From e89908b5926a6a5b5a5abc2ba269e2fb9bf9e13e Mon Sep 17 00:00:00 2001
From: Julian Mutter <julian.mutter@comumail.de>
Date: Sun, 19 Jul 2026 13:56:33 +0200
Subject: [PATCH] builder: store nix-serve key in sops

---
 features-nixos/optional/binarycaches.nix | 2 +-
 hosts/builder/default.nix                | 3 ++-
 hosts/builder/secrets.yaml               | 7 ++++---
 3 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/features-nixos/optional/binarycaches.nix b/features-nixos/optional/binarycaches.nix
index 8b06bf6..3d43147 100644
--- a/features-nixos/optional/binarycaches.nix
+++ b/features-nixos/optional/binarycaches.nix
@@ -18,7 +18,7 @@
     trusted-public-keys = [
       "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
       "hyprland.cachix.org-1:a7pgxzMz7+chwVL3/pzj6jIBMioiJM7ypFP8PwtkuGc="
-      "binarycache.julian-mutter.de:oJ67uRFwRhNPKL58CHzy3QQLv38Kx7OA1K+6xlEPu7E="
+      "binarycache.julian-mutter.de:7RB4Sif4WQU76XWIsRJ2KtKa45zg1QOTHEkUhi/JBe8="
       "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
       "devenv.cachix.org-1:w1cLUi8dv3hnoSPGAuibQv+f9TZLr6cv/Hm9XgU50cw="
       "noctalia.cachix.org-1:pCOR47nnMEo5thcxNDtzWpOxNFQsBRglJzxWPp3dkU4="
diff --git a/hosts/builder/default.nix b/hosts/builder/default.nix
index b5b58a9..8626f79 100644
--- a/hosts/builder/default.nix
+++ b/hosts/builder/default.nix
@@ -181,9 +181,10 @@
   };
 
   # =========== Binary Cache ==========
+  sops.secrets."nix_serve_key".sopsFile = ./secrets.yaml;
   services.nix-serve = {
     enable = true;
-    secretKeyFile = "/var/cache-priv-key.pem";
+    secretKeyFile = config.sops.secrets."nix_serve_key".path;
   };
 
   # =========== Binary Cache with attic ==========
diff --git a/hosts/builder/secrets.yaml b/hosts/builder/secrets.yaml
index 0602456..a24f589 100644
--- a/hosts/builder/secrets.yaml
+++ b/hosts/builder/secrets.yaml
@@ -1,3 +1,4 @@
