NixOS Secrets Management - Part 2/3

  Переглядів 1,252

EmergentMind

EmergentMind

День тому

Part 2 of 3 in my series on secrets management in NixOS using sops-nix as a part of a nix-config. The series covers information about sops, generating keys, storing secrets, programmatic access, and storing secrets in private repository separate from your main, nix-config repo.
OUTLINE
00:10 sops.nix
2:08 extracting msmtp credentials
3:11 extracting a user password
4:40 home-level ssh private key extraction
5:30 side note on managing public ssh keys in my nix-config
6:30 building the config
7:13 confirming secrets extraction
8:04 how to handle sops-nix.service failure during home-manager switch
8:55 managing access keys
OTHER VIDEOS IN THIS SERIES
Part 1: • NixOS Secrets Manageme...
Part 3: • NixOS Secrets Manageme...
ADDITIONAL MATERIAL
- My nix-config on GitHub: github.com/EmergentMind/nix-c...
- A related article on my website Unmoved Centre: unmovedcentre.com/technology/...
CONNECT
- Subscribe to this UKposts channel
- My website: www.unmovedcentre.com
- X / Twitter: / emergent_mind
- GitHub: github.com/EmergentMind
- GitLab: gitlab.com/emergentmind
EXTERNAL REFERENCES
- sops-nix: github.com/Mic92/sops-nix
- age file encryption: github.com/FiloSottile/age
Note: I discovered after recording audio that "age" in this case is the Italian word for needles is pronounced with a hard "g". translate.google.com/?sl=it&t...

КОМЕНТАРІ: 7
@akibahmed229
@akibahmed229 Місяць тому
Well explained
Місяць тому
I didn't know about that home-manager systemd failure tip at 8:22. I face this all the time.
@Emergent_Mind
@Emergent_Mind Місяць тому
I'm glad it was helpful for you. That failure tripped me up for quite a while when I first encountered it. Thanks for watching!
@akibahmed229
@akibahmed229 Місяць тому
Im using impermanence, facing some problem like /run/secret not showing after reboot, can u help!
@Emergent_Mind
@Emergent_Mind Місяць тому
I can try to help. I have yet to delve into impermanence much myself at this point so my knowledge is somewhat limited. The first thing I would check is that you have your age/access `keys.txt` files stored in directories that are set to persist. In the video and my nix-config repo, the hosts-level access key is stored at the default location '/var/lib/sops-nix/key.txt' and that path is declared in the `hosts/common/core/sops.nix` module. The home-level dev access key is stored at `/home//.config/sops/age/keys.txt` and the path for that is declared in the `home//common/optional/sops.nix` module. You could either persist those locations (assuming you used the same paths as I did) or move the keys and declared paths to a location that you prefer and that you are declaring as persistent. In the case of the host-level keys.txt path, since it is auto generated when required, you should be able to just change the declared path and it will generate the keys to that location based on the hosts ssh key. Considering the key is auto-generated that leads to the other potential issue. You may need to use the `neededForBoot` to ensure the related partitions are mounted early enough and also ensure that sops activation occurs after impermanence does its thing. There is an issue open issue on the sops-nix repo that goes into more detail on all of the above: github.com/Mic92/sops-nix/issues/149 The first several comments address the first bit and the `neededForBoot` and activation order are addressed in this comment: github.com/Mic92/sops-nix/issues/149#issuecomment-1596029524 I hope that points you in the right direction. Let me know how it goes and thanks for watching!
@akibahmed229
@akibahmed229 Місяць тому
​@@Emergent_Mind Thanks, ' fileSystems."/pathOf/sops-nix-key".neededForBoot = true; ' fixed the problem. really appriciate your help
@Emergent_Mind
@Emergent_Mind Місяць тому
Excellent, glad I could help.
NixOS Secrets Management - Part 3/3
6:10
EmergentMind
Переглядів 688
🐱Generate a New SSH Key and Add it to your GitHub
1:52
Geek Forever
Переглядів 147 тис.
LIVE - Парад Победы в Москве. 9 Мая 2024
2:27:56
AKIpress news
Переглядів 2,2 млн
ОДИН ДОМА #shorts
00:34
Паша Осадчий
Переглядів 5 млн
Manage Your NixOS Config with Git
44:25
LibrePhoenix
Переглядів 7 тис.
Writing your own NixOS modules for fun and (hopefully) profit
23:25
All Systems Go!
Переглядів 10 тис.
NixOS Secrets Management - Part 1/3
12:40
EmergentMind
Переглядів 3,1 тис.
SSH Keys
10:12
RobEdwards
Переглядів 95 тис.
NixOS: Everything Everywhere All At Once
15:10
No Boilerplate
Переглядів 241 тис.
Deflated · Made by shykids with Sora
3:39
OpenAI
Переглядів 33 тис.
Best OS for programming? Mac vs Windows vs Linux debate settled
8:41
HOW to REALLY learn NixOS
4:49
IogaMaster
Переглядів 31 тис.
Самый маленький Iphone в мире!📱(@ghoul.arena)
0:22
Взрывная История
Переглядів 210 тис.
Why spend $10.000 on a flashlight when these are $200🗿
0:12
NIGHTOPERATOR
Переглядів 17 млн
iPhone - телефон для нищебродов?!
0:53
ÉЖИ АКСЁНОВ
Переглядів 3,8 млн