mynix/agenix
1
0
Fork 0
mirror of https://github.com/ryantm/agenix.git synced 2024-11-22 17:50:48 +03:00
Code Issues Projects Releases Packages Wiki Activity
166 commits 4 branches 12 tags 604 KiB
Commit graph

38 commits

Author SHA1 Message Date
Ryan Mulligan
16bef569f4 contrib: format Nix code with Alejandra 2023-01-29 10:57:51 -08:00
Ryan Mulligan
f86b56229b feature: combine root and nonroot secret install; delay chowning 2022-07-10 11:47:58 -07:00
Jeroen Simonetti
fe206b4306
[module] change operation order 
Change the order of operations to:

1. create new generation
2. decrypt secrets into new generation
3. symlink and remove old generation/secrets

Signed-off-by: Jeroen Simonetti <jeroen@simonetti.nl>
 2022-07-10 19:12:55 +02:00
Ryan Mulligan
1a4643b779 feature: warn about missing files 
rage itself does not have good error messages when files are missing,
so add some of our own checks and warnings.
 2022-03-08 08:00:43 -08:00
Parthiv Seetharaman
85bd9d01ad modules/age: add option for secrets directory 2022-02-21 15:20:05 -08:00
Jan Tojnar
35ecba5704 Do not try to create /run/agenix in when installing secrets 
That is a job for agenixMountSecrets, which should have already
created a symlink there so the directory creation attempt would
fail anyway.
 2022-01-06 22:55:10 +01:00
Jan Tojnar
26edd03a5a Ensure /run is created before mounting secrets 
Otherwise /run/agenix might disappear if specialfs is toposorted
between agenixMountSecrets and agenixRoot.

Fixes: https://github.com/ryantm/agenix/issues/92
 2022-01-06 22:50:56 +01:00
Ryan Mulligan
dfb2e7e591 feature: rename age.sshKeyPaths to age.identityPaths 
implements #66
 2021-12-05 16:05:06 -08:00
Chuang Zhu
c2f6bd077c
allow customizing ageBin 2021-12-06 07:08:18 +08:00
sohalt
ed0d9ef01a update option descriptions 2021-11-24 18:00:28 +01:00
Ryan Mulligan
5ff75b48b4 fix: make non-root secrets accessible again 
fixes #69
 2021-11-20 12:19:52 -08:00
Cole Helbling
7bb0b5d7f1 modules/age: add option to disable symlinking 
There are some cases where it may be better or even required to have the
secret be a file that is not a symlink. Setting

    age.secrets.some-secret.symlink = false;

will disable the default functionality of symlinking secrets and instead
just forcibly move them to their `path`.
 2021-11-15 21:39:32 -08:00
Cole Helbling
e538664435 modules/age: /run/secrets -> /run/agenix 2021-11-15 21:39:32 -08:00
Cole Helbling
111754b894 modules/age: remove old secrets generations 2021-11-15 21:39:32 -08:00
Cole Helbling
f816a0d5df modules/age: symlink files into place 
This follows sops-nix's implementation, where it creates a
`/run/secrets.d` ramfs mountpoint and a "generation" each time
the activation script runs, and then symlinks `/run/secrets` to
`/run/secrets.d/[generation]`.
 2021-11-15 21:39:32 -08:00
Ryan Mulligan
6d9fdcbd70 fix: remove workaround for #54 
https://github.com/NixOS/nixpkgs/pull/137508 should remove the need
for this.
 2021-09-16 15:39:38 -07:00
Ryan Mulligan
375a33cd97 fix: workaround for #54 2021-09-10 16:30:05 -07:00
Kazutoshi Noguchi
8bad14fe08 run activation scripts after /run mount 2021-07-01 14:13:44 +09:00
Ryan Mulligan
b69fd62fbb fix: umask 
fixes #38
 2021-05-12 20:11:17 -07:00
Ryan Mulligan
6aec6889ba feature: use uid 0 and gid 0 as default owner and group (consider them root) 
This assumes that the root user is always uid 0 and gid 0, which I
believe is a safe assumption. The reason to add this is because when a
declarative VM (for example, a NixOS test) or image boots the first
time, the installRootOwnedSecrets activation script runs BEFORE the
"users" and "groups" activation scripts, so the user and group for
root is not created. Using uid 0 and gid 0 gets around the root user
not being set up yet.
 2021-05-09 14:18:20 -07:00
Ryan Mulligan
ecee2c76b9 fix: allow deps of installRootOwnedSecrets activation script to be overridden 2021-05-09 14:17:48 -07:00
Felix Scheinost
3f07139990 Fix relative path 2021-03-16 18:31:27 +01:00
Cole Helbling
ef7ec993e8
modules/age: build local rage if pkgs.rage is older than 0.5.0 2021-03-01 13:11:02 -08:00
Cole Helbling
9b8f6c01fe
modules/age: nixpkgs-fmt 2021-03-01 13:10:52 -08:00
Cole Helbling
7ba959742e
modules/age: set LANG 
rage has a localization crate as a dependency that whines when LANG
is unset.
 2021-02-25 15:16:28 -08:00
Aluísio Augusto Silva Gonçalves
b0a48f587e
correctly list non-root secrets 
Secrets that are only partly owned by root (i.e. either user or group
are not 'root') are now accounted for during activation.
 2020-12-22 01:34:35 -03:00
Ryan Mulligan
baf623214b Merge branch 'master' of github.com:ryantm/age-nix into master 2020-11-20 17:55:23 -08:00
Ryan Mulligan
fd34de02a2 more messages while activationscript run & make sure directory exists before decrypting 2020-11-20 16:28:37 -08:00
Ryan Mulligan
07ce686870 use unstable verison of rage in place of age 
* age limits the number of recipients to 20
* the latest release of rage (0.4.0) doesn't work with ssh-rsa keys
 2020-09-18 12:42:20 -07:00
Ryan Mulligan
aecba55db6 install root owned secrets sooner 2020-09-09 20:44:45 -07:00
Ryan Mulligan
91ff516ef6 fix description of secretType.path 
It talked about symlinks which isn't a feature of this yet.
 2020-09-03 13:41:45 -07:00
Ryan Mulligan
79244b4fc3 add flake and default .nix files; add agenix command 2020-09-03 11:24:33 -07:00
Ryan Mulligan
4c2fd23693 add flake 2020-09-02 20:49:24 -07:00
Ryan Mulligan
c77d82e784 move identities definition to top too 2020-09-01 14:29:37 -07:00
Ryan Mulligan
4b6b3bba3d move installation instructions to top 
they are the most important part for someone to review
 2020-09-01 14:27:54 -07:00
Ryan Mulligan
568dede67c don't expose decrypted secret during installation 2020-08-31 22:21:50 -07:00
Ryan Mulligan
9388c9bbad remove trace 2020-08-31 22:18:40 -07:00
Ryan Mulligan
202ea075cf initial prototype 2020-08-31 21:37:26 -07:00