From b36da46543044236c060aa0af3bc46b0b8fdad08 Mon Sep 17 00:00:00 2001
From: Yisroel Baum <yisroel.d.baum@gmail.com>
Date: Fri, 17 Jul 2026 12:27:34 +0300
Subject: [PATCH] document sops deployment

---
 README.md | 87 +++++++++++++++++++++++++++++++++++++++++++++----------
 1 file changed, 71 insertions(+), 16 deletions(-)

diff --git a/README.md b/README.md
index 41cb382..eb603aa 100644
--- a/README.md
+++ b/README.md
@@ -279,27 +279,71 @@ Example host configuration:
 
 ```nix
 {
-  inputs.rabbi-gerzi.url = "git+ssh://git@example.com/rabbi-gerzi.git";
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    rabbi-gerzi.url = "git+ssh://git@example.com/rabbi-gerzi.git";
+
+    sops-nix = {
+      url = "github:Mic92/sops-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+  };
 
   outputs =
-    { nixpkgs, rabbi-gerzi, ... }:
+    {
+      nixpkgs,
+      rabbi-gerzi,
+      sops-nix,
+      ...
+    }:
     {
       nixosConfigurations.rabbigerzi = nixpkgs.lib.nixosSystem {
         system = "x86_64-linux";
         modules = [
           rabbi-gerzi.nixosModules.default
-          {
-            services.rabbi-gerzi = {
-              enable = true;
+          sops-nix.nixosModules.sops
+          (
+            { config, ... }:
+            let
+              appKey = config.sops.placeholder."app-key";
+              initialAdminEmail =
+                config.sops.placeholder."admin-email";
+              initialAdminPassword =
+                config.sops.placeholder."admin-password";
+            in
+            {
+              sops = {
+                defaultSopsFile = ./secrets/rabbi-gerzi.yaml;
+                age.sshKeyPaths = [
+                  "/etc/ssh/ssh_host_ed25519_key"
+                ];
 
-              frontend.hostName = "rabbigerzi.com";
+                secrets = {
+                  "app-key" = { };
+                  "admin-email" = { };
+                  "admin-password" = { };
+                };
 
-              backend = {
-                hostName = "api.rabbigerzi.com";
-                environmentFile = "/run/secrets/rabbi-gerzi.env";
+                templates."rabbi-gerzi.env".content = ''
+                  APP_KEY=${appKey}
+                  RABBI_GERZI_INITIAL_ADMIN_EMAIL=${initialAdminEmail}
+                  RABBI_GERZI_INITIAL_ADMIN_PASSWORD=${initialAdminPassword}
+                '';
               };
-            };
-          }
+
+              services.rabbi-gerzi = {
+                enable = true;
+
+                frontend.hostName = "rabbigerzi.com";
+
+                backend = {
+                  hostName = "api.rabbigerzi.com";
+                  environmentFile =
+                    config.sops.templates."rabbi-gerzi.env".path;
+                };
+              };
+            }
+          )
         ];
       };
     };
@@ -313,14 +357,25 @@ services.rabbi-gerzi.frontend.apiBaseUrl =
   "https://api.rabbigerzi.com";
 ```
 
-Create the production environment file on the server:
+Configure `.sops.yaml` with age recipients for each administrator and the
+server's SSH Ed25519 host key. Then create the encrypted secrets file:
 
-```dotenv
-APP_KEY=base64:replace-with-laravel-app-key
-RABBI_GERZI_INITIAL_ADMIN_EMAIL=admin@example.com
-RABBI_GERZI_INITIAL_ADMIN_PASSWORD=replace-with-a-long-random-password
+```sh
+sops secrets/rabbi-gerzi.yaml
 ```
 
+Add these values in the editor opened by `sops`:
+
+```yaml
+app-key: base64:replace-with-laravel-app-key
+admin-email: admin@example.com
+admin-password: replace-with-a-long-random-password
+```
+
+Commit only the encrypted file written by `sops`. At activation time,
+`sops-nix` decrypts these values and renders the runtime environment file
+outside the Nix store.
+
 Then rebuild the host with the deployment method used by the server, for
 example: