!XLCFfvFhUkYwOMLbVx:nixos.org

agenix

350 Members
age-encrypted secrets for NixOS https://github.com/ryantm/agenix/103 Servers

Load older messages


SenderMessageTime
4 Dec 2024
@lordkekz:matrix.orgLordKekz* In reply to @lordkekz:matrix.org Your /home is on a separate btrfs subvolume. I think it should be fine but maybe it gets mounted too late. Make sure to set filesystems."/home".neededForBoot = true; in your config, maybe that can help ensure it gets mounted early. Beware typos tho, since I'm on my phone and just doing it from memory12:47:02
@bjrnmrtns:matrix.orgbjrnmrtns
In reply to @lordkekz:matrix.org

In reply to @lordkekz:matrix.org
Your /home is on a separate btrfs subvolume. I think it should be fine but maybe it gets mounted too late. Make sure to set filesystems."/home".neededForBoot = true; in your config, maybe that can help ensure it gets mounted early.

Beware typos tho, since I'm on my phone and just doing it from memory

That makes a lot of sense. I'm going to try it and report back. Thanks a lot so far!
12:48:34
@bjrnmrtns:matrix.orgbjrnmrtns
In reply to @lordkekz:matrix.org

In reply to @lordkekz:matrix.org
Your /home is on a separate btrfs subvolume. I think it should be fine but maybe it gets mounted too late. Make sure to set filesystems."/home".neededForBoot = true; in your config, maybe that can help ensure it gets mounted early.

Beware typos tho, since I'm on my phone and just doing it from memory

fileSystems."/home".neededForBoot = true; did the trick.
Thanks a lot for the help with debugging. I was fighting this problem already a few times, but couldn't find the issue.
12:57:05
@lordkekz:matrix.orgLordKekzNice! I'm glad I could help :)12:59:27
@orfeasz:matrix.orgOrfeasZ joined the room.17:36:44
@orfeasz:matrix.orgOrfeasZ Hello, I'm having an issue with agenix and was wondering if anybody has any solutions: I have an OCI container that uses an environment file that's decrypted by agenix. However, agenix seems to always use the same path for that file (/run/agenix/whatever.env) even when its contents change. This makes it so when I update the env file and rebuild my system, the container doesn't get rebuilt since the path hasn't changed. 17:38:31
@orfeasz:matrix.orgOrfeasZ * Hello, I'm having an issue with agenix and was wondering if anybody has any solutions: I have an OCI container that uses an environment file that's decrypted by agenix. However, agenix seems to always use the same path for that file (/run/agenix/whatever.env) even when its contents change. This makes it so when I update the env file and rebuild my system, the container doesn't get recreated since the path hasn't changed. 17:42:54
@orfeasz:matrix.orgOrfeasZ

Alright, looks like I was able to work around this by making agenix use a hash of the encrypted file as the file name:

age.secrets."my-secret" = {
  file = ./my-secret.age;
  name = builtins.hashFile "sha256" ./my-secret.age;
};
19:30:57
@orfeasz:matrix.orgOrfeasZnot ideal, but seems to do the job for now!19:31:09
@lordkekz:matrix.orgLordKekzYeah.. but why do you need the container to rebuild? If it's just to make it restart on system activation, it should be possible to reload the systemd unit on activation somehow. Not sure which option you need tho.19:37:15
@orfeasz:matrix.orgOrfeasZRestarting the container doesn't make it pick up new environment variables. It needs to be re-created.19:40:13
@lordkekz:matrix.orgLordKekzAh, I see. Then you the hash thing is probably as good as it gets19:43:42
@lordkekz:matrix.orgLordKekz * Ah, I see. Then the hash thing is probably as good as it gets19:43:51
@orfeasz:matrix.orgOrfeasZYeah should be fine for now19:44:23
@orfeasz:matrix.orgOrfeasZOnly "real issue" is that it's based on the hash of the encrypted contents and not the plain text contents, which means that the same source file re-encrypted without any changes will cause a re-creation.19:45:27
@orfeasz:matrix.orgOrfeasZBut making it based on the plain text content also reveals that they haven't changed, which is also not great.19:45:52
@orfeasz:matrix.orgOrfeasZSo you know, trade-offs.19:45:57
@lordkekz:matrix.orgLordKekzI think usually the re-creation is preferrable; it rebuilding the container doesn't cause a rebuild of the container image, right?19:48:51
@orfeasz:matrix.orgOrfeasZYe, it doesn't rebuild the image locally.19:49:35
11 Dec 2024
@sheeeng:matrix.orgsheeeng joined the room.06:48:46
@marijan:matrix.orgmarijan changed their profile picture.14:20:27
12 Dec 2024
@gagandeepb:matrix.orggagandeepb joined the room.07:52:39
@wiiplayer2:matrix.orgWaldemar Tomme (they/them) joined the room.22:27:23
14 Dec 2024
@aidalgol:matrix.org@aidalgol:matrix.org left the room.20:35:54
19 Dec 2024
@bbigras:matrix.orgbbigras left the room.01:48:11
21 Dec 2024
@sleepymonad:matrix.org@sleepymonad:matrix.org joined the room.21:18:32
@sleepymonad:matrix.org@sleepymonad:matrix.org set a profile picture.21:56:39
22 Dec 2024
@taotien:matrix.org@taotien:matrix.org left the room.05:30:43
@allrealmsoflife:matrix.orgallrealmsoflife joined the room.20:27:20
26 Dec 2024
@10leej:matrix.orgnevoyu joined the room.01:41:14

Show newer messages


Back to Room ListRoom Version: 6