nix-config/modules/nixos/core/sops.nix

{ inputs, ... }:
{
  flake.modules.nixos.core =
    {
      config,
      pkgs,
      ...
    }:
    let
      isEd25519 = k: k.type == "ed25519";
      getKeyPath = k: k.path;
      keys = builtins.filter isEd25519 config.services.openssh.hostKeys;
    in
    {
      imports = [ inputs.sops-nix.nixosModules.sops ];

      sops.age = {
        sshKeyPaths = map getKeyPath keys;
        keyFile = "/var/lib/sops-nix/key.txt";
        generateKey = true;
      };

      environment.systemPackages = with pkgs; [ sops ];
    };
}