mynix/agenix
1
0
Fork 0
mirror of https://github.com/ryantm/agenix.git synced 2024-12-22 23:58:29 +03:00
Code Issues Projects Releases Packages Wiki Activity

doc: explain better where SSH host keys come from in tutorial

Browse source 
fixes #17
This commit is contained in:
Ryan Mulligan 2021-05-12 20:37:06 -07:00
parent 20a5c3d256
commit e543aa7d68
1 changed files with 9 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
README.md
View file

@ -130,14 +130,18 @@ but, if you want to (change the system based on your system):
## Tutorial ## Tutorial
1. Make a directory to store secrets and `secrets.nix` file for listing secrets and their public keys: 1. The system you want to deploy secrets to should already exist and
have `sshd` running on it so that it has generated SSH host keys in
`/etc/ssh/`.
2. Make a directory to store secrets and `secrets.nix` file for listing secrets and their public keys:
```ShellSession ```ShellSession
$ mkdir secrets $ mkdir secrets
$ cd secrets $ cd secrets
$ touch secrets.nix $ touch secrets.nix
``` ```
2. Add public keys to `secrets.nix` file (hint: use `ssh-keyscan` or GitHub (for example, https://github.com/ryantm.keys)): 3. Add public keys to `secrets.nix` file (hint: use `ssh-keyscan` or GitHub (for example, https://github.com/ryantm.keys)):
```nix ```nix
let let
user1 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL0idNvgGiucWgup/mP78zyC23uFjYq0evcWdjGQUaBH"; user1 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL0idNvgGiucWgup/mP78zyC23uFjYq0evcWdjGQUaBH";
@ -153,15 +157,15 @@ but, if you want to (change the system based on your system):
"secret2.age".publicKeys = users ++ systems; "secret2.age".publicKeys = users ++ systems;
} }
``` ```
3. Edit secret files (these instructions assume your SSH private key is in ~/.ssh/): 4. Edit secret files (these instructions assume your SSH private key is in ~/.ssh/):
```ShellSession ```ShellSession
$ agenix -e secret1.age $ agenix -e secret1.age
``` ```
4. Add secret to a NixOS module config: 5. Add secret to a NixOS module config:
```nix ```nix
age.secrets.secret1.file = ../secrets/secret1.age; age.secrets.secret1.file = ../secrets/secret1.age;
``` ```
5. NixOS rebuild or use your deployment tool like usual. 6. NixOS rebuild or use your deployment tool like usual.
The secret will be decrypted to the value of `age.secrets.secret1.path` (`/run/secrets/secret1` by default). For per-secret options controlling ownership etc, see [modules/age.nix](modules/age.nix). The secret will be decrypted to the value of `age.secrets.secret1.path` (`/run/secrets/secret1` by default). For per-secret options controlling ownership etc, see [modules/age.nix](modules/age.nix).