4 ms·
One of the hurdles with this approach is that _everything_ has to live in configuration.nix. How are you handling secrets like your host keys? I recently got so
by ochoseis 4y ago
One of the hurdles with this approach is that _everything_ has to live in configuration.nix. How are you handling secrets like your host keys? I recently got sops-nix working as a prototype, but curious if there are better ways.
Side note: everything living in configuration.nix makes flake-ifying your system a lot easier, which is a win in my book.
- anotherhue 4y agoThere's a nix way to read a secret from a file. I'm not sure if it still ends up in the nix store that way but at least it's not in the config file so your VCS is clean.
- piperswe 4y agoTypically with NixOS, you'll have systemd or a wrapper script read the secret from a file into an environment variable for the service that needs the secret. This secret file would be stored in `/var/lib` or similar, outside the Nix store. There isn't really a "Nix" way, just a pattern used in various places in NixOS.
- whateveracct 4y agoI know NixOps has a way to handle keys without putting them in the store and without having to do some out-of-band file management: https://nixops.readthedocs.io/en/latest/overview.html#managing-keys https://nixops.readthedocs.io/en/latest/overview.html#managi...