System/Darwinix: Import sops secrets

config/navi/christoph.cheat

@@ -238,11 +238,11 @@ $ mode: echo -e "--export            \tExport public key\n--export-secret-keys\t
 
 % sops
 # Edit secrets.yaml
-sops ~/NixFlake/system/modules/sops-nix/secrets.yaml
+sops ~/NixFlake/system/systemmodules/sops-nix/secrets.yaml
 
 % sops
 # Rekey secrets.yaml
-sops updatekeys ~/NixFlake/system/modules/sops-nix/secrets.yaml
+sops updatekeys ~/NixFlake/system/systemmodules/sops-nix/secrets.yaml
 
 % ssh
 # Generate a new SSH key

home/homemodules/darwin.nix

@@ -7,6 +7,7 @@
     ./fastfetch
     ./fish
     ./git
+    ./jellyfin-tui
     ./kitty
     ./lazygit
     ./neovim

home/homemodules/default.nix

@@ -15,6 +15,7 @@
     ./firefox
     ./fish
     ./git
+    ./jellyfin-tui
     ./kitty
     ./lazygit
     ./mpd

home/homemodules/jellyfin-tui/default.nix

@@ -0,0 +1,72 @@
+{
+  config,
+  nixosConfig,
+  lib,
+  mylib,
+  pkgs,
+  ...
+}: let
+  inherit (config.homemodules) jellyfin-tui color;
+in {
+  options.homemodules.jellyfin-tui = import ./options.nix {inherit lib mylib;};
+
+  config = lib.mkIf jellyfin-tui.enable {
+    home = {
+      packages = [
+        pkgs.jellyfin-tui
+      ];
+
+      file = {
+        ".config/jellyfin-tui/config.yaml".text = ''
+          servers:
+          - name: Mafia Dortmund
+            url: https://jellyfin.local.chriphost.de
+            username: root
+            password_file: ${nixosConfig.sops.secrets.jellyfin-password.path}
+            default: true
+
+          # All following settings are OPTIONAL. What you see here are the defaults.
+
+          # Show album cover image
+          art: true
+          # Save and restore the state of the player (queue, volume, etc.)
+          persist: true
+          # Grab the primary color from the cover image (false => uses the current theme's `accent` instead)
+          auto_color: false
+          # Time in milliseconds to fade between colors when the track changes
+          auto_color_fade_ms: 400
+          # Always show the lyrics pane, even if no lyrics are available
+          lyrics: 'always' # options: 'always', 'never', 'auto'
+
+          rounded_corners: true
+
+          transcoding:
+            bitrate: 320
+            # container: mp3
+
+          # Discord Rich Presence. Shows your listening status on your Discord profile if Discord is running.
+          # NOTE: I think we're allowed to leak this to the public (hopefully)?
+          discord: 1466134677537685546 # https://discord.com/developers/applications
+          # Displays album art on your Discord profile if enabled
+          # !!CAUTION!! - Enabling this will expose the URL of your Jellyfin instance to all Discord users!
+          discord_art: false
+
+          # Customize the title of the terminal window
+          window_title: true # default -> {title} – {artist} ({year})
+          # window_title: false # disable
+          # Custom title: choose from current track's {title} {artist} {album} {year}
+          # window_title: "\"{title}\" by {artist} ({year}) – jellyfin-tui"
+
+          # Options specified here will be passed to mpv - https://mpv.io/manual/master/#options
+          mpv:
+            log-file: /tmp/mpv.log
+            no-config: true
+            # af: lavfi=[loudnorm=I=-23:TP=-1]
+            gapless-audio: weak
+            prefetch-playlist: yes
+            replaygain: no
+        '';
+      };
+    };
+  };
+}

home/homemodules/jellyfin-tui/options.nix

@@ -0,0 +1,7 @@
+{
+  lib,
+  mylib,
+  ...
+}: {
+  enable = lib.mkEnableOption "Enable jellyfin-tui";
+}

home/homemodules/packages/default.nix

@@ -74,7 +74,7 @@ in {
         # Common !headless packages
         (lib.optionals (!headless) [
           ripdrag # drag & drop from terminal
-          jellyfin-tui
+          # jellyfin-tui # Use module
         ])
 