+nix_serve_key: ENC[AES256_GCM,data:uTWXYd437EzaA921PckMSlHpKBcKt0LiJ0hCUs1I0iBRpGfoGmPrYXdFbalEpMrj44mrY7kd1T8EdsD2J7yXn1zHR89JahF+hJqnlu8dQoNeBdkIDgNamcY9eNETU3QE1/PvVs4SylvzRfMpysVVfhUCaEdh,iv:7v2+XGleI7Jym36nfcBFkXal4s2hnGt+g5dQvHasGDc=,tag:kC+4Kqh0AT61Qrh6ZnlZ+Q==,type:str]
 gitlab_runner_token: ENC[AES256_GCM,data:6H/9h58DpDOJRgeiFl4PXnkEWywLml94t2+5L31xEqg0ZiWNe1cftO4wzG6l5oUz1awqXHpuXNNHjK1PwPxUwqbHwnRN0BN5g2r5CImLVd3KyV5ULWj3FeGPlrsQY8RyNrqRQocbL+Hoqjnzy/3zWywA0yQMx451yY4MDAnmPscSiyXW4Z4Yp3Xrbv0vRA6elg==,iv:wxsHRCTYqqD2IQhfU5yNipudn9q0sFlo3eV/GNLjjWA=,tag:8lx+gImsgRtCz7M6COM9mg==,type:str]
 gitea_token: ENC[AES256_GCM,data:0EnVkWyeqfAQqAMM5GCNbY5PhopctL/xJLYGk7Kw20rysLpJcX8cZKx/Mgxckg==,iv:PsIefe9r1WIjXL1qH5pcL8DVbxgfSYrFuKz20HWkEt8=,tag:/aWRlwzlx/xa+hfEU8cYow==,type:str]
 attic_token: ENC[AES256_GCM,data:6FUnkQk4f9lAlhPXGDljVl98s0I86BNQV0RQb2xc6vIv//izJUlk7LFROTQew9bd1nezUI8vpyMqRtkC2l2t2wrzLaX2JIS039NKaxgCnKPQlgBKlaxS/aZTXtonB/fHCZeIVpTU9OilJ8TXA0g6DGfgdzj7MFHZi23TJON+/yEqOOQVjT9qFVIbR6oz4L8pq8YI+rdNfUV3yyrBcPrxj0sjZaRjfWM4QYStkmj7m7++IUCWsGKVKTd3SXSWGi30glnk1RxyLhj9U4qnFKw+9Dt3wiIoWoexq1bEEiZ8KWiQ9PGCXzkco4zfQt6oVhkhSo+VTAS8bO/K8P9hT3YVqcfnldXRwZuFaKsp+2u2+8mmkbwXHtvFEg6ufnYJjqDNUtx4FoP/1t0urpMTz8lc6qNI/WEesv94YTico+gC0rEUkLSN0GHSC4sO3mIwYRaKM6CiEAey+f5E8TD+yIGRELRSbZfjwZiLcqauruq9BpW1ZsanLwPXYmyo/TR88cWlfvnugxEmZB3FhoXhm3cSTN4pRtaBVoZdatlyL7Jvhdr4igHd3cuigxeLTj89rvxkYXJznwQHkFfdi3/bepnuDGEP5gHgV61D/TVsNJk0d/4TnEQhDEgURS4P7DoIpItkgCnVfdP9d5ZOd0mNN7jiOQL5t6kUdTAhOfjr704a493IT+qexpnyFj4FUxwdAWqodrS/3x1oMBVG72tklIC2RmzFdvXWxPYOVPXHWrLDq4eSvCedzbXijKF0ThM7G1JieGK2y0/MaF5D2qLVQ5y5v9vgFSHqDCT1yXFLpDqXJ0GMmI3EQ4hM9EniWZEQVIvHi/uGI+IwJIZBt1Svu3v4q6bi94/TDtMcOQoJahbD4pn6E08lXZ0E32Sr1SGfF6WvjU8TzIkEY5c+SdbksnOZgcVuBGZdv5Mbjpcr29X55Q2ikf6nyCsmcBDv0FFyIijQtbexPocVnpx497Rw0uhPjyU/tYLHEVhYZEKee2v1bn1YRhIO1q/QcHSaSplNcG7lFztVIVZVeYMlyNqubUAn9w6/z9FVhzKvJOuZoE5fnWAhIiKtWlQ+bxkU1iRJREcBCHCcqNl5Y9KkvtXcFBJx2o5n+