feat: switch over secret consumers to central secret loading

Signed-off-by: Reputable2722 <153411261+Reputable2772@users.noreply.github.com>

Author: Reputable2772

Config/config.nix

@@ -383,7 +383,10 @@ rec {
   "important-files.age".publicKeys = [ users.wickedwizard.secrets.encryption.key ];
 
   # Rclone config file
-  "rclone.age".publicKeys = [ users.wickedwizard.secrets.encryption.key ];
+  "rclone.age" = {
+    publicKeys = [ users.wickedwizard.secrets.encryption.key ];
+    dontLoad = true;
+  };
 
   # Container files
   "containers-backup-pwd.age".publicKeys = [ users.wickedwizard.secrets.encryption.key ];

System/HP-Laptop/users.nix

@@ -8,10 +8,6 @@
   ...
 }:
 {
-  age.secrets.selfhostedPassword.file = ../../Config/selfhostedPassword.age;
-  age.secrets.rootPassword.file = ../../Config/rootPassword.age;
-  age.secrets.guestPassword.file = ../../Config/guestPassword.age;
-
   users.mutableUsers = false;
   users.users.root.hashedPasswordFile = config.age.secrets.rootPassword.path;
   users.users.selfhosted = {

System/Lenovo-Laptop/Misc/bitlocker.nix

@@ -7,7 +7,6 @@
 }:
 let
   inherit (lib.attrsets)
-    mapAttrs
     mapAttrs'
     nameValuePair
     ;
@@ -22,12 +21,6 @@ let
     ) cond;
 in
 {
-  age.secrets = onlyIf (
-    mapAttrs (n: v: {
-      file = ./. + "../../../../Config/${n}.age";
-    }) config'.system.${config.networking.hostName}.mounts.bitlocker
-  );
-
   systemd.services = onlyIf (
     mapAttrs' (
       n: v:

System/Lenovo-Laptop/users.nix

@@ -14,10 +14,6 @@
   # Shell autocomplete for HM's ZSH.
   environment.pathsToLink = [ "/share/zsh" ];
 
-  age.secrets.wickedwizardPassword.file = ../../Config/wickedwizardPassword.age;
-  age.secrets.rootPassword.file = ../../Config/rootPassword.age;
-  age.secrets.guestPassword.file = ../../Config/guestPassword.age;
-
   users.mutableUsers = false;
   users.users.root.hashedPasswordFile = config.age.secrets.rootPassword.path;
   users.users.wickedwizard = {

Users/WickedWizard/Programs/Backup/backup.nix

@@ -20,8 +20,6 @@ in
   };
 
   config = {
-    age.secrets."${config.home.username}-backup".file = ../../../../Config/wickedwizard-backup.age;
-
     services.restic = {
       enable = true;
       backups.${config.home.username} = {

Users/WickedWizard/Programs/Backup/rclone.nix

@@ -12,7 +12,7 @@
     lib.optionalAttrs (config'.secrets ? rcloneAgeFile && config'.secrets.rcloneAgeFile != null)
       {
         rclone = {
-          file = ./. + "../../../../../Config/${config'.secrets.rcloneAgeFile}.age";
+          file = ./. + "../../../../../Config/Secrets/${config'.secrets.rcloneAgeFile}.age";
           path = "${config.xdg.configHome}/rclone/rclone.conf";
         };
       };

Users/WickedWizard/Programs/Selfhosted/Containers/default.nix

@@ -1,4 +1,7 @@
-{
+{ config', lib, ... }: {
+  programs.quadlets.enable =
+    config'.dir ? containers && lib.strings.typeOf config'.dir.containers == "string";
+
   imports = [
     # ./baikal.nix
     ./caddy.nix
@@ -9,7 +12,6 @@
     ./ollama.nix
     ./podman-socket-proxy.nix
     ./radicale.nix
-    ./secrets-loader.nix
     ./syncthing.nix
     ./vaultwarden.nix
     ./wud.nix

Users/WickedWizard/Programs/Selfhosted/Containers/radicale.nix

@@ -63,9 +63,6 @@ in
 {
   containers.caddy.services.radicale = "radicale:5232";
 
-  # Mounted directly as a file, not an environment variable.
-  age.secrets.radicale.file = ../../../../../Config/radicale.age;
-
   programs.quadlets.quadlets."radicale.container" = {
     Container = {
       Image = "docker.io/tomsquest/docker-radicale";
@@ -95,6 +92,7 @@ in
       Volume = [
         "data:/data"
         "${pkgs.writeText "radicale-config" radicaleConfig}:/config/config:ro:noMap"
+        # Mounted directly as a file, not an environment variable.
         "${config.age.secrets.radicale.path}:${userFilePath}:noMap"
         "${birthdayHookShFile}:${birthdayHookSh}:noMap"
         "${sources.radicale_birthday_hook.src}${birthdayHook}:${birthdayHook}:noMap"

Users/WickedWizard/Programs/Selfhosted/Containers/secrets-loader.nix

@@ -7,7 +7,6 @@
 }:
 let
   inherit (config'.containers.backup)
-    pwdFile
     blacklistedContainers
     blacklistedPaths
     location
@@ -57,8 +56,6 @@ let
   ) config.programs.quadlets.finalQuadlets;
 in
 {
-  age.secrets.containers-backup-pwd.file = ./. + "../../../../../Config/${pwdFile}.age";
-
   services.restic = {
     enable = true;
     backups.containers = {