import secrets right

modules/k3s/default.nix

@@ -4,6 +4,10 @@ let
   cfg = config.nyxs-nix.services.k3s;
 in
 {
+  imports = [
+    ./secrets.nix
+  ];
+
   options.nyxs-nix.services.k3s = with types; {
     enable = mkEnableOption "Enable the vrrp quotes service";
 
@@ -15,10 +19,7 @@ in
   };
 
   config = mkIf cfg.enable {
-    imports = [
-      ./secrets.nix
-    ];
-    
+
     networking.firewall.allowedTCPPorts = [
       6443 # k3s, api server
       2379 # k3s, etcd clients

modules/k3s/secrets.nix

@@ -1,6 +1,10 @@
-{ config, ... }:
+{ config, lib, ... }:
+with lib;
+let
+  cfg = config.nyxs-nix.services.k3s;
+in
 {
-  sops.templates = {
+  sops.templates = mkIf cfg.enable {
      "authentik-secrets.yaml" = {
       content = ''
         apiVersion: v1