all: make deploy setup optional

configs/update.nix

@@ -12,6 +12,14 @@ with lib; {
         type = lib.types.bool;
       };
     };
+    needsDeploy = {
+      enable = mkOption {
+        description = "Host needs deploy key to receive encrypted secrets";
+        default = true;
+        example = true;
+        type = lib.types.bool;
+      };
+    };
   };
 
   config = mkMerge [
@@ -24,15 +32,17 @@ with lib; {
         dates = "*-*-* *:05:00";
       };
     })
-    {
+
-      # Always add our host alias or we run into a bootstrap issue
+    # Always add our host alias or we run into a bootstrap issue
-      programs.ssh.extraConfig = ''
+    (mkIf config.needsDeploy.enable {
-        Host xin-secrets-ro
+      programs.ssh.extraConfig =
-          IdentityFile ${config.sops.secrets.xin_secrets_deploy_key.path}
+        ''
-          User gitea
+          Host xin-secrets-ro
-          Port 2222
+            IdentityFile ${config.sops.secrets.xin_secrets_deploy_key.path}
-          Hostname git.tapenet.org
+            User gitea
-      '';
+            Port 2222
-    }
+            Hostname git.tapenet.org
+        '';
+    })
   ];
 }

hosts/tv/default.nix

@@ -22,6 +22,8 @@ in
     ./hardware-configuration.nix
   ];
 
+  needsDeploy.enable = false;
+
   boot = {
     loader = {
       systemd-boot.enable = true;