claude'd better security things

secrets.nix

@@ -0,0 +1,22 @@
+let
+  # USB secrets key - for encrypting/decrypting all secrets
+  usbSecretsKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN8+eSX2LH5wEHVG9sSv97ceD5zdTarV0lRvoUso4A7p USB secrets decryption key";
+in
+{
+  # ZFS encryption key
+  "zfs-key.age".publicKeys = [ usbSecretsKey ];
+
+  # Secureboot keys archive
+  "secureboot.tar.age".publicKeys = [ usbSecretsKey ];
+
+  # System passwords and auth
+  "hashedPass.age".publicKeys = [ usbSecretsKey ];
+
+  # Service authentication
+  "caddy_auth.age".publicKeys = [ usbSecretsKey ];
+  "jellyfin-api-key.age".publicKeys = [ usbSecretsKey ];
+  "slskd_env.age".publicKeys = [ usbSecretsKey ];
+
+  # Network configuration
+  "wg0.conf.age".publicKeys = [ usbSecretsKey ];
+}