* infra backend
* infra vars
* general envs
this way, secrets are only ever stored on the system (including the nix
store) in an encrypted form in ${XDG_RUNTIME_DIR}.
the workflow is as follows:
* age is used to manually encrypt e.g the sops keys file so it can
securely be stored in git
* homeage decrypts the file and symlinks it where sops expects it to
be present. decrypted, which it will be, but it will in fact be
residing in $XDG_RUNTIME_DIR (which *should* be tmpfs) and only be
symlinked to $HOME/...
* sops can from then on be used to manage arbitrary secrets as usual