From c6258a77e44ea46d97590f9dc03415837c1c006a Mon Sep 17 00:00:00 2001
From: Sergei Poljanski <me@asxp.io>
Date: Tue, 14 Jul 2026 12:24:34 +0400
Subject: [PATCH] ssh: private host aliases via sops-provisioned include

---
 modules/private/ssh-hosts.nix |  6 ------
 modules/programs.nix          | 10 +++++++++-
 2 files changed, 9 insertions(+), 7 deletions(-)
 delete mode 100644 modules/private/ssh-hosts.nix

diff --git a/modules/private/ssh-hosts.nix b/modules/private/ssh-hosts.nix
deleted file mode 100644
index 30a6374..0000000
--- a/modules/private/ssh-hosts.nix
+++ /dev/null
@@ -1,6 +0,0 @@
-{ ... }:
-{
-  # Stub. Real values kept locally via:
-  #   git update-index --skip-worktree modules/private/ssh-hosts.nix
-  programs.ssh.extraConfig = "";
-}
diff --git a/modules/programs.nix b/modules/programs.nix
index 93876e8..1bde50a 100644
--- a/modules/programs.nix
+++ b/modules/programs.nix
@@ -2,7 +2,15 @@
 { config, pkgs, lib, ... }:
 
 {
-  imports = [ ./private/ssh-hosts.nix ];
+  # Private SSH host aliases live in sops (secrets/network.yaml: ssh-hosts)
+  sops.secrets."ssh-hosts" = {
+    sopsFile = "/etc/nixos/secrets/network.yaml";
+    key = "ssh-hosts";
+    mode = "0444";
+  };
+  programs.ssh.extraConfig = ''
+    Include /run/secrets/ssh-hosts
+  '';
 
   # GPG agent
   programs.gnupg.agent = {