyh3UoopX7BzV+WLbJjySNAQAizcvNdSyfFvFQQ/w1
+            pK0=
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1yubikey1q2dcpyyfhhj6veu9zct8kvxs97nul3jnefvyz5vx9z4382xuujdcyxygj35
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IHgwclE3dyBBMVVrcEhl
+            ek9JeWtPSFFmVHQ2eXJFSThYV0ZIWmIrMlo3RmJzaXlxQW1qVQo5Q1RXeG9HOVFs
+            czRtVTZyczVpaTJiUXYyMFEyMGtkeUpBYmdYSzFNNUIwCi0tLSBUU3kxMktnbk1h
+            bFd6aFlCZC9hR1ZXYVVkWUZnMk1wMGNOZSs0SG9yK2I4CokrIhYCbDcN1TKV3msc
+            fIyGIhyfBvSXjhGTYSAIjFtlTNle3ir0W/sMEv7RjwXvEyZB+imPpenXeKrxUQ7/
+            Muo=
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age127wk9zrxww2ghxdr0d2u2qummk6dpm29gfqxvx5zvyazju9xychs899m2u
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJY0tGb1BqT3U1TG1RYTgw
+            VFAwMnY2NzdjcnlMbGh5Mno5dzVvNitreTA4CmRrNVVGaWlaWFJ2cmo4UzU5MGdX
+            VjFHa04vRldZNGZsb1BndnpwWGdIYncKLS0tIGJFaGE2SHhpdUhQbjFxMFcvam0r
+            cDZSSXJnYm1IYURYY25XV1ozQXliSWsKIHQO62fxfpt7tqi2zabMtJD7qT9/PRk0
+            ht9s/Hoke3s6UZm3aAyxBpDfjoGWWc/nw2UkHRfqGaespvcuWMA84w==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-10-06T18:13:54Z"
+    mac: ENC[AES256_GCM,data:J+9/FfwztbszJDONV8WambPZDIoyQXbpBbwx+qYMOu00ttzZ5s6mbF3ZdzEv2IlJtbFyojPHrBvWxiVBpDirs1dcj17Bt/ilPhtfi/ahRl7iL9UCPC4g6ssoQLvWx05S97uQIX6oCV2RAcz5WiTbQociXDErsb4CXjgJou89c4I=,iv:7w56+H1sb5AP6YmC6Oi5GdIAxLdJlAZ+BiIZOs7z4Uo=,tag:+QE4gxpwpdDr7YhX6X8/1w==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.12.2
diff --git a/modules/hosts/sif/sharparam/sharparam.nix b/modules/hosts/sif/sharparam/sharparam.nix
new file mode 100644
index 0000000..e2cedd0
--- /dev/null
+++ b/modules/hosts/sif/sharparam/sharparam.nix
@@ -0,0 +1,11 @@
+{den, ...}: let
+  hostname = "sif";
+  username = "sharparam";
+  identifier = "${username}@${hostname}";
+in {
+  den.aspects."${username}".provides."${hostname}" = {
+    includes = [
+      den.aspects."${identifier}".provides.secrets
+    ];
+  };
+}
diff --git a/modules/hosts/sif/sharparam/sops.nix b/modules/hosts/sif/sharparam/sops.nix
new file mode 100644
index 0000000..76e46e5
--- /dev/null
+++ b/modules/hosts/sif/sharparam/sops.nix
@@ -0,0 +1,13 @@
+let
+  hostname = "sif";
+  username = "sharparam";
+  identifier = "${username}@${hostname}";
+in {
+  den.aspects."${identifier}".provides.secrets = {
+    homeManager.sops.secrets = {
+      "radicle/passphrase".sopsFile = ./secrets.yaml;
+      "radicle/public-key".sopsFile = ./secrets.yaml;
+      "radicle/private-key".sopsFile = ./secrets.yaml;
+    };
+  };
+}
-- 
2.54.0