!XLCFfvFhUkYwOMLbVx:nixos.org

agenix

313 Members
age-encrypted secrets for NixOS https://github.com/ryantm/agenix/92 Servers

Load older messages


SenderMessageTime
21 May 2025
@oddlama:matrix.orgoddlama changed their display name from Malte to oddlama.17:42:11
22 May 2025
@mynacol:mynacol.xyz@mynacol:mynacol.xyz left the room.20:46:14
24 May 2025
@rp6667:matrix.orgrow joined the room.14:51:21
25 May 2025
@raijin_:matrix.org@raijin_:matrix.org left the room.02:00:05
@tebriel:frodux.nettebriel
In reply to @xoredg:matrix.org
let me know what you guys usually do
in these cases I use pkgs.replace-secret to put a hash in the yaml file and pre-process it. Since I use virutalisation.oci-containers which creates a systemd job I can do an execstartpre on the container start to replace the secrets in the file
02:25:21
@nemnix:matrix.org@nemnix:matrix.org left the room.22:40:13
26 May 2025
@yzx9:matrix.orgZexin Yuan joined the room.07:59:49
27 May 2025
@andrew-selvia:matrix.orgAndrew SelviaI have successfully encrypted a secret with agenix (i.e., I see the generated mysecret.age file). Now, I'm trying to integrate it into my flake.nix file. I've been struggling for a week. Is anyone able to educate me?02:45:04
@andrew-selvia:matrix.orgAndrew SelviaMy flake.nix file is just the stock one produced by nix-darwin.02:46:31
@andrew-selvia:matrix.orgAndrew Selvia

When I try to apply configuration like this:

let 
  configuration = { pkgs, config, lib, agenix, ... }: {
    ...
    age.secrets.mysecret = {
      file =./mysecret.age;
      path = "~/demo";
    };
  };
in ...

the following error is produced:

The option `age' does not exist.
02:53:01
@andrew-selvia:matrix.orgAndrew Selvia

Aha! I needed to add this within the configuration:

imports = [ agenix.darwinModules.default ];
04:57:04
@andrew-selvia:matrix.orgAndrew Selvia

I'm trying to produce a minimal flake.nix file that integrates:

  1. agenix
  2. nix-darwin
  3. home-manager

I'm stuck on the last piece. I have successfully threaded an agenix-encrypted secret through an environment variable in the nix-darwin configuration; however, I have yet to discover how to get that same exact secret stored in a file via home-manager. My flake.nix is as follows:

{
  description = "nix-darwin+home-manager+agenix";
  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/master";
    nix-darwin.url = "github:nix-darwin/nix-darwin/master";
    nix-darwin.inputs.nixpkgs.follows = "nixpkgs";
    home-manager.url = "github:nix-community/home-manager";
    home-manager.inputs.nixpkgs.follows = "nixpkgs";
    agenix.url = "github:ryantm/agenix";
  };
  outputs = inputs@{ self, nix-darwin, nixpkgs, home-manager, agenix, ... }:
  let
    homeconfig = { pkgs, config, lib, ... }: {
      #home.file."mysecret.txt".source = config.age.secrets.mysecret.path;
      home.stateVersion = "25.05";
      programs.home-manager.enable = true;
    };
    configuration = { pkgs, config, lib, ... }: {
      age.secrets.mysecret.file = ./mysecret.age;
      environment = {
        systemPackages = [
          agenix.packages.aarch64-darwin.default
        ];
        variables = {
          MYSECRET = config.age.secrets.mysecret.path;
        };
      };
      nix.settings.experimental-features = "nix-command flakes";
      nixpkgs.hostPlatform = "aarch64-darwin";
      system = {
        configurationRevision = self.rev or self.dirtyRev or null;
        stateVersion = 5;
      };
  };
  in
  {
    darwinConfigurations."mac-book-pro" = nix-darwin.lib.darwinSystem {
      modules = [
        agenix.darwinModules.default
        configuration
        home-manager.darwinModules.home-manager
        {
          home-manager.useGlobalPkgs = true;
          home-manager.useUserPackages = true;
          home-manager.users.andrew = homeconfig;
        }
      ];
    };
  };
}

When I try to uncomment this line in the homeconfig:

home.file."mysecret.txt".source = config.age.secrets.mysecret.path;

I encounter this error message:

error: attribute 'age' missing

Please point out anything I should be doing better.

09:41:46
@k900:0upti.meK900 The home-manager config and the nix-darwin config are different things 09:44:28
@k900:0upti.meK900You need to define your secrets in the same config you consume them in09:44:44
@k900:0upti.meK900 Or possibly use osConfig to refer to the nix-darwin fixpoint from home-manager 09:44:58
@andrew-selvia:matrix.orgAndrew Selvia

K900: If I add the secret to homeconfig:

homeconfig = { pkgs, config, lib, ... }: {
  age.secrets.mysecret.file = ./mysecret.age;
  ...
};

I end up with a different error:

error: The option `home-manager.users.andrew.age' does not exist.
09:50:14
@k900:0upti.meK900You also need to add the HM module for agenix09:50:30
@k900:0upti.meK900As the modules are also completely separate09:50:39
@andrew-selvia:matrix.orgAndrew Selvia *

K900: If I add the secret to homeconfig:

homeconfig = { pkgs, config, lib, ... }: {
  age.secrets.mysecret.file = ./mysecret.age;
  home.file."mysecret.txt".source = config.age.secrets.mysecret.path;
  ...
};

I end up with a different error:

error: The option `home-manager.users.andrew.age' does not exist.
09:50:47
@andrew-selvia:matrix.orgAndrew Selvia

K900: When I add the HM module:

modules = [
  agenix.darwinModules.default
  agenix.homeManagerModules.default
  ...
];

I end up with this error:

error: The option `age.identityPaths' in `/nix/store/foo.../age.nix' is already declared in `/nix/store/bar.../age.nix'.
09:56:51
@k900:0upti.meK900It needs to be added to the HM imports 09:57:31
@k900:0upti.meK900 Not the nix-darwin imports 09:57:36
@k900:0upti.meK900Because those are, yet again, separate 09:57:41
@andrew-selvia:matrix.orgAndrew SelviaMy apologies, how would I express that?09:58:10
@k900:0upti.meK900 home-manager.users.foo.imports = [ agenix.homeManagerModules.default ] 09:59:49
@andrew-selvia:matrix.orgAndrew Selvia

K900 You've pointed me in the right direction:

homeconfig = { pkgs, config, lib, ... }: {
  imports = [agenix.homeManagerModules.default];
  age.secrets.mysecret.file = ./mysecret.age;
  home.file."mysecret.txt".source = config.age.secrets.mysecret.path;
  ...
};

By any chance, do you have a recommendation for how to handle this?

error: A definition for option `home-manager.users.andrew.home.file."mysecret.txt".source' is not of type `absolute path'. Definition values:
- In `<unknown-file>': "$(getconf DARWIN_USER_TEMP_DIR)/agenix/mysecret"
10:19:09
@k900:0upti.meK900I don't think it works like that 10:20:26
@andrew-selvia:matrix.orgAndrew Selviahttps://github.com/ryantm/agenix/issues/329?10:21:15
@andrew-selvia:matrix.orgAndrew SelviaIs there a preferred way of storing an agenix secret via HM?10:25:41
@andrew-selvia:matrix.orgAndrew Selvia Seemingly related 10:35:56

Show newer messages


Back to Room ListRoom Version: 6