mynix/agenix
1
0
Fork 0
mirror of https://github.com/ryantm/agenix.git synced 2024-11-22 17:50:48 +03:00
Code Issues Projects Releases Packages Wiki Activity

Rules now read from AGENIX_RULES/agenix-rules.nix

Browse source
This commit is contained in:
Giorgio Gallo 2023-10-14 11:52:45 +02:00
parent daf42cb35b
commit f5f56c0246
No known key found for this signature in database
5 changed files with 55 additions and 17 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
README.md
View file

@ -244,15 +244,15 @@ e.g. inside your `flake.nix` file:
have `sshd` running on it so that it has generated SSH host keys in have `sshd` running on it so that it has generated SSH host keys in
`/etc/ssh/`. `/etc/ssh/`.
2. Make a directory to store secrets and `secrets.nix` file for listing secrets and their public keys: 2. Make a directory to store secrets and `agenix-rules.nix` file for listing secrets and their public keys:
```ShellSession ```ShellSession
$ mkdir secrets $ mkdir secrets
$ cd secrets $ cd secrets
$ touch secrets.nix $ touch agenix-rules.nix
``` ```
This `secrets.nix` file is **not** imported into your NixOS configuration. This `agenix-rules.nix` file is **not** imported into your NixOS configuration.
It's only used for the `agenix` CLI tool (example below) to know which public keys to use for encryption. It's only used for the `agenix` CLI tool (example below) to know which public keys to use for encryption.
3. Add public keys to your `secrets.nix` file: 3. Add public keys to your `agenix-rules.nix` file:
```nix ```nix
let let
user1 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL0idNvgGiucWgup/mP78zyC23uFjYq0evcWdjGQUaBH"; user1 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL0idNvgGiucWgup/mP78zyC23uFjYq0evcWdjGQUaBH";
@ -283,7 +283,7 @@ e.g. inside your `flake.nix` file:
$ agenix -e secret1.age $ agenix -e secret1.age
``` ```
It will open a temporary file in the app configured in your $EDITOR environment variable. It will open a temporary file in the app configured in your $EDITOR environment variable.
When you save that file its content will be encrypted with all the public keys mentioned in the `secrets.nix` file. When you save that file its content will be encrypted with all the public keys mentioned in the `agenix-rules.nix` file.
5. Add secret to a NixOS module config: 5. Add secret to a NixOS module config:
```nix ```nix
{ {
@ -567,13 +567,18 @@ EDITOR environment variable of editor to use when editing FILE
If STDIN is not interactive, EDITOR will be set to "cp /dev/stdin" If STDIN is not interactive, EDITOR will be set to "cp /dev/stdin"
RULES environment variable with path to Nix file specifying recipient public keys. AGENIX_RULES environment variable with path to Nix file specifying recipient public keys.
Defaults to './secrets.nix' Defaults to './agenix-rules.nix'
``` ```
Up to version 0.14.0, agenix used the variable `RULES` (instead of
`AGENIX_RULES`) and the default rules file `secrets.nix` (instead of
`agenix-rules.nix`). Currently agenix still honours those, but they will be
deprecated in the future.
#### Rekeying #### Rekeying
If you change the public keys in `secrets.nix`, you should rekey your If you change the public keys in `agenix-rules.nix`, you should rekey your
secrets: secrets:
```ShellSession ```ShellSession

4
doc/reference.md
View file

@ -246,5 +246,5 @@ EDITOR environment variable of editor to use when editing FILE
If STDIN is not interactive, EDITOR will be set to "cp /dev/stdin" If STDIN is not interactive, EDITOR will be set to "cp /dev/stdin"
RULES environment variable with path to Nix file specifying recipient public keys. AGENIX_RULES environment variable with path to Nix file specifying recipient public keys.
Defaults to './secrets.nix' Defaults to './agenix-rules.nix'

2
doc/rekeying.md
View file

@ -1,6 +1,6 @@
# Rekeying {#rekeying} # Rekeying {#rekeying}
If you change the public keys in `secrets.nix`, you should rekey your If you change the public keys in `agenix-rules.nix`, you should rekey your
secrets: secrets:
```ShellSession ```ShellSession

