Hey Zhaofeng Li: would you be willing to consider https://github.com/zhaofengli/colmena/pull/89?

I wanted to continue hacking along on my colmena adoption, but I feel like a tightrope walker without security if I need to deviate too much from upstream.

I think I'm just not ready yet for forking, so I'd appreciate if I can build on those building blocks.

In reply to @blaggacao:matrix.org

Hey Zhaofeng Li: would you be willing to consider https://github.com/zhaofengli/colmena/pull/89?

I wanted to continue hacking along on my colmena adoption, but I feel like a tightrope walker without security if I need to deviate too much from upstream.

(New to Colmena and just Nix in general).

How do y'all deal with bootstrapping secrets in a Colmena deployment. For example, I have a secret key that I don't want to keep in repo. So every time a developer clones the colmena nix code they would have to get the secret key and create the file on their local machine.

I want to split my colmena deploymeny into 2 parts:

1. Bootstrapping secrets. Should only be done by very few people who have access to the secrets.
2. Any other configuration that can be run by anyone and CI.

Does this make sense to do?

(New to Colmena and just Nix in general).

How do y'all deal with bootstrapping secrets in a Colmena deployment. For example, I have a secret key that I don't want to keep in repo. So every time a developer clones the colmena nix code they would have to get the secret key and create the file on their local machine.

I want to split my colmena deploymeny into 2 parts:

1. Bootstrapping secrets. Should only be done by very few people who have access to the secrets.
2. Any other configuration that can be run by anyone and CI. They should be able to colmena apply without getting secret keys from somewhere else manually.

Does this make sense to do?

In reply to @linus:schreibt.jetzt
lemmalamma: colmena stores the secrets unencrypted on the target hosts, so these "unauthorised" users can still fairly trivially get the secret keys by deploying their own code to the machines.

In reply to @linus:schreibt.jetzt
you also don't need to split it into two, since colmena supports using a command to get secrets -- so you can store them together with your deployment, encrypted (with a tool of your choice) to the authorised users.

In reply to @tiha889a:tu-dresden.de
you can also check out agenix, it is basically sops-nix but with age and I am happily using it, not with colmena yet though.. it is dead simple especially when using the system ssh keys in /etc/ssh/

I'm using the colmena from git (commit 9db25bd) with flakes.

I'm struggling to understand how to define a hive w/ 2 systems where one is using nixpkgs/22.05 while the other is using nixpkgs/unstable as pkgs source.

      meta = {
        nixpkgs = import nixpkgs { system = "x86_64-linux"; };
        nodeNixpkgs = {
          rpi-tv = import nixpkgs-unstable {};
        };
...      
}```

In reply to @janejasperous:one.ems.host

      meta = {
        nixpkgs = import nixpkgs { system = "x86_64-linux"; };
        nodeNixpkgs = {
          rpi-tv = import nixpkgs-unstable {};
        };
...      
}```

Until I change the system in nodeNixpkgs to something different than nixpkgs. Than I get the error

[ERROR]   stderr) error: a 'aarch64-linux' with features {} is required to build '/nix/store/h5ggpshqjbl14pp1qri043d5dk0n2iyc-append-initrd-secrets.drv', but I am a 'x86_64-linux' with features {benchmark, big-parallel, kvm, nixos-test}

In reply to @dantefromhell:matrix.org

Until I change the system in nodeNixpkgs to something different than nixpkgs. Than I get the error

[ERROR]   stderr) error: a 'aarch64-linux' with features {} is required to build '/nix/store/h5ggpshqjbl14pp1qri043d5dk0n2iyc-append-initrd-secrets.drv', but I am a 'x86_64-linux' with features {benchmark, big-parallel, kvm, nixos-test}