4 ms·
With NixOS the main problem is that a lot of local "packages" are configuration files with a lot of secrets. It is very easy to end up seeding your VPN and emai
by Jhsto 3y ago
With NixOS the main problem is that a lot of local "packages" are configuration files with a lot of secrets. It is very easy to end up seeding your VPN and email passwords this way.
- toastal 3y agoIt's not required but it’s a best practices to not get your secrets into the nix store. There are solutions like env vars or Agenix.
- Filligree 3y agoPeople do it anyway, and none of those solutions are as convenient.
- toastal 3y agoGuess you should just check all your secrets into source control. That would be easier too.
- pxc 3y agoThe Nix store is world-readable. Storing plaintext secrets in the Nix store is absolutely insane and foolish. Who does this? Either don't store your secrets this way or don't use Nix. Please.
- ptman 3y agoThere are unfortunately lots of software packages that don't offer a convenient passwordFile option in nix and the easiest way to get running is to specify a password in a way that ends up in the nix store.
- pxc 3y agoI knew of a few options like that, but didn't realize it was so widespread. I wish Nixpkgs had a policy against writing modules that way. This creates a policy nightmare for companies that might use Nix. Alternatively, we need ACLs for the Nix store, or at least some store paths, at a minimum. :-\
- Filligree 3y agoI use agenix when I can, but I'm internally wincing at the thought of trying to explain it to friends I'm getting into nixos. It's not exactly usable. /nix/store isn't world-readable. It's machine-readable, and most machines are single-user. I'll explain the caveats, but I can't tell them never to put secrets there; the predictable outcome then is they won't try nixos.