Secrets from sops-nix should be per user instead of owned by root, I think #1
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
I dislike having to manage configuration for services specifically in two separate places (services user and the host config) and the only reason I do is because of the secrets.
The only thing stopping me having the secrets managed through the sops-nix hm module is the initial private key generation step for first deployment. The user needs a generated private SSH key to generate an age key (ssh-to-age), which i then add as a recipient to any relevant secrets files, then that user can decrypt them and we're off to the races.
But that is a pain, how do I deploy my configuration to create the user, which will also try to decrypt the secrets and fail? More to work out here, maybe I'm just tired.