refactor: move secrets off-shore

modules/nixos/base/admin.nix

@@ -1,10 +1,10 @@
 {
   config,
   pkgs,
-  keys,
   ...
 }: let
   inherit (config.ooknet.host) admin;
+  inherit (config.ooknet.secrets) keys;
 
   ifTheyExist = groups: builtins.filter (group: builtins.hasAttr group config.users.groups) groups;
 in {

modules/nixos/base/default.nix

@@ -7,7 +7,6 @@
     ./admin.nix
     ./locale.nix
     ./options.nix
-    ./secrets.nix
     ./openssh.nix
     ./tailscale.nix
     ./networking.nix

modules/nixos/base/distributed-builds.nix

@@ -1,5 +1,4 @@
 {
-  keys,
   config,
   lib,
   ...
@@ -7,6 +6,7 @@
   inherit (lib) mkIf;
   inherit (config.ooknet.host) admin;
   inherit (config.networking) hostName;
+  inherit (config.ooknet.secrets) keys;
 
   mkBuilderMachine = {
     host,

modules/nixos/base/nix.nix

@@ -23,7 +23,6 @@ in {
     defaultPackages = [];
     systemPackages = attrValues {
       inherit (pkgs) git deadnix statix;
-      inherit (inputs'.agenix.packages) default;
     };
 
     # location of the configuration flake

modules/nixos/base/secrets.nix

@@ -1,43 +0,0 @@
-{
-  config,
-  lib,
-  self,
-  ...
-}: let
-  inherit (lib) mkIf;
-
-  inherit (config.ooknet) host;
-  inherit (host) admin;
-  inherit (config.services) tailscale transmission;
-in {
-  age.identityPaths = [
-    "/home/${admin.name}/.ssh/id_ed25519"
-  ];
-
-  age.secrets = {
-    tailscale-auth = mkIf tailscale.enable {
-      file = "${self}/secrets/tailscale-auth.age";
-      mode = "444";
-    };
-    github_key = mkIf admin.homeManager {
-      file = "${self}/secrets/github_key.age";
-      path = "/home/${admin.name}/.ssh/github_key";
-      owner = "${admin.name}";
-      group = "users";
-    };
-    ooknet_org = mkIf admin.homeManager {
-      file = "${self}/secrets/ooknet_org.age";
-      path = "/home/${admin.name}/.ssh/ooknet_org";
-      owner = "${admin.name}";
-      group = "users";
-    };
-    spotify_key = mkIf admin.homeManager {
-      file = "${self}/secrets/spotify_key.age";
-      owner = "${admin.name}";
-      group = "users";
-    };
-    "mullvad_wg.conf" = mkIf transmission.enable {
-      file = "${self}/secrets/mullvad_wg.age";
-    };
-  };
-}