You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Make bootstrapping new NixOS systems using encrypted secrets less of a chore by creating options to generate new secrets for secrets specified in config that are missing their corresponding .age secret file.
Here's a quick-n-dirty set of NixOS/home-manager options to implement this:
When a secret name cannot be found, these options would be run as a bash script to initialize the secret file with the stdout of the command or a file path to be generated by the command.
Additionally, other options could be used for common secret formats. e.g. age.secrets.<name>.type. Secrets could be declared as that type to reuse common secret generation commands or manually specify how they are to be generated.
# agenix could provide the most common type definitions, which users could extend
age.generate.types.ssh-rsa4096 = rec {
commandOutput = "<path>"; # or stdout when null.
command = ''
ssh-keygen -t rsa -b 4096 -f ${commandOutput}
'';
};
# Secrets could then use this by setting:
age.secrets.my-4096bit-ssh-key.type = "ssh-rsa4096";
Once all missing secrets are resolved, agenix could optionally do one of the following:
Mount the resulting age-encrypted secret .age files to a location on disk
Create an activation script to add & commit the changes to an upstream repo.
age.generate.push = {
# Disabled by default
enable = true;
# Push directly to a branch, otherwise open new PR
skipRequest = true;
# Set remote. Could be filesystem directory, URL, or attrset specifying host, owner, repo, branch, rev, etc.
repo = "https://github.com/<user>/my-nixos-configs.git";
commitMessage = ''
command to generate summary of secret changes.
--- OR ---
plain string interpolated with vars
'';
# ... whatever other options that might facilitate this.
};
Might be a lot for this feature, but would simplify bootstrapping even further. This could also be done with generic hooks on the generation command or upon fully resolving all missing secrets.
Something like this would make bootstrapping NixOS with per-host or per-user secrets so much less of a pain, especially when you need a mixture of secrets that are unique per-host and shared between hosts.
Obviously, this would break reproducibility until all missing secrets are fully resolved, but would maintain reproducibility thereafter...which is not different from manually bootstrapping secrets, just with more automation.
Another (potentially) simpler implementation options could just be surfacing options to hook the various parts of the process
Make bootstrapping new NixOS systems using encrypted secrets less of a chore by creating options to generate new secrets for secrets specified in config that are missing their corresponding
.age
secret file.Here's a quick-n-dirty set of NixOS/home-manager options to implement this:
When a secret name cannot be found, these options would be run as a bash script to initialize the secret file with the
stdout
of the command or a file path to be generated by the command.Additionally, other options could be used for common secret formats. e.g.
age.secrets.<name>.type
. Secrets could be declared as that type to reuse common secret generation commands or manually specify how they are to be generated.Once all missing secrets are resolved,
agenix
could optionally do one of the following:.age
files to a location on diskMight be a lot for this feature, but would simplify bootstrapping even further. This could also be done with generic hooks on the generation command or upon fully resolving all missing secrets.
Something like this would make bootstrapping NixOS with per-host or per-user secrets so much less of a pain, especially when you need a mixture of secrets that are unique per-host and shared between hosts.
Obviously, this would break reproducibility until all missing secrets are fully resolved, but would maintain reproducibility thereafter...which is not different from manually bootstrapping secrets, just with more automation.
Another (potentially) simpler implementation options could just be surfacing options to hook the various parts of the process
The text was updated successfully, but these errors were encountered: