From 88f17bc21c4b9b027d515f1c3921fb5f7ef33243 Mon Sep 17 00:00:00 2001
From: Yisroel Baum <yisroel.d.baum@gmail.com>
Date: Fri, 12 Jun 2026 11:20:15 +0300
Subject: [PATCH] move borg secrets to its own file

---
 borgbackup.nix    | 17 +++++++++++++++++
 configuration.nix |  1 +
 forgejo.nix       | 14 --------------
 3 files changed, 18 insertions(+), 14 deletions(-)
 create mode 100644 borgbackup.nix

diff --git a/borgbackup.nix b/borgbackup.nix
new file mode 100644
index 0000000..fe906a9
--- /dev/null
+++ b/borgbackup.nix
@@ -0,0 +1,17 @@
+{
+  sops.secrets."borg-private-key" = {
+    sopsFile = ./secrets/borgbackup.yaml;
+    mode = "0400";
+    key = "private-key";
+    owner = "root";
+    group = "root";
+  };
+
+  sops.secrets."borg-passphrase" = {
+    sopsFile = ./secrets/borgbackup.yaml;
+    mode = "0400";
+    key = "passphrase";
+    owner = "root";
+    group = "root";
+  };
+}
diff --git a/configuration.nix b/configuration.nix
index dd36bae..29870b7 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -9,6 +9,7 @@
   imports =
     [ # Include the results of the hardware scan.
       ./hardware-configuration.nix
+      ./borgbackup.nix
       ./forgejo.nix
       ./boot.nix
     ];
diff --git a/forgejo.nix b/forgejo.nix
index 272ff39..942bb83 100644
--- a/forgejo.nix
+++ b/forgejo.nix
@@ -104,18 +104,4 @@
     sopsFile = ./secrets/forgejo.yaml;
     mode = "0400";
   };
-  sops.secrets."borg-private-key" = {
-    sopsFile = ./secrets/borgbackup.yaml;
-    mode = "0400";
-    key = "private-key";
-    owner = "root";
-    group = "root";
-  };
-  sops.secrets."borg-passphrase" = {
-    sopsFile = ./secrets/borgbackup.yaml;
-    mode = "0400";
-    key = "passphrase";
-    owner = "root";
-    group = "root";
-  };
 }