initial commit

secrets.nix.example

@@ -0,0 +1,25 @@
+{ pkgs, config, lib, ... }:
+
+{
+  # Forgejo
+  services.forgejo.settings.database.PASSWORD = "changeme_forgejo_db";
+
+  # Stalwart Mail
+  services.stalwart.settings.authentication.fallback-admin.secret = "changeme_stalwart_admin";
+
+  # Searx
+  services.searx.settings.server.secret_key = "changeme_searx_secret";
+
+  # Minecraft RCON
+  services.minecraft-servers.servers.fabric.serverProperties."rcon.password" = "changeme_rcon";
+
+  # Tailscale Auth Key (needs to be a file for the service usually, or use pre-auth)
+  # For Tailscale, standard module uses 'authKeyFile'. 
+  # We can create a file in the store for it since this is an impure secrets file anyway.
+  
+  # For Tailscale, let's just write valid one-liner to a file via environment.etc if needed, 
+  # or use the 'authKey' option if available (it is not, usually).
+  # We will stick to environment.etc JUST for Tailscale or file-based secrets.
+  environment.etc."secrets/tailscale-auth".text = "tskey-auth-PLACEHOLDER";
+  services.tailscale.authKeyFile = "/etc/secrets/tailscale-auth";
+}