wip: migrate client modules

aspects/battery-pii.nix

@@ -0,0 +1,57 @@
+{ lib, ... }:
+let
+  # If the given expression is a bare set, it will be wrapped in a function,
+  # so that the imported file can always be applied to the inputs, similar to
+  # how modules can be functions or sets.
+  constSet = x: if builtins.isAttrs x then (_: x) else x;
+
+  sopsImportEncrypted =
+    assert lib.assertMsg (builtins ? extraBuiltins.sopsImportEncrypted)
+      "The extra builtin 'sopsImportEncrypted' is not available, so repo.secrets cannot be decrypted. Did you forget to add nix-plugins and point it to `<flakeRoot>/files/nix/extra-builtins.nix` ?";
+    builtins.extraBuiltins.sopsImportEncrypted;
+
+  importEncrypted =
+    path:
+    constSet (
+      if builtins.pathExists path then
+        sopsImportEncrypted path
+      else
+        { }
+    );
+in
+{
+  den = {
+    schema.conf = { config, inputs, lib, homeLib, nodes, globals, ... }: {
+      options = {
+        repo = {
+          secretFiles = lib.mkOption {
+            default = { };
+            type = lib.types.attrsOf lib.types.path;
+            example = lib.literalExpression "{ local = ./pii.nix.enc; }";
+            description = ''
+              This is for storing PII.
+                Each path given here must be an sops-encrypted .nix file. For each attribute `<name>`,
+                the corresponding file will be decrypted, imported and exposed as {option}`repo.secrets.<name>`.
+            '';
+          };
+
+          secrets = lib.mkOption {
+            readOnly = true;
+            default = lib.mapAttrs (_: x: importEncrypted x { inherit lib homeLib nodes globals inputs config; inherit (inputs.topologyPrivate) topologyPrivate; }) config.repo.secretFiles;
+            type = lib.types.unspecified;
+            description = "Exposes the loaded repo secrets.";
+          };
+        };
+      };
+      config = {
+        repo.secretFiles =
+          let
+            local = config.node.secretsDir + "/pii.nix.enc";
+          in
+          (lib.optionalAttrs (lib.pathExists local) { inherit local; }) // {
+            common = ../secrets/repo/pii.nix.enc;
+          };
+      };
+    };
+  };
+}