mirror of
https://github.com/ryantm/agenix.git
synced 2024-08-17 01:50:24 +03:00
Compare commits
4 Commits
9b12d3b02b
...
66d8bd08ab
Author | SHA1 | Date | |
---|---|---|---|
|
66d8bd08ab | ||
|
3a56735779 | ||
|
08ed896eb6 | ||
|
f5f56c0246 |
21
README.md
21
README.md
@ -244,15 +244,15 @@ e.g. inside your `flake.nix` file:
|
||||
have `sshd` running on it so that it has generated SSH host keys in
|
||||
`/etc/ssh/`.
|
||||
|
||||
2. Make a directory to store secrets and `secrets.nix` file for listing secrets and their public keys:
|
||||
2. Make a directory to store secrets and `agenix-rules.nix` file for listing secrets and their public keys:
|
||||
```ShellSession
|
||||
$ mkdir secrets
|
||||
$ cd secrets
|
||||
$ touch secrets.nix
|
||||
$ touch agenix-rules.nix
|
||||
```
|
||||
This `secrets.nix` file is **not** imported into your NixOS configuration.
|
||||
This `agenix-rules.nix` file is **not** imported into your NixOS configuration.
|
||||
It's only used for the `agenix` CLI tool (example below) to know which public keys to use for encryption.
|
||||
3. Add public keys to your `secrets.nix` file:
|
||||
3. Add public keys to your `agenix-rules.nix` file:
|
||||
```nix
|
||||
let
|
||||
user1 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL0idNvgGiucWgup/mP78zyC23uFjYq0evcWdjGQUaBH";
|
||||
@ -283,7 +283,7 @@ e.g. inside your `flake.nix` file:
|
||||
$ agenix -e secret1.age
|
||||
```
|
||||
It will open a temporary file in the app configured in your $EDITOR environment variable.
|
||||
When you save that file its content will be encrypted with all the public keys mentioned in the `secrets.nix` file.
|
||||
When you save that file its content will be encrypted with all the public keys mentioned in the `agenix-rules.nix` file.
|
||||
5. Add secret to a NixOS module config:
|
||||
```nix
|
||||
{
|
||||
@ -567,13 +567,18 @@ EDITOR environment variable of editor to use when editing FILE
|
||||
|
||||
If STDIN is not interactive, EDITOR will be set to "cp /dev/stdin"
|
||||
|
||||
RULES environment variable with path to Nix file specifying recipient public keys.
|
||||
Defaults to './secrets.nix'
|
||||
AGENIX_RULES environment variable with path to Nix file specifying recipient public keys.
|
||||
Defaults to './agenix-rules.nix'
|
||||
```
|
||||
|
||||
Up to version 0.14.0, agenix used the variable `RULES` (instead of
|
||||
`AGENIX_RULES`) and the default rules file `secrets.nix` (instead of
|
||||
`agenix-rules.nix`). Currently agenix still honours those, but they will be
|
||||
deprecated in the future.
|
||||
|
||||
#### Rekeying
|
||||
|
||||
If you change the public keys in `secrets.nix`, you should rekey your
|
||||
If you change the public keys in `agenix-rules.nix`, you should rekey your
|
||||
secrets:
|
||||
|
||||
```ShellSession
|
||||
|
@ -246,5 +246,5 @@ EDITOR environment variable of editor to use when editing FILE
|
||||
|
||||
If STDIN is not interactive, EDITOR will be set to "cp /dev/stdin"
|
||||
|
||||
RULES environment variable with path to Nix file specifying recipient public keys.
|
||||
Defaults to './secrets.nix'
|
||||
AGENIX_RULES environment variable with path to Nix file specifying recipient public keys.
|
||||
Defaults to './agenix-rules.nix'
|
||||
|
@ -1,6 +1,6 @@
|
||||
# Rekeying {#rekeying}
|
||||
|
||||
If you change the public keys in `secrets.nix`, you should rekey your
|
||||
If you change the public keys in `agenix-rules.nix`, you should rekey your
|
||||
secrets:
|
||||
|
||||
```ShellSession
|
||||
|
@ -4,14 +4,14 @@
|
||||
have `sshd` running on it so that it has generated SSH host keys in
|
||||
`/etc/ssh/`.
|
||||
|
||||
2. Make a directory to store secrets and `secrets.nix` file for listing secrets and their public keys (This file is **not** imported into your NixOS configuration. It is only used for the `agenix` CLI.):
|
||||
2. Make a directory to store secrets and `agenix-rules.nix` file for listing secrets and their public keys (This file is **not** imported into your NixOS configuration. It is only used for the `agenix` CLI.):
|
||||
|
||||
```ShellSession
|
||||
$ mkdir secrets
|
||||
$ cd secrets
|
||||
$ touch secrets.nix
|
||||
$ touch agenix-rules.nix
|
||||
```
|
||||
3. Add public keys to `secrets.nix` file (hint: use `ssh-keyscan` or GitHub (for example, https://github.com/ryantm.keys)):
|
||||
3. Add public keys to `agenix-rules.nix` file (hint: use `ssh-keyscan` or GitHub (for example, https://github.com/ryantm.keys)):
|
||||
```nix
|
||||
let
|
||||
user1 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL0idNvgGiucWgup/mP78zyC23uFjYq0evcWdjGQUaBH";
|
||||
|
@ -61,7 +61,7 @@ with lib; let
|
||||
|
||||
${optionalString secretType.symlink ''
|
||||
# shellcheck disable=SC2193,SC2050
|
||||
[ "${secretType.path}" != "${cfg.secretsDir}/${secretType.name}" ] && ln -sfn "${cfg.secretsDir}/${secretType.name}" "${secretType.path}"
|
||||
[ "${secretType.path}" != "${cfg.secretsDir}/${secretType.name}" ] && ln -sfT "${cfg.secretsDir}/${secretType.name}" "${secretType.path}"
|
||||
''}
|
||||
'';
|
||||
|
||||
@ -76,7 +76,7 @@ with lib; let
|
||||
_agenix_generation="$(basename "$(readlink "${cfg.secretsDir}")" || echo 0)"
|
||||
(( ++_agenix_generation ))
|
||||
echo "[agenix] symlinking new secrets to ${cfg.secretsDir} (generation $_agenix_generation)..."
|
||||
ln -sfn "${cfg.secretsMountPoint}/$_agenix_generation" "${cfg.secretsDir}"
|
||||
ln -sfT "${cfg.secretsMountPoint}/$_agenix_generation" "${cfg.secretsDir}"
|
||||
|
||||
(( _agenix_generation > 1 )) && {
|
||||
echo "[agenix] removing old secrets (generation $(( _agenix_generation - 1 )))..."
|
||||
|
@ -88,7 +88,7 @@ with lib; let
|
||||
mv -f "$TMP_FILE" "$_truePath"
|
||||
|
||||
${optionalString secretType.symlink ''
|
||||
[ "${secretType.path}" != "${cfg.secretsDir}/${secretType.name}" ] && ln -sfn "${cfg.secretsDir}/${secretType.name}" "${secretType.path}"
|
||||
[ "${secretType.path}" != "${cfg.secretsDir}/${secretType.name}" ] && ln -sfT "${cfg.secretsDir}/${secretType.name}" "${secretType.path}"
|
||||
''}
|
||||
'';
|
||||
|
||||
@ -103,7 +103,7 @@ with lib; let
|
||||
_agenix_generation="$(basename "$(readlink ${cfg.secretsDir})" || echo 0)"
|
||||
(( ++_agenix_generation ))
|
||||
echo "[agenix] symlinking new secrets to ${cfg.secretsDir} (generation $_agenix_generation)..."
|
||||
ln -sfn "${cfg.secretsMountPoint}/$_agenix_generation" ${cfg.secretsDir}
|
||||
ln -sfT "${cfg.secretsMountPoint}/$_agenix_generation" ${cfg.secretsDir}
|
||||
|
||||
(( _agenix_generation > 1 )) && {
|
||||
echo "[agenix] removing old secrets (generation $(( _agenix_generation - 1 )))..."
|
||||
|
@ -26,8 +26,8 @@ function show_help () {
|
||||
echo ' '
|
||||
echo 'If STDIN is not interactive, EDITOR will be set to "cp /dev/stdin"'
|
||||
echo ' '
|
||||
echo 'RULES environment variable with path to Nix file specifying recipient public keys.'
|
||||
echo "Defaults to './secrets.nix'"
|
||||
echo 'AGENIX_RULES environment variable with path to Nix file specifying recipient public keys.'
|
||||
echo "Defaults to './agenix-rules.nix'"
|
||||
echo ' '
|
||||
echo "agenix version: @version@"
|
||||
echo "age binary path: @ageBin@"
|
||||
@ -101,7 +101,40 @@ while test $# -gt 0; do
|
||||
esac
|
||||
done
|
||||
|
||||
RULES=${RULES:-./secrets.nix}
|
||||
function get_configured_rules {
|
||||
# prints the first among $AGENIX_RULES, $RULES, erroring out if it points to a
|
||||
# non-existing file
|
||||
! [ -v AGENIX_RULES ] && ! [ -v RULES ] && return 1
|
||||
local rulesfile="${AGENIX_RULES:-$RULES}"
|
||||
[ -f "$rulesfile" ] || {
|
||||
[ -v AGENIX_RULES ] && variable='AGENIX_RULES' || variable='RULES'
|
||||
err "Rules file '$rulesfile' specified via the variable $variable not found."
|
||||
}
|
||||
echo "$rulesfile"
|
||||
}
|
||||
|
||||
function find_rules {
|
||||
# walks up the directory tree, printing the first file named agenix-rules.nix
|
||||
# or ./secrets.nix it finds and erroring out otherwise
|
||||
local cwd="$PWD"
|
||||
local rulesfile=''
|
||||
while [ -z "$rulesfile" ]
|
||||
do
|
||||
for f in "$cwd/agenix-rules.nix" "$cwd/secrets.nix"
|
||||
do
|
||||
[ -f "$f" ] && rulesfile="$f"
|
||||
done
|
||||
[ "$cwd" != '/' ] || break
|
||||
cwd=$(dirname "$cwd")
|
||||
done
|
||||
[ -n "$rulesfile" ] || err "$PACKAGE needs a rules file. You can specify one by setting the AGENIX_RULES variable or you can create a file named 'agenix-rules.nix' in the current directory or one of its parents."
|
||||
echo "$rulesfile"
|
||||
unset cwd rulesfile
|
||||
}
|
||||
|
||||
RULES=$(get_configured_rules || find_rules)
|
||||
[ -r "$RULES" ] || err "Cannot read rules file '$RULES'."
|
||||
|
||||
function cleanup {
|
||||
if [ -n "${CLEARTEXT_DIR+x}" ]
|
||||
then
|
||||
|
Loading…
Reference in New Issue
Block a user