feat(esphome): add secretsFile option

devices/homie/modules/home-assistant/assist.nix

@@ -53,4 +53,7 @@
       port = 6052;
     };
   };
+
+  # In case tailscale is down
+  boot.kernel.sysctl."net.ipv4.ip_nonlocal_bind" = 1;
 }

devices/homie/modules/home-assistant/firmware.nix

@@ -1,5 +1,8 @@
-{...}: {
+{config, ...}: {
-  services.esphome.firmwareConfigs = {
+  services.esphome = {
+    secretsFile = config.sops.secrets.esphome.path;
+
+    firmwareConfigs = {
       "esp1" = {
         packages.remote_package_files = {
           url = "https://github.com/esphome/firmware";
@@ -37,4 +40,5 @@
         };
       };
     };
+  };
 }

flake.lock

@@ -1757,11 +1757,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1723480554,
+        "lastModified": 1725588406,
-        "narHash": "sha256-2giqpDLWpVYy5GV87x20GzRAxORGToeaKsWjEOyFB8o=",
+        "narHash": "sha256-yX3/SKEP/AB4IJiV8X008tnOepTla0XeJ9m2d6VoQAQ=",
         "ref": "refs/heads/main",
-        "rev": "205779bc5f06840e30e0a90d97baa61e42b6a76a",
+        "rev": "fe8958ac8792da69e7071e69482bc488a65f926f",
-        "revCount": 73,
+        "revCount": 76,
         "type": "git",
         "url": "ssh://git@git.nelim.org/matt1432/nixos-secrets"
       },

nixosModules/esphome-plus/default.nix

@@ -37,7 +37,7 @@
   in {
     name = "${name}.yaml";
     file = pkgs.runCommandLocal "${name}.yaml" {} ''
-      cp ${format.generate "${name}.yaml" filteredConfig} $out
+      cp ${format.generate name filteredConfig} $out
       sed -i -e "s/'\!\([a-z_]\+\) \(.*\)'/\!\1 \2/;s/^\!\!/\!/;" $out
       sed -i 's/ {}//g' $out
     '';
@@ -49,6 +49,11 @@ in {
       type = with types; attrsOf anything;
     };
 
+    secretsFile = mkOption {
+      default = null;
+      type = types.nullOr types.path;
+    };
+
     deleteUnmanaged = mkOption {
       default = true;
       type = types.bool;
@@ -74,6 +79,8 @@ in {
                   mkdir -p ${stateDir}
               fi
 
+              ${optionalString (cfg.secretsFile != null) ''cp -f "$(realpath "${cfg.secretsFile}")" ${stateDir}/secrets.yaml''}
+
               ${optionalString cfg.deleteUnmanaged ''find ${stateDir} -name "*.yaml" ! -name "secrets.yaml" -delete''}
 
               ${concatMapStringsSep

outputs.nix

@@ -98,7 +98,12 @@
       };
 
       # Home-assistant
-      homie = mkNixOS {extraModules = [./devices/homie];};
+      homie = mkNixOS {
+          extraModules = [
+            ./devices/homie
+            secrets.nixosModules.homie
+          ];
+        };
 
       # Cluster
       thingone = mkNixOS {