Add secret support

secrets.nix

@@ -0,0 +1,24 @@
+let
+  self = getFlake (toString ./.);
+  inherit (self) lib;
+
+  inherit (builtins) mapAttrs attrValues readFile getFlake;
+  inherit (lib) optional flatten zipAttrsWith nameValuePair mapAttrs';
+
+  secretPath = p: "secrets/${p}.age";
+
+  defaultKeys = [
+    (readFile .keys/dev.pub)
+  ];
+  secretKeys =
+    zipAttrsWith
+      (_: keys: flatten (keys ++ defaultKeys))
+      (map
+        (c: let cfg = c.config.my.secrets; in mapAttrs'
+          (f: _: nameValuePair
+            (secretPath f)
+            (optional (cfg.key != null) cfg.key))
+          cfg.files)
+        (attrValues self.nixosConfigurations));
+in
+mapAttrs (_: keys: { publicKeys = keys; }) secretKeys