!XLCFfvFhUkYwOMLbVx:nixos.org

agenix

319 Members
age-encrypted secrets for NixOS https://github.com/ryantm/agenix/96 Servers

Load older messages


SenderMessageTime
25 Apr 2025
@mynacol:mynacol.xyz@mynacol:mynacol.xyzBasename explicitly does not seem to allow this syntax XD21:29:32
@mynacol:mynacol.xyz@mynacol:mynacol.xyzThe reason was I did a bit nix foo to make two rather complex attrsets based on a single string and this string should now also be empty, leaving a leading dash in the generated age file path21:30:53
26 Apr 2025
@mmkaram:matrix.orgmmkaram

would anyone know how to access an agenix decrypted file in home manager, for things in my configuration.nix file I use config.age.secrets.whatever but I've been told I shouldn't pass config into my home.nix file

06:58:20
@k900:0upti.meK900You use the agenix HM module 07:00:30
@k900:0upti.meK900 And then use HM's config 07:00:36
@mmkaram:matrix.orgmmkaram

so use

age.secrets = {};

in my home.nix?

07:01:24
@mmkaram:matrix.orgmmkaram

how would I access those variables in other parts of my home.nix

07:01:54
@mmkaram:matrix.orgmmkaram

again I'm used to the config.age.secrets syntax

07:02:11
@k900:0upti.meK900 You use config.age.secrets 07:05:47
@k900:0upti.meK900 Where config is passed down from HM 07:05:54
@k900:0upti.meK900You don't need to do that explicitly07:06:11
@mmkaram:matrix.orgmmkaram

seriously? my lsp says it can't find config which checks out because it's not an input to the home function

07:07:01
@k900:0upti.meK900You add it as an argument07:07:15
@mmkaram:matrix.orgmmkaram

okaaaay, and I can access the path from that I think, config.age.secrets.whatever.path

07:11:33
@mmkaram:matrix.orgmmkaramhow would I get what's actually in the value07:11:51
@mmkaram:matrix.orgmmkaram

builtins.readFile?

07:11:56
@k900:0upti.meK900That would entirely break the security model of agenix07:12:22
@mmkaram:matrix.orgmmkaramright yeah that makes sense07:12:35
@k900:0upti.meK900The whole point of agenix is that your secrets are never visible at eval time07:12:36
@mmkaram:matrix.orgmmkaramrealized that after I wrote that message07:12:59
@mmkaram:matrix.orgmmkaramhow do most people go about reading the value07:13:08
@k900:0upti.meK900You don't07:13:12
@k900:0upti.meK900You need the application to read that file at runtime07:13:20
@k900:0upti.meK900Somehow07:13:26
@k900:0upti.meK900How exactly depends on the application07:13:34
@mmkaram:matrix.orgmmkaraminteresting07:14:31
@ruby:isincredibly.gayruby joined the room.14:41:13
@r522:matrix.org522 [it/its][ΘΔ]

generally speaking, services that handle secrets will let you pass them as a file (as in, you enter the filename)
like my listenbrainz-mpd config

services.listenbrainz-mpd = {
  enable = true;
  settings = {
    submission = {
      token_file = config.age.secrets.listenbrainz-mpd-token.path;
    };
  };
};
20:21:58
@tebriel:frodux.nettebriel

and sometimes they don't and you have to bend over backwards to find a way to inject them in another manner! (I feel icky about this script I wrote)

    xdg.configFile."mcphub/servers.json" = {
      source = jsonFormat.generate "servers.json" {
        mcpServers = {
          github-mcp = {
            command = lib.getExe (
              pkgs.writeShellApplication {
                name = "github-mcp-server";
                runtimeInputs = [pkgs-unstable.github-mcp-server];
                text = ''
                  GITHUB_PERSONAL_ACCESS_TOKEN=$(cat ${osConfig.age.secrets."github-mcp-token".path})
                  export GITHUB_PERSONAL_ACCESS_TOKEN
                  ${lib.getExe pkgs-unstable.github-mcp-server} "$@"
                '';
              }
            );
            args = ["stdio"];
            env = {};
          };
        };
      };
    };
20:41:54
27 Apr 2025
@luzifer2222:matrix.orgbitfoo changed their display name from luzifer2222 to bitfoo.17:17:52

Show newer messages


Back to Room ListRoom Version: 6