!XLCFfvFhUkYwOMLbVx:nixos.org

agenix

380 Members
age-encrypted secrets for NixOS https://github.com/ryantm/agenix/99 Servers

Load older messages


SenderMessageTime
27 Jun 2023
@madonius:entropia.de/madonius[er|he]
In reply to @cole-h:matrix.org
What is that modules = [ in shoemaker...? Looks highly suspicious. Just add agenix.nixosModules.default to your imports list right above it.
yeah that was a residue of me trying around
20:47:48
@cole-h:matrix.orgcole-h (nit, but imports is not colmena specific -- it is part of the NixOS module system, which colmena heavily leverages) 20:47:52
@cole-h:matrix.orgcole-h
In reply to @madonius:entropia.de
yeah that was a residue of me trying around
Then if you move the module into your system's imports, does that resolve the issue?
20:50:04
@madonius:entropia.de/madonius[er|he]yes, it does20:54:36
@madonius:entropia.de/madonius[er|he]thanks20:54:39
@madonius:entropia.de/madonius[er|he]since I use sops in all other places I was confused as to why this did not work for age20:55:19
@madonius:entropia.de/madonius[er|he]and no it did not work for sops either :D20:56:17
@madonius:entropia.de/madonius[er|he]I have to say I just switched to nixos 23.05 so this might be an explanation20:56:42
29 Jun 2023
@MartiniMoe:matrix.orgMartiniMoe Does somebody have an example of how to use agenix as a home-manager module? I saw that support for that just got merged but I can’t figure out how to use it 😅
I tried just changing the module used to agenix.homeManagerModule.default but that doesn’t work. I get an error „attribute 'home' is missing“
08:33:44
@ryantm:matrix.orgryantm MartiniMoe: https://github.com/search?q=+agenix.homeManagerModules.default&type=code 12:29:58
@ryantm:matrix.orgryantmit's homeManagerModules with an s on the end12:30:15
@ryantm:matrix.orgryantmI don't actually use it myself, I was hoping someone would follow on with the documentation, but that seems to have not happened. Maybe I should have gated merging on that?12:31:22
@MartiniMoe:matrix.orgMartiniMoe Actually it’s homeManagerModules in my config, you are right.
Hmm there must be something else I’m doing wrong 🤔
12:58:02
@MartiniMoe:matrix.orgMartiniMoe
       error: attribute 'home' missing

       at /nix/store/xp0x08djbldg6cnfbxlhjkna9v6v4v5j-source/modules/age-home.nix:170:12:

          169|       default = [
          170|         "${config.home.homeDirectory}/.ssh/id_ed25519"
             |            ^
          171|         "${config.home.homeDirectory}/.ssh/id_rsa"
       Did you mean time?
13:06:41
@steveej0:matrix.orgsteveej joined the room.13:30:26
@steveej0:matrix.orgsteveejwould anyone mind explaining why the pcscd is needed for agenix-yubikey-plugin? i was hoping i could use the ssh-agent which is configured to use the yubikey14:22:53
@steveej0:matrix.orgsteveej even after enabling the pcscd agenix-yubikey-plugin --list's output is empty 🤔 14:23:48
@steveej0:matrix.orgsteveej * even after enabling the pcscd agenix-plugin-yubikey --list's output is empty 🤔 14:24:01
@oddlama:matrix.orgoddlama

I presume you meant age-plugin-yubikey? pcscd is required for that since that plugin communicates with the smartcard in the yubikey directly. If by "using the ssh-agent" you mean a -sk type key, then openssh would do that communication. That would require age to communicate to the ssh-agent which is not supported:

man age says

Note that keys held on hardware tokens such as YubiKeys
or accessed via ssh-agent(1) are not supported.

14:30:26
@steveej0:matrix.orgsteveej
In reply to @oddlama:matrix.org

I presume you meant age-plugin-yubikey? pcscd is required for that since that plugin communicates with the smartcard in the yubikey directly. If by "using the ssh-agent" you mean a -sk type key, then openssh would do that communication. That would require age to communicate to the ssh-agent which is not supported:

man age says

Note that keys held on hardware tokens such as YubiKeys
or accessed via ssh-agent(1) are not supported.

it's an ssh-rsa type key as displayed by ssh-add -L.
14:36:40
@oddlama:matrix.orgoddlamaBut it's just a keygrab if you have the private part on your yubikey14:37:18
@steveej0:matrix.orgsteveej

i've got gpg enabled via home-manager with the following settings

  programs.gpg.enable = true;
  services.gpg-agent = {
    enable = true;
    enableScDaemon = true;
    enableSshSupport = true;
  };

this is what makes my set up work

14:38:29
@steveej0:matrix.orgsteveej SSH_AUTH_SOCK points to /run/user/1000/gnupg/S.gpg-agent.ssh 14:39:12
@steveej0:matrix.orgsteveejmaybe the plugin could talk to the gpg-agent's scdaemon socket somehow?14:40:00
@oddlama:matrix.orgoddlamaIf you want to use both gpg and age-plugin-yubikey at the same time you have to disable scdaemon and force gpg to use pcsc lite too14:42:47
@steveej0:matrix.orgsteveeji don't insist on using that plugin btw.. i just would like to use the yubikey instead of managing a private key on the filesystem14:42:57
@oddlama:matrix.orgoddlamaI don't think there's an alternative to that plugin then14:43:12
@steveej0:matrix.orgsteveej
In reply to @oddlama:matrix.org
If you want to use both gpg and age-plugin-yubikey at the same time you have to disable scdaemon and force gpg to use pcsc lite too
does the latter refer to options of the plugi, age, or agenix?
14:44:26
@oddlama:matrix.orgoddlamaAgenix has nothing to do with that. It just calls age or rage (implementations of the age spec) which can interface with the plugin https://github.com/str4d/age-plugin-yubikey14:46:12
@steveej0:matrix.orgsteveej thanks oddlama. i'll read up on pcsclite 14:56:06

Show newer messages


Back to Room ListRoom Version: 6