dotfiles.nix/nixos/common/global/age.nix

{
  config,
  pkgs,
  inputs,
  ...
}: let
  hostname = config.networking.hostName;
in {
  imports = [
    inputs.agenix.nixosModules.default
    inputs.agenix-rekey.nixosModules.default
  ];

  nixpkgs.overlays = [
    inputs.agenix-rekey.overlays.default
  ];

  environment.systemPackages = with pkgs; [
    agenix-rekey
  ];

  age.rekey = {
    # Pubkey for rekeying
    hostPubkey = ../../${hostname}/ssh_host_ed25519_key.pub;
    # Master identity used for decryption
    masterIdentities = [../users/sajenim/agenix-rekey.pub];
    # Where we store the rekeyed secrets
    storageMode = "local";
    localStorageDir = ./. + "/secrets/rekeyed/${config.networking.hostName}";
  };
}