sops_ update keys for workmac (reencrypt secret)

common/nix-settings.nix

@@ -21,6 +21,7 @@ in
   sops = {
     secrets."nix/access-tokens" = {
       owner = "root";
+      group = "users";
       mode = "0440";
       sopsFile = ./secrets.yaml;
     };
@@ -29,8 +30,7 @@ in
         access-tokens = ${config.sops.placeholder."nix/access-tokens"}
       '';
       owner = "root";
-      # secret needs to be readable by users (nix client) as well as nix-daemon (running as root)
-      group = if pkgs.stdenv.isDarwin then "localaccounts" else "users";
+      group = "users";
       mode = "0440";
     };
   };

darwin/sops.nix

@@ -7,8 +7,6 @@
 {
   sops = {
     age.keyFile = "/Users/os/Library/Application Support/sops/age/keys.txt";
-    age.sshKeyPaths = lib.mkForce [ ]; # no host keys
-    gnupg.sshKeyPaths = lib.mkForce [ ]; # no host keys
     defaultSopsFile = lib.mkDefault ./secrets.yaml;
     defaultSopsFormat = "yaml"; # is the default. ini had some template rendering issues in practice
   };