!XLCFfvFhUkYwOMLbVx:nixos.org

agenix

327 Members
age-encrypted secrets for NixOS https://github.com/ryantm/agenix/96 Servers

Load older messages


SenderMessageTime
10 May 2025
@headb:edwardh.devEdward Hesketh changed their display name from Edward Hesketh to headb.19:44:59
@strutztm:strutztm.de@strutztm:strutztm.de left the room.19:53:44
@headb:edwardh.devEdward Hesketh changed their display name from headb to Edward Hesketh.23:32:18
11 May 2025
@nemnix:matrix.org@nemnix:matrix.org removed their profile picture.01:27:19
@dgrig:erethon.comdgrig joined the room.20:34:05
13 May 2025
@kraem:ne.bul.aekraem changed their profile picture.13:54:57
17 May 2025
@oddlama:matrix.orgoddlama changed their display name from oddlama to Malte.20:12:11
18 May 2025
@xoredg:matrix.orgxoredi have a container that doesn't allow env vars or anything like that, is there an external tool i can run within nix that would interpolate a secret in a yaml file? 22:31:51
@xoredg:matrix.orgxoredi could also write the yaml in nix so if there are any helps other than builtin.readFile or similar (not recommended) plz let me know22:32:30
@xoredg:matrix.orgxoredor i could do a sed on container startup22:33:01
@xoredg:matrix.orgxoredlet me know what you guys usually do22:33:08
19 May 2025
@andrew-selvia:matrix.orgAndrew Selvia joined the room.08:25:55
21 May 2025
@oddlama:matrix.orgoddlama changed their display name from Malte to oddlama.17:42:11
22 May 2025
@mynacol:mynacol.xyz@mynacol:mynacol.xyz left the room.20:46:14
24 May 2025
@rp6667:matrix.orgrow joined the room.14:51:21
25 May 2025
@raijin_:matrix.org@raijin_:matrix.org left the room.02:00:05
@tebriel:frodux.nettebriel
In reply to @xoredg:matrix.org
let me know what you guys usually do
in these cases I use pkgs.replace-secret to put a hash in the yaml file and pre-process it. Since I use virutalisation.oci-containers which creates a systemd job I can do an execstartpre on the container start to replace the secrets in the file
02:25:21
@nemnix:matrix.org@nemnix:matrix.org left the room.22:40:13
26 May 2025
@yzx9:matrix.orgZexin Yuan joined the room.07:59:49
27 May 2025
@andrew-selvia:matrix.orgAndrew SelviaI have successfully encrypted a secret with agenix (i.e., I see the generated mysecret.age file). Now, I'm trying to integrate it into my flake.nix file. I've been struggling for a week. Is anyone able to educate me?02:45:04
@andrew-selvia:matrix.orgAndrew SelviaMy flake.nix file is just the stock one produced by nix-darwin.02:46:31
@andrew-selvia:matrix.orgAndrew Selvia

When I try to apply configuration like this:

let 
  configuration = { pkgs, config, lib, agenix, ... }: {
    ...
    age.secrets.mysecret = {
      file =./mysecret.age;
      path = "~/demo";
    };
  };
in ...

the following error is produced:

The option `age' does not exist.
02:53:01
@andrew-selvia:matrix.orgAndrew Selvia

Aha! I needed to add this within the configuration:

imports = [ agenix.darwinModules.default ];
04:57:04
@andrew-selvia:matrix.orgAndrew Selvia

I'm trying to produce a minimal flake.nix file that integrates:

  1. agenix
  2. nix-darwin
  3. home-manager

I'm stuck on the last piece. I have successfully threaded an agenix-encrypted secret through an environment variable in the nix-darwin configuration; however, I have yet to discover how to get that same exact secret stored in a file via home-manager. My flake.nix is as follows:

{
  description = "nix-darwin+home-manager+agenix";
  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/master";
    nix-darwin.url = "github:nix-darwin/nix-darwin/master";
    nix-darwin.inputs.nixpkgs.follows = "nixpkgs";
    home-manager.url = "github:nix-community/home-manager";
    home-manager.inputs.nixpkgs.follows = "nixpkgs";
    agenix.url = "github:ryantm/agenix";
  };
  outputs = inputs@{ self, nix-darwin, nixpkgs, home-manager, agenix, ... }:
  let
    homeconfig = { pkgs, config, lib, ... }: {
      #home.file."mysecret.txt".source = config.age.secrets.mysecret.path;
      home.stateVersion = "25.05";
      programs.home-manager.enable = true;
    };
    configuration = { pkgs, config, lib, ... }: {
      age.secrets.mysecret.file = ./mysecret.age;
      environment = {
        systemPackages = [
          agenix.packages.aarch64-darwin.default
        ];
        variables = {
          MYSECRET = config.age.secrets.mysecret.path;
        };
      };
      nix.settings.experimental-features = "nix-command flakes";
      nixpkgs.hostPlatform = "aarch64-darwin";
      system = {
        configurationRevision = self.rev or self.dirtyRev or null;
        stateVersion = 5;
      };
  };
  in
  {
    darwinConfigurations."mac-book-pro" = nix-darwin.lib.darwinSystem {
      modules = [
        agenix.darwinModules.default
        configuration
        home-manager.darwinModules.home-manager
        {
          home-manager.useGlobalPkgs = true;
          home-manager.useUserPackages = true;
          home-manager.users.andrew = homeconfig;
        }
      ];
    };
  };
}

When I try to uncomment this line in the homeconfig:

home.file."mysecret.txt".source = config.age.secrets.mysecret.path;

I encounter this error message:

error: attribute 'age' missing

Please point out anything I should be doing better.

09:41:46
@k900:0upti.meK900 The home-manager config and the nix-darwin config are different things 09:44:28
@k900:0upti.meK900You need to define your secrets in the same config you consume them in09:44:44
@k900:0upti.meK900 Or possibly use osConfig to refer to the nix-darwin fixpoint from home-manager 09:44:58
@andrew-selvia:matrix.orgAndrew Selvia

K900: If I add the secret to homeconfig:

homeconfig = { pkgs, config, lib, ... }: {
  age.secrets.mysecret.file = ./mysecret.age;
  ...
};

I end up with a different error:

error: The option `home-manager.users.andrew.age' does not exist.
09:50:14
@k900:0upti.meK900You also need to add the HM module for agenix09:50:30
@k900:0upti.meK900As the modules are also completely separate09:50:39

Show newer messages


Back to Room ListRoom Version: 6