chore: move secrets to blueprint module (#68)

nix/hosts/inwin-tower/configuration.nix

···
     flake.nixosModules.desktop
     flake.nixosModules.kernel
     flake.nixosModules.networking
-    flake.nixosModules.secrets
     flake.nixosModules.sound
     flake.nixosModules.tailscale
+
+    flake.modules.secrets.base
 
     flake.modules.desktop.jetbrains
     flake.modules.desktop.ollama

nix/hosts/nixos-thinkpad/configuration.nix

···
     flake.nixosModules.desktop
     flake.nixosModules.kernel
     flake.nixosModules.networking
-    flake.nixosModules.secrets
     flake.nixosModules.sound
     flake.nixosModules.tailscale
+
+    flake.modules.secrets.base
 
     flake.modules.desktop.jetbrains
     flake.modules.desktop.steam

nix/modules/nixos/secrets.nix

···
-{
-  imports = [
-    ../../../secrets/mod.nix
-  ];
-}

nix/modules/secrets/base.nix

···
+{inputs, ...}: let
+  encrypted_path = ./secret_files/encrypted;
+in {
+  imports = [
+    inputs.agenix.nixosModules.default
+  ];
+
+  config.age.identityPaths = ["/etc/ssh/ssh_host_ed25519_key"];
+  # Secrets
+  config.age.secrets = {
+    github_pat.file = encrypted_path + "/github_pat.age";
+    nix_store_signing_key.file = encrypted_path + "/nix_store_signing_key.age";
+    tailscale_key.file = encrypted_path + "/tailscale_key.age";
+  };
+}

secrets/mod.nix

···
-{
-  age.identityPaths = ["/etc/ssh/ssh_host_ed25519_key"];
-  # Secrets
-  age.secrets = {
-    github_pat.file = ./keys/github_pat.age;
-    nix_store_signing_key.file = ./keys/nix_store_signing_key.age;
-    tailscale_key.file = ./keys/tailscale_key.age;
-  };
-}