home-manager

nix/flakeModule.nix

@@ -1,7 +1,6 @@
 {
   config,
   lib,
-  flake-parts-lib,
   inputs,
   den,
   ...
@@ -17,6 +16,14 @@ in
       default = [ ];
       description = "A list of master keys for encrypting secrets.";
     };
+    homeIdentities = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      example = [
+        "laptop-home"
+        "wawa-wawa-home"
+      ];
+    };
     secretsDir = mkOption {
       type = types.str;
       default = null;
@@ -39,6 +46,12 @@ in
         description = "A function that takes the NixOS configuration and returns a NixOS module to apply to the host based on its network configuration.";
       };
     };
+    homeManagerModule = {
+      default = mkOption {
+        type = types.functionTo types.attrs;
+        default = identity: { };
+      };
+    };
   };
   config =
     let
@@ -74,6 +87,9 @@ in
             ++ (lib.optionals value.global all_keys)
             ++ cfg.masterKeys
           );
+          # Descriptive flag: is this secret consumed by a home-manager user?
+          # True when it is global or targets any identity in `homeIdentities`.
+          home = value.global || lib.any (h: lib.elem h cfg.homeIdentities) value.hosts;
         in
         {
           inherit (value)
@@ -83,7 +99,7 @@ in
             global
             ;
           keys = value.keys or [ ];
-          inherit sopskeys;
+          inherit sopskeys home;
         }
       ) secrets;
 
@@ -130,12 +146,55 @@ in
             ) secret_map
           )
         );
+
+      # Home-manager analog of sops_secrets_map. Takes a key identity (e.g.
+      # `laptop-home`) and deliberately omits `neededForUsers`, which the
+      # sops-nix home-manager module does not support (it only matters for
+      # decrypting before system users exist, a NixOS-only concern).
+      home_secrets_map =
+        identity:
+        lib.mkMerge (
+          lib.concatLists (
+            lib.mapAttrsToList (
+              name: value:
+              let
+                hasHost = (lib.elem identity value.hosts) || value.global;
+                isYamlOrJson = value.format == "yaml" || value.format == "json";
+              in
+              (
+                [
+                  (
+                    if hasHost && !(isYamlOrJson && value.keys != [ ]) then
+                      {
+                        ${name} = {
+                          inherit (value) format;
+                          sopsFile = inputs.self + "/${cfg.secretsDir}/${name}";
+                        };
+                      }
+                    else
+                      { }
+                  )
+                ]
+                ++ lib.optionals hasHost (
+                  lib.map (v: {
+                    "${name}-${v}" = {
+                      inherit (value) format;
+                      sopsFile = inputs.self + "/${cfg.secretsDir}/${name}";
+                      key = v;
+                    };
+                  }) value.keys
+                )
+              )
+            ) secret_map
+          )
+        );
     in
     {
       flake.secretsManifest = {
         secretsDir = cfg.secretsDir;
         masterKeys = cfg.masterKeys;
         hosts = lib.mapAttrs (_: keys: { inherit keys; }) per_host_keys;
+        homeIdentities = cfg.homeIdentities;
         secrets = secret_map;
         secrets_map = sops_secrets_map;
       };
@@ -151,6 +210,11 @@ in
             config.sops.secrets = sops_secrets_map config.networking.hostName;
           };
       };
+      secrets.homeManagerModule = {
+        default = identity: {
+          config.sops.secrets = home_secrets_map identity;
+        };
+      };
       perSystem =
         { pkgs, self', ... }:
         let

src/app.rs

@@ -1,12 +1,10 @@
 use color_eyre::Report;
 use crossterm::event::{KeyCode, KeyEvent, KeyModifiers};
-use ratatui::{prelude::CrosstermBackend, widgets::ListState, DefaultTerminal, Terminal};
+use ratatui::{prelude::CrosstermBackend, widgets::ListState, Terminal};
-use ratatui_form::{Email, Form};
 use std::{io, path::Path};
 
 use crate::{
     event::{AppEvent, Event, EventHandler},
-    form::FormState,
     manifest::{load_manifest, Manifest},
 };
 

src/manifest.rs

@@ -11,6 +11,8 @@ pub struct Manifest {
     #[serde(rename = "masterKeys")]
     pub master_keys: Vec<String>,
     pub hosts: BTreeMap<String, HostInfo>,
+    #[serde(rename = "homeIdentities", default)]
+    pub home_identities: Vec<String>,
     pub secrets: BTreeMap<String, SecretInfo>,
 }
 