6
doc/tutorial.md
View file

@ -4,14 +4,14 @@
have `sshd` running on it so that it has generated SSH host keys in have `sshd` running on it so that it has generated SSH host keys in
`/etc/ssh/`. `/etc/ssh/`.
2. Make a directory to store secrets and `secrets.nix` file for listing secrets and their public keys (This file is **not** imported into your NixOS configuration. It is only used for the `agenix` CLI.): 2. Make a directory to store secrets and `agenix-rules.nix` file for listing secrets and their public keys (This file is **not** imported into your NixOS configuration. It is only used for the `agenix` CLI.):
```ShellSession ```ShellSession
$ mkdir secrets $ mkdir secrets
$ cd secrets $ cd secrets
$ touch secrets.nix $ touch agenix-rules.nix
``` ```
3. Add public keys to `secrets.nix` file (hint: use `ssh-keyscan` or GitHub (for example, https://github.com/ryantm.keys)): 3. Add public keys to `agenix-rules.nix` file (hint: use `ssh-keyscan` or GitHub (for example, https://github.com/ryantm.keys)):
```nix ```nix
let let
user1 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL0idNvgGiucWgup/mP78zyC23uFjYq0evcWdjGQUaBH"; user1 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL0idNvgGiucWgup/mP78zyC23uFjYq0evcWdjGQUaBH";

39
pkgs/agenix.sh
View file

@ -26,8 +26,8 @@ function show_help () {
echo ' ' echo ' '
echo 'If STDIN is not interactive, EDITOR will be set to "cp /dev/stdin"' echo 'If STDIN is not interactive, EDITOR will be set to "cp /dev/stdin"'
echo ' ' echo ' '
echo 'RULES environment variable with path to Nix file specifying recipient public keys.' echo 'AGENIX_RULES environment variable with path to Nix file specifying recipient public keys.'
echo "Defaults to './secrets.nix'" echo "Defaults to './agenix-rules.nix'"
echo ' ' echo ' '
echo "agenix version: @version@" echo "agenix version: @version@"
echo "age binary path: @ageBin@" echo "age binary path: @ageBin@"
@ -101,7 +101,40 @@ while test $# -gt 0; do
esac esac
done done
RULES=${RULES:-./secrets.nix} function get_configured_rules {
# prints the first among $AGENIX_RULES, $RULES, erroring out if it points to a
# non-existing file
! [ -v AGENIX_RULES ] && ! [ -v RULES ] && return 1
local rulesfile="${AGENIX_RULES:-$RULES}"
[ -f "$rulesfile" ] || {
[ -v AGENIX_RULES ] && variable='AGENIX_RULES' || variable='RULES'
err "Rules file '$rulesfile' specified via the variable $variable not found."
}
echo "$rulesfile"
}
function find_rules {
# walks up the directory tree, printing the first file named agenix-rules.nix
# or ./secrets.nix it finds and erroring out otherwise
local cwd="$PWD"
local rulesfile=''
while [ -z "$rulesfile" ]
do
for f in "$cwd/agenix-rules.nix" "$cwd/secrets.nix"
do
[ -f "$f" ] && rulesfile="$f"
done
[ "$cwd" != '/' ] || break
cwd=$(dirname "$cwd")
done
[ -n "$rulesfile" ] || err "$PACKAGE needs a rules file. You can specify one by setting the AGENIX_RULES variable or you can create a file named 'agenix-rules.nix' in the current directory or one of its parents."
echo "$rulesfile"
unset cwd rulesfile
}
RULES=$(get_configured_rules || find_rules)
[ -r "$RULES" ] || err "Cannot read rules file '$RULES'."
function cleanup { function cleanup {
if [ -n "${CLEARTEXT_DIR+x}" ] if [ -n "${CLEARTEXT_DIR+x}" ]
then then