chore(cleanup): sops, opencode, etc

modules/darwin/security/sops/default.nix

@@ -1,31 +1,35 @@
-{ config, lib, namespace, ... }:
+{ config
+, lib
+, namespace
+, ...
+}:
 let
+  inherit (lib) mkIf mkEnableOption types;
   inherit (lib.${namespace}) mkOpt;
+  getFile = lib.snowfall.fs.get-file;
 
+  user = config.users.users.${config.${namespace}.user.name};
   cfg = config.${namespace}.security.sops;
 in
 {
-  options.${namespace}.security.sops = {
-    enable = lib.mkEnableOption "sops";
-    defaultSopsFile = mkOpt lib.types.path null "Default sops file.";
-    sshKeyPaths = mkOpt (with lib.types; listOf path) [
-      "/etc/ssh/ssh_host_ed25519_key"
-    ] "SSH Key paths to use.";
+  options.${namespace}.security.sops = with types; {
+    enable = mkEnableOption "Enable sops";
+    defaultSopsFile = mkOpt str "secrets/systems/${config.system.name}.yaml" "Default sops file.";
+    sshKeyPaths = mkOpt (listOf path) [ ] "Additional SSH key paths to use.";
   };
 
-  config = lib.mkIf cfg.enable {
+  config = mkIf cfg.enable {
     sops = {
-      inherit (cfg) defaultSopsFile;
+      defaultSopsFile = getFile cfg.defaultSopsFile;
 
       age = {
-        inherit (cfg) sshKeyPaths;
-
-        keyFile = "${config.users.users.${config.${namespace}.user.name}.home}/.config/sops/age/keys.txt";
+        keyFile = "${user.home}/.config/sops/age/keys.txt";
+        sshKeyPaths = [ "${config.home.homeDirectory}/.ssh/id_ed25519" ] ++ cfg.sshKeyPaths;
       };
     };
 
     sops.secrets.builder_ssh_key = {
-      sopsFile = lib.snowfall.fs.get-file "secrets/default.yaml";
+      sopsFile = getFile "secrets/common/systems.yaml";
     };
   };
 }