WIVDfmttLWB3ilipXYxXhw1YosliZTi6ESzhr3wihxxtWo1Oz/ZNBYJHWr2nEtXcay6tRg2JcsF8oOaAo2zAIj+2cM+zmomPSDt6NkBYf1xy/D9cKfaZy97ify9hgCQ9fPXeosinUvz9SoWuYbni3hk1IGtztLtA27mh4OMJ03exuzpchDKvJIUfayjdbkXTTag2Akre7EiXrHeKbVC9iV2EeoA6EPGHt9RPhrRbk182ca4YQE+KP8zTSJGS1msK1pisvhMo5RlH6f2Sg4PQHev/eFkYU4Lv/UymS7ijwH5832a7ZoYjhyQ5R3ycUPld5+1MOtFPGudAiSjbzyi/ugV1FCI9PbI5U8SkPq410Xf+hdCpH/BK7lr3Js6ZBwZTF8pClQiRsYghu1AcAMgW8YQXQ9wiIq9lx1oTGN6n4TW/QL2mA5f7zjEWzpAqoLlLU+9LVaUG4iBL4NyDJqAeOYaMNguRBRVr16NzFyqpzHO7ceG4BMKSvVRGWDFhHLDWK6AQClvDk+olqPIQX2nCQj2G7E+l3/70yK0AJmlzwJU9iD/4oP6Frvaqd+U+qhq8+Gzab/8WigQA594pJOflQyRHWwQP8y8bGjMm0/+o0GIeO8ZBGiVL9zzQuu7OiB0rLj9X4vJzz8n9OaHNZ5+US9DVrmI/u+hl47nhBrpCu7RFGt9VpBi8LWyLR7xAWR75nwzgBQEv0eGJQ+2Hf8jnLnVmIxRqzqCUJPI5latSeniIE25Fq2mUSebRDcj32e+b8kx8X+SjmvBtzOACwi/P+qdfnox0Lfcc5eFfqV+R8I+gczYTqRUIEKbwUgxyTsOwZ6XJDlvHIf68wZbqT8iB18YbltuMVFdvom93md91ZMzKujz7VtxirjW1bbFHSBQ31sN93c5TldYHgHmhnhtZTvpjf9mjzgufbCD+wlVRZF2K5LPPIxTSbsMam/5YU+wBGKBVLAHiN8Jt6yY2wzwiRGvnUYrm3pLR48pL+g9jHbSuF1N9WKjf4hhQnEGrnEmRzLx274Rnvxq6OY6qt0sNz6Dz7rNQT1U2mySYRNfkuTOvv/BwqckALnxPboprw3S9QiPZSKc7MEGZcSlY6dzQ5YrBju+jAow/MR0Ou6PjJU2C1JwesdXwYtMEWpFRwwMxzVMf7iDa85j/Kr1FJNjwG1RfIbz3gUuZhObDWHb3FdEyiP4wjGlNzxJBiuulosa5TNRKFSqFisVIIM2c/05/cGR3otiMayJBNK8GidomH4SLdmfe9VafRtRUZcSZ0nJe4zUPecnIrpBwRFvh5PB6Nnf4vOuh8InbxdMa7TxsrZejDuufbq/zJmTKfUad0LRuUgyjevSGFt9t7zlww9gl+fG3ZYQs3hLR+XHM9YTc7aedpghdr2NHDwqAhFiDaqlIfHPN/J4dP64DA4DZOa/DLklfogo7dknCKpZYY49+YFGPbJLPoXLTEhJaJDunS1iVOvaN/GSEqSMqgCUbNPI3i3t2VALQEM9F+rSA481vfmyv/FHoNPYtkSK8uzOvFfYhrQSMI+wXb7hE7HxKPayNZ7gf9J2tYVyO/IcZNaVA8VT7tcWZuwYCmEl+HwBvpOXH9zLtQW4x/QY0Fs6nn9x5MrDQAfXjWpIfr4OucvaHNR0owOa2JLbRsxznjY2CR9jugOPwt99dBgYWH4RcnJ7nw2FUiTxlGkj3b6SqpZra3Pqmtt0AKePFrci6mmdmsYHDkVkpkCgRfAnuxPfM7igxrVzuxLRbRRkiY+sybjsKaEQpNwgJL2/Qr1nf369r0NwoEhYLSqYDC84r889pzEkNESVJMMcRe4b+2x/adkkxKhOxotwNzzQLgbLR/GCUqfoqjlkgg0jaZkePCGQDdF4slepTzOB7M7qnyR0lA2CFEyJkjf+pIXg22NDQbvMY4eCXgXkhusApoi70QGqmUb2sL0EJIyEW9UrHXLXwkuIcghXYl24oyQVBZptWPsv1vRE0JYrWF3WWRQBlhJFQs5llZCc/IMUfM4aTq3LXoSQt04vdy4Dce8/U7MrsPtKhBGq5kL+EKUHjrKexKAQ6ExKzqOvp289cqEU4RisqqB8Lo64QEETIMjJGtDYlwanSJvMYUrgw7UB//l/za4QSly0KWelyTAaeaJ7ABIcWxM0Bs1ZdSuWMMfFMqfiPZloKFWV6rbgQnmzIgCsmAkIpxtxZTxqpmDRH+Ebb07aNEq7FDsTBwHQU9QkGbFU1j24pzjoknpCzGY+RBRePFgj+57sLlh2/Pc1JQUkcCEyZy5ESMmFhVf7xTIqDAPyi9UqNdxhq/QX60ji2hhf7aO7DWu/pLzOOqWx5rOgn5uPPpCH3Sx8IBpo5WTQi6IehQ7XnpSjQ1xba2JKEg/PEvnk1mfqzZVQAU5xGC2fEc508xaSQd9HgJ18jQKn46qLOg/3cLixCKTQ7BL5VLgMr9/l8GgL+1hZeWJ51iUMW1mEf/fAFMwatcuiq1mAIg4C8kGuwgVrke0ZXudfOxCgQXsrSuuSavbMUpbNf1A5aUm+z3DSvAy6cGQrX6H33EpgUicR7oLSM7HHPMjDCd7RWx7rdqZSsGj6d7ArLEfxy47peI/nITCjsKN/aXLOmBpbIt9K3YzyPf6KpqAyfLzRMdeAfT1SmFb1YJsdWRaPemBadMVWT+pDgTgnUvjZyh4iQwExrh88cqpmdpHWA51sTO7SDQ938xd9GoS7KrdA/WnI0eWilG4peU4sQz/R9jjO6XJvoz0FAgMbqlUxNRsFG0Ppcgxhva4ILStU5DOTu1rZoerHYP3X4KpeUqFbzO+YfMuIbWrg/iIbtgn4BfGFmF0h8uGWI9/9+78+13lgNrnqUSswl+XQX+yPA+Pji9rfF8+8MHywsAudOTplHXh/xd7TUnMOpfoQX01sw8KrryLbJM0Q31rMSnM+zXFQzBnMc1HlVl7l/eerjfiUnkO0HExQH8xdzLr2UbaeqFntyTh/GsxjAiF+950xU2czXJiWTSMVozT5oB5PVua1E58nJxb9gOpOZyNFHivHd+w+aSky9l5n9APtEBwn+3/AzstnstscqrfkAGFdDfSOSUr79Ts6Vg4H3FgxZQetlSPyE6RAdVVsWwfo2uOhzid6VDiCDUR3PWoYt9yta9oqYmUFMB3hf5J+VM4c4p4BgCJ5UxNuebAZrxgw7KVdEIQJEB4k6FFvQ8nYmb1TGM2yWlniZwqZ0DNVBwBZdLZHSZdke6Z3zGVzJlI2Dkna0VvPMuo9lxPRPCdcKCbqNAYFE8TvIIBrSekKtqSo+znb9u1/4F0AJGOfUBiunQoTvNxEK+d6/HyvNH+hz5MCjw3iDK8n8M6a7ZvG3py0LEDw5fmhTNMBrGNO8uJaWDSfO8xP9wWlOVofABkAIS4tajx+PTqRWnzd3U+5rUMfkJYmhJQzSbfNcRoZojNi+cxJVO6NGVgtyOd9do4F9cUnN0lj38vJagUPreX5WNaZjdUdRkVP10HHSslSvTJVD/uOz0GURDIECmOpHpj4x/vC0sudjMYEOAhZP4xcahS+74OTPsPQVxh/pqUTM769m/cLgSc5d5zKxw4osvEUczFyg3VpzdNnT+jS1VTWRH/q8KW/KmYg9QDt7hfwBF6hd3ZTu/zs+VlPYofkNnGS7x6Z0Lp2HBXryem+UgvQ4x50TUcWejPlejQ2BZNZ0l+kByrub2coDybwRSeDjHVy3qEGIrsqizWRRVl+k5GSguVEk/phwCaoUo0PkGSP/Ee3yurL8AWXcA0G0FP5GBLpqWv0MqNJT8vDAm0XXSdLL/3n8w+bWmah9XxyzEBVUNebhdV48dsAMKAjViLEsTm//HdWJ4Qe6suF58lKNPiHHsPWh/PcYtJZwHT4AYSOqNkE5W19BAbcRfuvQdmmaKzV2kLqvxBUyClBOTa179FuvKoCyjolJcF7at8JAzLVFAUAvNTTvm6EwDBc5QINyEq0TAxUXdGZqr/XGBH1di1bn7kBrznJX12/aj33ALHzyBSkiDdm0NihLLIq8qOzZt1VvClxLnh25MRD8VC2WfbzN16BRa2vSuBBw4YtxkX34fzailOW6dLNurGimx3lb3Jvq/jcxP1apGF05KVYtZJGK4GHLkhvB7a2MOWRmUAk9EcstY3dV/mE3HqTINDZaFcSUpJByV0oxHxTwooX8vz969z10HEmig3wCCcN/c5ziUaPPejrp1iMltf3q5IDyIKkVJp1JeCaEN0rEOkJckHQz52Bu5p74hPYtEYO57IQ9dcv8cYhy6sMIHheKZwiU9RgWkDc1v4Jsy904E3IsLXL6RdEWJbHQjOj2ga1LfsyCEk2JFwqVeHh73Hu2fF2b9NRNLoBYVx6XdaSBL0Qb3PVaFOIXTRceGuE82Ku85V6W/SjrdmTnpk/BVgKj2iTX+RiLDlFKHr4Ya8xM9lxQbruWR8LfWEx92KlLid20A9US/or+lg+1i+fCX8l/6hFlEVYPy6Obht7OP4eQXZuco3pFpSQbSM1bjWQ6AuNa/ZmJCAgVpB7XDlrUatVHSJnijhrVVtuhjlqLo+4nWWnQJc7QTXLRe07iCxxbtNmfKE5/jcJL00q/NMT1u2vnTTf3jOFxKEz9/cYyf1S711aWT4UaRxTKDpkClXVVZ2B3oTEA4X9yGLhRj5gG3sXPvmXCntO8mzRZRAkgItukn6dfJr5vj10YaH8pbf66uc/IQ==,iv:V70uGJmhe1yZ9iKk0DX3dmtiFDLs2lBBxu/ik2D+m7A=,tag:gehDQTppsgxM1wJG8F9lfg==,type:str]
@@ -21,7 +22,7 @@ sops:
             sIJDGzCPLd8QRUV9Zi/ubtF89q8m6FUdbysGlhaEPuTW7lmz0usWbw==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1fnheprr07z0hewtzcg6ec60shrt037zk9qtxj6kpzfh2zzmtvppqhcxw2j
-    lastmodified: "2026-06-04T11:03:22Z"
-    mac: ENC[AES256_GCM,data:O3zRBKFnnx+RaGTlSW5TsrDbKyAhUo2d8k22qRGnPg/ZRqH3CrUDDWAwjHmQhmw3izuztD2gizuYk9g5TE6Ijg7AY5rD7dB51m/X4dMVSLGdG73XyAFItK5T/EjPCRT108Ih87hMsWip8ycKxJzYJQOgqQ1Kmu2M1fJZ9s+BVkY=,iv:vNLQEHUHPvC25++699JwkI49JBNx8ttYIErotG/HCxI=,tag:/OEZN8MGVqF1FSrDK1RChA==,type:str]
+    lastmodified: "2026-07-19T11:55:37Z"
+    mac: ENC[AES256_GCM,data:gchjWA8vrfS5FvIXbHgXNamkFWTWgBTTtI2FBkf/keRp6+oZwNFeb0QhFkylH24PMDsmjfw8SlH4AOkrYVilWMNq1GQbQNr36IOAvrrHUxnGA5rqn51Lk+9mSVkkWOpq7ivTVxEAfgLfNNKjvj+Ix54KVU44lCFHnAtS/+YxOrc=,iv:2Z1hgWBiHG1eG/lxW+y65T6i7Otu2D7zMy6Kr7+cCRA=,tag:xDooAEdvpGes5l80Ctk0eQ==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.13.1
+    version: 3.13.2