vars: implement sops.defaultGroups

nixosModules/clanCore/default.nix

@@ -2,8 +2,10 @@
   imports = [
     ./backups.nix
     ./facts
-    ./manual.nix
     ./imports.nix
+    ./inventory/interface.nix
+    ./manual.nix
+    ./meta/interface.nix
     ./metadata.nix
     ./networking.nix
     ./nix-settings.nix
@@ -11,12 +13,10 @@
     ./outputs.nix
     ./packages.nix
     ./schema.nix
+    ./sops.nix
+    ./vars
     ./vm.nix
     ./wayland-proxy-virtwl.nix
     ./zerotier
-    # Inventory
-    ./inventory/interface.nix
-    ./meta/interface.nix
-    ./vars
   ];
 }

nixosModules/clanCore/facts/secret/sops.nix

@@ -33,15 +33,6 @@ let
   secrets = filterDir containsMachineOrGroups secretsDir;
 in
 {
-  options = {
-    clan.core.sops.defaultGroups = lib.mkOption {
-      type = lib.types.listOf lib.types.str;
-      default = [ ];
-      example = [ "admins" ];
-      description = "The default groups to for encryption use when no groups are specified.";
-    };
-  };
-
   config = lib.mkIf (config.clan.core.facts.secretStore == "sops") {
     # Before we generate a secret we cannot know the path yet, so we need to set it to an empty string
     clan.core.facts.secretPathFunction =

nixosModules/clanCore/outputs.nix

@@ -73,6 +73,7 @@
           services
           ;
       };
+      sops.defaultGroups = config.clan.core.sops.defaultGroups;
       inherit (config.clan.core.networking) targetHost buildHost;
       inherit (config.clan.deployment) requireExplicitUpdate;
     };

nixosModules/clanCore/sops.nix

@@ -0,0 +1,11 @@
+{ lib, ... }:
+{
+  options = {
+    clan.core.sops.defaultGroups = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      example = [ "admins" ];
+      description = "The default groups to for encryption use when no groups are specified.";
+    };
+  };
+}