         # Linux exclusive packages
@@ -157,7 +157,6 @@ in {
           ferdium
           gparted
           # feishin # electron :(
-          jellyfin-tui
           playerctl # Media player control
           czkawka-full # file deduplicator
 

home/homemodules/terminal/default.nix

@@ -26,6 +26,7 @@ in {
         signCommits = true;
       };
 
+      jellyfin-tui.enable = true;
       kitty.enable = true;
       lazygit.enable = true;
 

system/darwinix/default.nix

@@ -10,6 +10,15 @@
   hostname,
   ...
 }: {
+  systemmodules = {
+    sops-nix.secrets.${username} = [
+      "ssh-private-key"
+      "nix-github-token"
+      "docker-password"
+      "jellyfin-password"
+    ];
+  };
+
   nix = mylib.nixos.mkCommonNixSettings username;
 
   networking = {

system/default.nix

@@ -91,6 +91,7 @@ with mylib.networking; {
       "ssh-private-key"
       "nix-github-token"
       "docker-password"
+      "jellyfin-password"
     ];
   };
 

system/systemmodules/impermanence/default.nix

@@ -152,7 +152,7 @@ in {
             (mkUDir ".config/ghidra" m755)
             (mkUDir ".config/impermanence" m755)
             (mkUDir ".config/jellyfin-mpv-shim" m755)
-            (mkUDir ".config/jellyfin-tui" m755) # TODO: Generate this config file, have to use sops because it includes the password in cleartext
+            # (mkUDir ".config/jellyfin-tui" m755) # Configured using nix
             (mkUDir ".config/JetBrains" m755)
             (mkUDir ".config/kdeconnect" m755)
             (mkUDir ".config/keepassxc" m755)
@@ -182,7 +182,7 @@ in {
             (mkUDir ".local/share/hytale-launcher" m755)
             (mkUDir ".local/share/Hytale" m755)
             (mkUDir ".local/share/jellyfin-desktop" m755)
-            (mkUDir ".local/share/jellyfin-tui" m755)
+            # (mkUDir ".local/share/jellyfin-tui" m755) # Configured using nix
             (mkUDir ".local/share/JetBrains" m755) # Unity
             (mkUDir ".local/share/keyrings" m755) # m700
             (mkUDir ".local/share/IsolatedStorage" m755) # JetBrains license data

