Fediversity/secrets

Secrets

Secrets are handled using Agenix.

Cheat sheet

Adding a secret

As an example, let us add a secret in a file “cheeses” whose content should be “best ones come unpasteurised”.

1. Edit secrets.nix, adding a field to the final record with the file name mapped to the systems that should be able to decrypt the secret, for instance:

   cheeses = [ vm02116 forgejo-ci ];
   

2. Run Agenix to add the content of the file. Agenix is provided by the development Shell but can also be run directly with nix run github:ryantm/agenix --. Run agenix -e cheeses.age (with the .age extension); this will open your $EDITOR ; enter “best ones come unpasteurised”, save and close.

3. If you are doing something flake-related such as NixOps4, remember to commit or at least stage the secret.

4. In the machine's configuration, load the Agenix NixOS module, declare your secret, possibly with owner/group, and use it where necessary, eg.:

   { config, ... }:
   {
     imports = [ inputs.agenix.x86_64-linux.nixosModules.default ];
     age.secrets.cheeses.file = ../secrets/cheeses.age;
     # age.secrets.cheeses.owner = "jeanpierre";
     # age.secrets.cheeses.group = "france";
     # age.secrets.cheeses.mode = "440";
     services.imaginaryCheeseFactory.frenchSecretFile = config.age.secrets.cheeses.path;
   }
   

5. Never read the content of the file in Nix, that is never do anything like:

   services.imaginaryCheeseFactory.frenchSecret = readFile config.age.secrets.cheeses.path;
   

   This will put the secret as a world-readable file in the Nix store. The service that you are using must be able to read from a file at runtime, and if the NixOS default module options do not provide that, you must find a way around it.