ft: certificates

secrets/default.nix

@@ -2,11 +2,13 @@
 # Each secret is a file stored in this directory as binary files (edit with `sops edit <filename>`)
 let
   # make secrets readable by our processes
-  djaiOnly = {
+  rootOnly = {
     format = "binary";
-    owner = "djai";
     mode = "0400";
   };
+  djaiOnly = rootOnly // {
+    owner = "djai";
+  };
 in
 {
   # machine's age key, also used by `sops edit`.  
@@ -22,13 +24,13 @@ in
     };
 
     # npm caddy certificates
-    "npm-certificate-private" = djaiOnly // {
+    "npm-certificate-private" = rootOnly // {
       sopsFile = ./npm-certificate-private.bin;
     };
-    "npm-certificate-shared" = djaiOnly // {
+    "npm-certificate-shared" = rootOnly // {
       sopsFile = ./npm-certificate-shared.bin;
     };
-    "npm-certificate-public" = djaiOnly // {
+    "npm-certificate-public" = rootOnly // {
       sopsFile = ./npm-certificate-public.bin;
     };
 
@@ -39,10 +41,5 @@ in
     "wg-config-tuxcomp" = djaiOnly // {
       sopsFile = ./wg-config-tuxcomp.bin;
     };
-
-    # thunderbird's logins.json + key4.db as a tarball, seeded on fresh hosts.
-    "thunderbird-creds" = djaiOnly // {
-      sopsFile = ./thunderbird-creds.bin;
-    };
   };
 }