base/secrets: add module

base/base.nix

@@ -30,6 +30,7 @@ in
     ./grafana-alloy.nix
     ./network.nix
     ./qemu.nix
+    ./secrets.nix
     ./spice.nix
   ];
 

base/secrets.nix

@@ -0,0 +1,25 @@
+{
+  config,
+  lib,
+  pkgs,
+  pkgsUnstable,
+  inputs,
+  ...
+}:
+
+with lib;
+
+let
+  cfg = config.secrets;
+in
+{
+  options.spice = {
+    enable = mkEnableOption "Enable SPICE guest setup";
+  };
+
+  config = {
+    sops.defaultSopsFile = ./secrets/secrets.yaml;
+    sops.defaultSopsFormat = "yaml";
+    sops.age.keyFile = "";
+  };
+}