@@ -28,6 +30,8 @@ pub struct SecretInfo {
     #[serde(rename = "neededForUsers")]
     pub needed_for_users: bool,
     pub keys: Vec<String>,
+    #[serde(default)]
+    pub home: bool,
 }
 
 #[derive(Debug, Clone, Deserialize, PartialEq)]

src/ui.rs

@@ -91,25 +91,29 @@ fn render_secret_detail(state: &App, area: Rect, buf: &mut Buffer) {
         Span::styled(scope, Style::default().fg(Color::White)),
     ]));
     if !secret.global {
-        // Hosts
+        // Hosts / identities. Home-manager identities are coloured distinctly
-        let hosts_str = if secret.hosts.is_empty() {
+        // so it is obvious which targets are user (home) rather than system.
-            if secret.global {
+        let mut host_spans: Vec<Span> = vec![Span::styled(
-                manifest
+            "  Hosts:      ",
-                    .hosts
+            Style::default().fg(Color::DarkGray),
-                    .keys()
+        )];
-                    .cloned()
+        if secret.hosts.is_empty() {
-                    .collect::<Vec<_>>()
+            host_spans.push(Span::styled("none", Style::default().fg(Color::White)));
-                    .join(", ")
         } else {
-                "none".to_string()
+            for (i, identity) in secret.hosts.iter().enumerate() {
+                if i > 0 {
+                    host_spans.push(Span::styled(", ", Style::default().fg(Color::DarkGray)));
                 }
+                let is_home = manifest.home_identities.contains(identity);
+                let style = if is_home {
+                    Style::default().fg(Color::Magenta)
                 } else {
-            secret.hosts.join(", ")
+                    Style::default().fg(Color::White)
                 };
-        lines.push(Line::from(vec![
+                host_spans.push(Span::styled(identity.clone(), style));
-            Span::styled("  Hosts:      ", Style::default().fg(Color::DarkGray)),
+            }
-            Span::styled(hosts_str, Style::default().fg(Color::White)),
+        }
-        ]));
+        lines.push(Line::from(host_spans));
     }
 
     // Recipients
@@ -128,6 +132,14 @@ fn render_secret_detail(state: &App, area: Rect, buf: &mut Buffer) {
             Span::styled("yes", Style::default().fg(Color::Yellow)),
         ]));
     }
+
+    // Home-manager: shown when this secret is consumed by a home-manager user.
+    if secret.home {
+        lines.push(Line::from(vec![
+            Span::styled("  Home-mgr:   ", Style::default().fg(Color::DarkGray)),
+            Span::styled("yes", Style::default().fg(Color::Magenta)),
+        ]));
+    }
     while lines.len() < 6 {
         lines.push(Line::from(""));
     }
@@ -151,14 +163,22 @@ fn render_secret_detail(state: &App, area: Rect, buf: &mut Buffer) {
         let label = if manifest.master_keys.contains(key) {
             Span::styled(" (master)", Style::default().fg(Color::Magenta))
         } else {
-            // Try to find which host owns this key
+            // Try to find which identity owns this key. Home identities are
-            let host_label = manifest
+            // tagged and coloured distinctly from system identities.
+            match manifest
                 .hosts
                 .iter()
                 .find(|(_, info)| info.keys.contains(key))
-                .map(|(name, _)| format!(" ({})", name))
+            {
-                .unwrap_or_default();
+                Some((name, _)) if manifest.home_identities.contains(name) => Span::styled(
-            Span::styled(host_label, Style::default().fg(Color::Cyan))
+                    format!(" ({name}, home)"),
+                    Style::default().fg(Color::Magenta),
+                ),
+                Some((name, _)) => {
+                    Span::styled(format!(" ({name})"), Style::default().fg(Color::Cyan))
+                }
+                None => Span::raw(""),
+            }
         };
 
         lines.push(Line::from(vec![
@@ -168,7 +188,7 @@ fn render_secret_detail(state: &App, area: Rect, buf: &mut Buffer) {
         ]));
     }
 
-    let paragraph = Paragraph::new(lines).block(block).render(area, buf);
+    Paragraph::new(lines).block(block).render(area, buf);
 }
 
 fn render_placeholder(area: Rect, buf: &mut Buffer, title: &str, message: &str) {