mdy/nix-config
1
0
Fork 0
Code Pull Requests Activity

feat: add exa/context7 secrets, enable greedy cask upgrades

Browse Source
This commit is contained in:
imbytecat
2026-04-11 23:53:27 +08:00
parent fbd6761040
commit 09acb83206
3 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
home/secrets.nix
+5 -1
View File
@@ -9,6 +9,8 @@
secrets = { secrets = {
ai_gateway_base_url = { }; ai_gateway_base_url = { };
ai_gateway_api_key = { }; ai_gateway_api_key = { };
exa_api_key = { };
context7_api_key = { };
}; };
}; };
@@ -16,7 +18,9 @@
# sops-nix secrets → env vars # sops-nix secrets → env vars
for pair in \ for pair in \
AI_GATEWAY_BASE_URL:${config.sops.secrets.ai_gateway_base_url.path} \ AI_GATEWAY_BASE_URL:${config.sops.secrets.ai_gateway_base_url.path} \
AI_GATEWAY_API_KEY:${config.sops.secrets.ai_gateway_api_key.path} AI_GATEWAY_API_KEY:${config.sops.secrets.ai_gateway_api_key.path} \
EXA_API_KEY:${config.sops.secrets.exa_api_key.path} \
CONTEXT7_API_KEY:${config.sops.secrets.context7_api_key.path}
set -l parts (string split : $pair) set -l parts (string split : $pair)
if test -r $parts[2] if test -r $parts[2]
set -gx $parts[1] (cat $parts[2]) set -gx $parts[1] (cat $parts[2])
modules/darwin/default.nix
+2
View File
@@ -53,6 +53,7 @@
# ── Homebrew ─────────────────────────────────────── # ── Homebrew ───────────────────────────────────────
homebrew = { homebrew = {
enable = true; enable = true;
greedyCasks = true; # always upgrade casks even if they auto-update
taps = [ taps = [
"goooler/repo" "goooler/repo"
@@ -98,6 +99,7 @@
onActivation = { onActivation = {
autoUpdate = true; autoUpdate = true;
upgrade = true;
cleanup = "zap"; # remove anything not declared above cleanup = "zap"; # remove anything not declared above
}; };
}; };
secrets/secrets.yaml
+4 -2
View File
@@ -1,5 +1,7 @@
ai_gateway_base_url: ENC[AES256_GCM,data:5/F4Tp6O4cYcpV6j00WOk2kXRd9iUorvD2Fl5LWKy9yJgfA=,iv:f09QoozjEEvblSOlDutw3CODju6DlTOKSjgPS5ypfJQ=,tag:ojD9CbG6ZiL3qlUzTcp4/w==,type:str] ai_gateway_base_url: ENC[AES256_GCM,data:5/F4Tp6O4cYcpV6j00WOk2kXRd9iUorvD2Fl5LWKy9yJgfA=,iv:f09QoozjEEvblSOlDutw3CODju6DlTOKSjgPS5ypfJQ=,tag:ojD9CbG6ZiL3qlUzTcp4/w==,type:str]
ai_gateway_api_key: ENC[AES256_GCM,data:bGr4RGGOANmUNY8fZzhdq4/0hdc+3g9adFaNoXTOAF823iZAbtLi6jC7EXVrDJYuTjBH,iv:YLMecyk3yIAcSY63gmEJm7NJcFD9vE0D8zqb1vNJd98=,tag:w1GThmuY3aBNr15VPOtuNg==,type:str] ai_gateway_api_key: ENC[AES256_GCM,data:bGr4RGGOANmUNY8fZzhdq4/0hdc+3g9adFaNoXTOAF823iZAbtLi6jC7EXVrDJYuTjBH,iv:YLMecyk3yIAcSY63gmEJm7NJcFD9vE0D8zqb1vNJd98=,tag:w1GThmuY3aBNr15VPOtuNg==,type:str]
exa_api_key: ENC[AES256_GCM,data:DqZXFCHP1wpzrvXzLtmtooqKV0ljLTmAARWnfyFjm+tDmqMl,iv:7cDwuVudmWkwoI77XX5azmuOUKrUL3akI53wDc5CJks=,tag:BJZl7M0C9EQAnELcrWYN4Q==,type:str]
context7_api_key: ENC[AES256_GCM,data:XjwUQSarEtvWA0wnbRDn8QqFxSpCQphpzgTSeK2NVcn7Z0GLTpUkalCcFg==,iv:ttULoAsJ/4PhuE/LIVok7CaekVWO3FHwKGhjUQiG0E0=,tag:Va7wdsz90LF4LWpeQYP6Iw==,type:str]
sops: sops:
age: age:
- recipient: age1w74wqpmum6xa3mk5p7ya620e8mhn9afdyf30gh3fk44javxsmvssm4hs64 - recipient: age1w74wqpmum6xa3mk5p7ya620e8mhn9afdyf30gh3fk44javxsmvssm4hs64
@@ -11,7 +13,7 @@ sops:
YUFlVW1IcGpVdjRsMmlmL1lOeEQzY1EKH1K2NomPsote6PGp30ZASKKwQoZi9x5F YUFlVW1IcGpVdjRsMmlmL1lOeEQzY1EKH1K2NomPsote6PGp30ZASKKwQoZi9x5F
UWPj6xphWXp/7lFE7XpujKU323tFj7mZ+wRCb77T9QTNbg8zGsUO/A== UWPj6xphWXp/7lFE7XpujKU323tFj7mZ+wRCb77T9QTNbg8zGsUO/A==
-----END AGE ENCRYPTED FILE----- -----END AGE ENCRYPTED FILE-----
lastmodified: "2026-04-10T17:42:34Z" lastmodified: "2026-04-11T15:51:24Z"
mac: ENC[AES256_GCM,data:dVVNOi8k8mmw1aRr1AXUDoF1UdF48HOPfX69Fh/mY9+HzZrIYCukqI4548eL0KcqCrbo0yEtTOYfg6PzckxpGA5FQRVv7qrfimkpFntbWoUzY8dy0pXxKFUxUuHW43XXpqkq1ZmVX5B6/fzkNxiLu4YY9X2Qnf840O/1E0fYaWw=,iv:UFfdK6I2SeGrBz12OcCjAycq7dFPfsAxploBvk+4Zic=,tag:6qLU79NwlKLApErYAoJIVQ==,type:str] mac: ENC[AES256_GCM,data:x3Os/6i9jdmyIitD2dnz9Dl2GPLDVQlbPfVMRnebixFJ5fX6L0BqPRVVG20FvtCUQSzTMKp5eVZPRtti3wkr5TyQHz/0bz65B7Ucq3ssnpz0Hh/X8JyLRb6dKyRiiE3kIHf82nq+Do5oFUEG95LmRvhvbVdIzdMF/TJNVXOd4DQ=,iv:hIljr/1Y0Ra02Y4PwykNjhhxzxYFeMc1/waSCEy2skA=,tag:NoLozwKMPZVxKAg8g6R3UA==,type:str]
unencrypted_suffix: _unencrypted unencrypted_suffix: _unencrypted
version: 3.12.2 version: 3.12.2