In reply to @happyalu:matrix.org
I was using git-crypt with yubikey before, and just switched to sops-nix.

In reply to @oddlama:matrix.org
Do you want to use your yubikey to decrypt on system activation, or do you want to use it to store encrypted secrets in your repository which are then rekeyed for the host before deploying?

In reply to @xxxcrow:matrix.org
Is yubikey working for you right now?
If yes, can you show me the way to do this, please, i can't find clues 💀

I'm using gpg on my yubikey to encrypt secrets in the repo. sops-nix decrypts them at system activation. Yubikey is not (needeed to be) present during the activation. Not sure if that matches with what you are trying to do.

I found these resources helpful:

1. create ECC based gpg key. https://illuad.fr/2020/10/06/build-an-openpgp-key-based-on-ecc.html
2. add the key to yubikey. https://illuad.fr/2020/10/07/store-openpgp-keys-on-a-yubikey.html

After that I just followed the sops-nix readme to add my gpg key fingerprint to the .sops.yaml file.

In reply to @happyalu:matrix.org

I'm using gpg on my yubikey to encrypt secrets in the repo. sops-nix decrypts them at system activation. Yubikey is not (needeed to be) present during the activation. Not sure if that matches with what you are trying to do.

I found these resources helpful:

1. create ECC based gpg key. https://illuad.fr/2020/10/06/build-an-openpgp-key-based-on-ecc.html
2. add the key to yubikey. https://illuad.fr/2020/10/07/store-openpgp-keys-on-a-yubikey.html

After that I just followed the sops-nix readme to add my gpg key fingerprint to the .sops.yaml file.

In reply to @xxxcrow:matrix.org
Does not need to be present during activation? Because it stored in the agent? 🤔

In reply to @happyalu:matrix.org
oh i missed one quite important detail. I use the yubikey mainly so I can edit my secrets anywhere. For the host, I use the ssh key of the host (with ssh-to-age) for decryption.