2 files changed, 64 insertions, 0 deletions

diff --git a/flake.lock b/flake.lock
index f4aeef7..c57a6f1 100644
--- a/flake.lock
+++ b/flake.lock
@@ -122,9 +122,27 @@
         "openwrt-packages": "openwrt-packages",
         "openwrt-routing": "openwrt-routing",
         "openwrt-telephony": "openwrt-telephony",
+        "sops": "sops",
         "sunwait": "sunwait"
       }
     },
+    "sops": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1617918541,
+        "narHash": "sha256-AY6xWdN3SxN53dFWt3/fIgHFW6AGCif/19IXIqhncnw=",
+        "owner": "mozilla",
+        "repo": "sops",
+        "rev": "68e2a824bd61c23a8a682f40360559e1da4d3228",
+        "type": "github"
+      },
+      "original": {
+        "owner": "mozilla",
+        "ref": "v3.7.1",
+        "repo": "sops",
+        "type": "github"
+      }
+    },
     "sunwait": {
       "flake": false,
       "locked": {
diff --git a/flake.nix b/flake.nix
index 26d6c0b..3121c76 100644
--- a/flake.nix
+++ b/flake.nix
@@ -46,6 +46,13 @@
       ref = "master";
       flake = false;
     };
+    sops = {
+      type = "github";
+      owner = "mozilla";
+      repo = "sops";
+      ref = "v3.7.1";
+      flake = false;
+    };
   };
 
   outputs = { self, openwrt, nixpkgs, flake-utils, ... }@inputs: flake-utils.lib.eachDefaultSystem (system:
@@ -97,6 +104,8 @@
         # zlib.static
         # glibc.static
 
+        go
+
         pkgconfig
         ubnt-mkfwimage
         gnused
@@ -150,12 +159,49 @@
               $(eval $(call BuildPackage,sunwait))
             ''} $out/utils/sunwait/Makefile
           '';
+          sopsRepo = pkgs.runCommand "openwrt-sops" {} ''
+            mkdir -p $out/utils/sops
+            cp ${pkgs.writeText "Makefile" ''
+              include $(TOPDIR)/rules.mk
+
+              PKG_NAME:=sops
+              PKG_VERSION:=${inputs.sops.rev}
+              PKG_RELEASE:=1
+
+              PKG_BUILD_DEPENDS:=golang/host
+              PKG_BUILD_PARALLEL:=1
+              PKG_USE_MIPS16:=0
+
+              GO_PKG:=go.mozilla.org/sops/v3/cmd/sops
+
+              include $(INCLUDE_DIR)/package.mk
+              include ${inputs.openwrt-packages}/lang/golang/golang-package.mk
+
+              define Package/sops
+                SECTION:=util
+                CATEGORY:=Utilities
+                SUBMENU:=Encryption
+                TITLE:=sops
+                URL:=https://github.com/mozilla/sops
+                DEPENDS:=$(GO_ARCH_DEPENDS)
+                PKGARCH:=all
+              endef
+
+              define Build/Prepare
+                cp --no-preserve=mode --remove-destination -t $(PKG_BUILD_DIR) -r ${inputs.sops}/.
+              endef
+
+              $(eval $(call GoBinPackage,sops))
+              $(eval $(call BuildPackage,sops))
+            ''} $out/utils/sops/Makefile
+          '';
           feedsConf = pkgs.writeText "feeds.conf" ''
             src-cpy packages ${inputs.openwrt-packages}
             src-cpy luci ${inputs.openwrt-luci}
             src-cpy routing ${inputs.openwrt-routing}
             src-cpy telephony ${inputs.openwrt-telephony}
             src-cpy sunwait ${sunwaitRepo}
+            src-cpy sops ${sopsRepo}
           '';
         in ''
           rm feeds.conf.default