system/systemmodules/sops-nix/secrets.yaml

@@ -5,6 +5,7 @@ user-password: ENC[AES256_GCM,data:okgvaTTesCDwriI8PxhNdHZF8XgzB4yxapuFl2/CK8x4W
 ssh-private-key: ENC[AES256_GCM,data:JrRarfeS3y6b9gxg4Za5GIc5Ci3aGR+OyZxQybj4dcv2mzxXmT/bm7KOwM1zkz1PFl1xW5X82T5jte+XQOKx0+6m4ovjUgUmQUMP4E/yosp8XSdi0+YlUKBEHEJx6HqCZy+v6qx5kfp9JC6fZqCbL1J6FIqWqAoKTFXoiou1YnhmBa2fM17Q++i6TflDWiVrUS7X9xjuZFq1hz1aQXS303uvJEUOEpXdqPyJvUKJWzVsFrAwpa9FG+reO70SSc+1hBbqdw1QjrzNWh3eNnztwZURauJtVFBYUZ5ozHmWBr4aVFjYvqz+t6G1SAunmBRbVqbH4bjBv9jXXjHAB4U0wanvkJN2C+EY1zxwjyx2fWckMdhoLr9gtC1FJKMbV49UFHJ3iXWNczKj1t7LrctehEKXJa0Eb3UogYuaRxbVYbC++kD8LvL4AY8ertgc9/pxQQZmogdINJmIxKN4HTlGbX8kSDLbohZLheOfzZ5ycTlrbOjfJ1EBMLo+mJcMUW0qhFySl1aamPqTeII7lvgTOE3xV/d/9VAQTFKsftWPNkfhAJIym51bYrrMPV8AVeFQnLhSid3d3zK4w20zIQKSYnq9A8zcNhM0keddiv4XC+M=,iv:7HP7VCFpMRZXRD6GD/zFzDSBO02V/DyxKLmuDCLXTLU=,tag:Ugx81JwCP8HmhtflYoevLg==,type:str]
 nix-github-token: ENC[AES256_GCM,data:AXV0ODLhfa4M6+7clulfIKm0qCOeo3lQ+66iYgoDeR12RxZOV19UtA==,iv:1XECVKyzH3NumKwRSPKNlUwJMLFwptcG8DQ09U4LrGk=,tag:QdtvJNV8BttWjhH4v0RtRQ==,type:str]
 docker-password: ENC[AES256_GCM,data:mK5YWEQPKWBtVCgRBZvwWTdVAi8MEGbLnLeP7hfDkcc=,iv:Az8+eAK6R6xssmmbhuEsDbLU+ks8lS+qzc4L33WfefA=,tag:NSXvRhbIuRZZqRR28Tu0PQ==,type:str]
+jellyfin-password: ENC[AES256_GCM,data:ugfwgpkIiLY0O+m/UGnBB5AFPBkCcai+RQOkxiCSohE=,iv:VP+Jyv2lUIBz1dFow038uN0KT+tQKK9uGr7/T5crlgk=,tag:rPGPpaqZApfHkecLBSs4Yw==,type:str]
 #
 #ENC[AES256_GCM,data:y5dlZFhK38dR+Q==,iv:1JYizUeyWeMR4KUblkj7kVSHPCL5l8mFpaQdo774BcM=,tag:kUTnBZb46KYQyi8bgIYSOQ==,type:comment]
 #
@@ -33,7 +34,7 @@ sops:
             SURMTmh1TGIrRmtENzc0Sk4rNFJNUE0KOpjN6jkEHO+lvdWdp4P++r9SNSPWaT0h
             FAbbvZZ/EdIk/njLEcayFN7B4ftTcD/f4XJZiyosilZnIkk76bMOHA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-07-19T01:29:00Z"
+    lastmodified: "2026-03-26T19:30:04Z"
-    mac: ENC[AES256_GCM,data:IzLYRuOlkUpry37sw7OB5MglntVflMjCcNiWpi7rvT2suOivLX9IT36qZFfYIbVIFXDmfsi1hsTvsPyekD7vVWQ1vkajAlGQYYTVpnO2cFrK3+TfWCyYjiD01rQBiRikybrR11zWRq6atieurDIxMUMEI7ypiqFOwpYaqSePAFc=,iv:9bc6rc4gjuiJWNjg1g0KfySqxnPjpzmlzDi/R+Iv2g4=,tag:tEwthVZAmdXbwRtoNykGrQ==,type:str]
+    mac: ENC[AES256_GCM,data:DGsz+TNyYXuX45Go4fkFDoWePhx1KUzq94awp+1bQtmq2MC+bPJrTNqvhBDx/I2OWFUNSh/0lXJVvaz4gfeYT9z8YCniJeb3z53ui7ldFL0BNnA6ua1iIViWbJvYARgWlSiuU7wTsb8om57Kainkpm9C9pp2U+vQqQ4suxLmrko=,iv:sUibX01AHDrscPqz+gIPyJhLRJYkyW4DPcQ3QtUGha0=,tag:8yuSGHMg1Z7kDMo2Bx4QlA==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.10.2
+    version: 3.12.2