Way to use secrets with NixOps4 #130

New issue

Closed

opened 2025-02-12 15:53:02 +01:00 by kiara · 3 comments

kiara commented

2025-02-12 15:53:02 +01:00

Owner

options:

use local-exec
use an existing age TF provider, c.f. #129
make a new NixOps provider using age Rust implementation rage

options: - use `local-exec` - use an existing age TF provider, c.f. #129 - make a new NixOps provider using age Rust implementation [`rage`](https://github.com/str4d/rage)

kiara commented

2025-02-18 18:23:59 +01:00

Author

Owner

/cc @roberth

👍 1

roberth commented

2025-02-18 18:42:26 +01:00

Owner

So the goal here is to declare an age-encrypted secret as an input to other resources, decrypting it with the ops person's ambiently provided credentials (e.g. ~/.ssh), and something similar for fedi-panel's configured credentials.
Such workflows are already supported by age/rage. The part that is yet to be bridged is to have actual resources and/or providers that call age/rage to achieve this during nixops apply.

Also worth noting: this operation is stateless and can therefore be implemented before stateful resources are implemented in NixOps4.

So the goal here is to declare an age-encrypted secret as an input to other resources, decrypting it with the ops person's ambiently provided credentials (e.g. `~/.ssh`), and something similar for fedi-panel's configured credentials. Such workflows are already supported by `age`/`rage`. The part that is yet to be bridged is to have actual resources and/or providers that call `age`/`rage` to achieve this during `nixops apply`. Also worth noting: this operation is stateless and can therefore be implemented before stateful resources are implemented in NixOps4.

kiara referenced this issue

2025-03-01 09:20:11 +01:00

handle credentials in NixOps4 #219

kiara added the

component: nixops4

label

2025-03-03 08:15:27 +01:00

kiara added a new dependency

2025-04-02 08:52:05 +02:00

#296 orchestrator features

kiara commented

2025-04-14 11:08:19 +02:00