Remove all git-crypt

modules/services/data-access/config.nix

@@ -7,7 +7,9 @@
     description = "Data Access";
     uid = 1000;
     group = "users";
+    passwordFile = "/run/secrets/password_file";
   };
+  environment.systemPackages = [ pkgs.rsync pkgs.mktorrent (pkgs.writeShellScriptBin "create_torrent" ". /run/secrets/create_torrent") ];
   security.sudo.enable = false;
   services.openssh = {
     enable = true;
@@ -16,5 +18,6 @@
       { bits = 4096; path = "/run/secrets/ssh_host_rsa_key"; type = "rsa"; }
       { path = "/run/secrets/ssh_host_ed25519_key"; type = "ed25519"; }
     ];
+    authorizedKeysFiles = [ "/run/secrets/authorized_keys" ];
   };
 }

modules/services/data-access/default.nix

@@ -1,8 +1,6 @@
 { config, lib, ... }:
 
 {
-  imports = [ ./secret.nix ];
-
   options.chvp.services.data-access.enable = lib.mkOption {
     default = false;
     example = true;
@@ -32,6 +30,8 @@
       ];
     };
 
+    networking.firewall.allowedTCPPorts = [ 2002 ];
+
     containers.data-access = {
       ephemeral = true;
       autoStart = true;
@@ -45,13 +45,18 @@
           isReadOnly = true;
         };
       };
+      forwardPorts = [{
+        containerPort = 22;
+        hostPort = 2002;
+        protocol = "tcp";
+      }];
       privateNetwork = true;
       hostAddress = "192.168.100.10";
       hostAddress6 = "fc00::1";
       localAddress = "192.168.100.11";
       localAddress6 = "fc00::2";
       config = { ... }: {
-        imports = [ ./config.nix ./config.secret.nix ];
+        imports = [ ./config.nix ];
       };
     };
 
@@ -59,6 +64,15 @@
     age.secrets."data-access/ssh_host_rsa_key.pub".file = ../../../secrets/data-access/ssh_host_rsa_key.pub.age;
     age.secrets."data-access/ssh_host_ed25519_key".file = ../../../secrets/data-access/ssh_host_ed25519_key.age;
     age.secrets."data-access/ssh_host_ed25519_key.pub".file = ../../../secrets/data-access/ssh_host_ed25519_key.pub.age;
+    age.secrets."data-access/password_file".file = ../../../secrets/data-access/password_file.age;
+    age.secrets."data-access/authorized_keys" = {
+      file = ../../../secrets/data-access/authorized_keys.age;
+      owner = "charlotte";
+    };
+    age.secrets."data-access/create_torrent" = {
+      file = ../../../secrets/data-access/create_torrent.age;
+      owner = "charlotte";
+    };
     age.secrets."passwords/services/data-basic-auth" = {
       file = ../../../secrets/passwords/services/data-basic-auth.age;
       owner = "nginx";