NixOS で API key を暗号化しつつ自動的に環境変数に設定する方法

1> nix-shell -p nix-info --run "nix-info -m"
2 - system: `"aarch64-linux"`
3 - host os: `Linux 5.15.167.4-microsoft-standard-WSL2, NixOS, 25.05 (Warbler), 25.05.20250503.f21e454`
4 - multi-user?: `yes`
5 - sandbox: `yes`
6 - version: `nix-env (Nix) 2.28.3`
7 - channels(root): `"nixos-24.11, nixos-wsl"`
8 - nixpkgs: `/nix/store/qmm7hgw60vp7vj9lma95hl329d0j3n6n-source`

1> home-manager --version
225.05-pre

1> zsh --version
2zsh 5.9 (aarch64-unknown-linux-gnu)

 1# 本論と関係しないファイルは適宜省略しています
 2.dotfiles
 3├── .git
 4│   ├── ...
 5│   ├── hooks
 6│   └── ...
 7├── .gitignore
 8├── .sops.yaml
 9├── configuration.nix
10├── flake.lock
11├── flake.nix
12├── home
13│   ├── git-pre-commit
14│   └── zsh.nix
15├── home.nix
16├── secrets.yaml
17└── sops
18    └── age

1home.packages = with pkgs; [
2+  age
3+  sops
4];

 1{
 2  inputs = {
 3    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
 4    home-manager.url = "github:nix-community/home-manager/";
 5    home-manager.inputs.nixpkgs.follows = "nixpkgs";
 6+   sops-nix.url = "github:Mic92/sops-nix";
 7  };
 8
 9  outputs =
10    inputs:
11    let
12      # 各マシンのシステムタイプを定義する辞書
13      systems = {
14        desktop = "x86_64-linux";
15        zenbook = "aarch64-linux";
16      };
17
18      # NixOS のシステム構成を作成するヘルパー関数
19      mkNixosSystem =
20        machine: system:
21        inputs.nixpkgs.lib.nixosSystem {
22          system = system;
23          modules = [
24            ./configuration.nix
25+           inputs.sops-nix.nixosModules.sops
26          ];
27        };
28
29      # Home Manager のホーム構成を作成するヘルパー関数
30      mkHomeManager =
31        machine: system:
32        inputs.home-manager.lib.homeManagerConfiguration {
33          pkgs = import inputs.nixpkgs {
34            system = system;
35            config = {
36              allowUnfree = true;
37            };
38          };
39          extraSpecialArgs = { inherit inputs; };
40          modules = [
41            ./home.nix
42          ];
43        };
44    in
45    {
46      nixosConfigurations = builtins.listToAttrs (
47        map (machine: {
48          name = machine;
49          value = mkNixosSystem machine (systems.${machine});
50        }) (builtins.attrNames systems)
51      );
52      homeConfigurations = builtins.listToAttrs (
53        map (machine: {
54          name = "s-show@" + machine;
55          value = mkHomeManager machine (systems.${machine});
56        }) (builtins.attrNames systems)
57      );
58+     home-manager.sharedModules = [
59+       inputs.sops-nix.homeManagerModules.sops
60+     ];
61    };
62}

1mkdir -p ~/.dotfiles/sops/age

1age-keygen -o ~/.dotfiles/sops/age/keys.txt

1# zenbook は私の環境のホスト名なので、適宜読み替えてください。
2keys:
3  - &zenbook (先程コピーした公開鍵を入力)
4creation_rules:
5  - path_regex: secrets.yaml$
6    key_groups:
7    - age:
8      - *zenbook

1# `secrets.yaml` は `.sops.yaml` の `path_regex` に合わせる
2nix-shell -p sops --run "sops secrets.yaml"

1# API key を直接入力してから保存して閉じると自動的に暗号化される
2OPENROUTER_API_KEY: ***

 1home.packages = with pkgs; [
 2  ~~~
 3];
 4
 5+ sops = {
 6+   age.keyFile = "/home/(username)/.dotfiles/sops/age/keys.txt"; # must have no password!
 7+   defaultSopsFile = ./secrets.yaml;
 8+   defaultSymlinkPath = "/run/user/1001/secrets";
 9+   defaultSecretsMountPoint = "/run/user/1001/secrets.d";
10+ };
11
12+ imports = [
13+   inputs.sops-nix.homeManagerModules.sops
14+ ];

 1sops = {
 2  age.keyFile = "/home/(username)/.dotfiles/sops/age/keys.txt";
 3  defaultSopsFile = ./secrets.yaml;
 4  defaultSymlinkPath = "/run/user/1001/secrets";
 5  defaultSecretsMountPoint = "/run/user/1001/secrets.d";
 6+  secrets.OPENROUTER_API_KEY = {
 7+    path = "${config.sops.defaultSymlinkPath}/OPENROUTER_API_KEY";
 8+  };
 9};
10
11imports = [
12  inputs.sops-nix.homeManagerModules.sops
13];

1+ programs.zsh = {
2+   initContent = ''
3+     export OPENROUTER_API_KEY=$(cat ${config.sops.secrets.OPENROUTER_API_KEY.path})
4+   '';
5+ };

 1#!/usr/bin/env bash
 2
 3# コミットをブロックするファイルのリスト
 4blocked_files="secrets.yaml keys.txt .sops.yaml"
 5
 6# コミット対象のファイルを取得
 7staged_files=$(git diff --cached --name-only)
 8
 9for file in $staged_files; do
10  for blocked_file in $blocked_files; do
11    if [ "$(basename $file)" = "$blocked_file" ]; then
12      echo "機密保持のため $blocked_file のコミットは禁止！"
13      exit 1
14    fi
15  done
16done

1 programs.zsh = {
2   initContent = ''
3     export OPENROUTER_API_KEY=$(cat ${config.sops.secrets.OPENROUTER_API_KEY.path})
4+    cp "${builtins.toString config.home.homeDirectory}/.dotfiles/home/git-pre-commit" "${builtins.toString config.home.homeDirectory}/.dotfiles/.git/hooks/pre-commit"
5   '';
6 };