mirrors/sops-nix
mirrors/sops-nix
1
0
Fork 0
mirror of https://github.com/Mic92/sops-nix.git synced 2025-03-16 21:48:15 +00:00
Code Activity

Add review suggestions

Browse source
This commit is contained in:
Janne Heß 2021-08-28 11:44:38 +02:00
parent 19089e588f
commit 44d91e885e
No known key found for this signature in database
GPG key ID: 69165158F05265DF
2 changed files with 10 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
README.md
View file

@ -39,7 +39,8 @@ be used to decrypt the secrets on the target machine. The tool `ssh-to-pgp` can
be used to derive a gnupg key from a ssh (host) key in RSA format. be used to derive a gnupg key from a ssh (host) key in RSA format.
The other method is age which is based on [age](https://github.com/FiloSottile/age). The other method is age which is based on [age](https://github.com/FiloSottile/age).
A tool is provided with sops-nix that can convert ssh host or user keys to age keys. A tool is provided with sops-nix that can convert ssh host or user keys in ed25519
format to age keys.
## Usage example ## Usage example
@ -201,11 +202,13 @@ have one, you can generate one using
$ ssh-keygen -t ed25519 $ ssh-keygen -t ed25519
``` ```
Converting it to the age format works like this: Converting the public key to the age format works like this:
```console ```console
$ nix run -f default.nix sops-ssh-to-age -c sh -c 'ssh-add -L | sops-ssh-to-age' $ nix run -f default.nix sops-ssh-to-age -c sh -c 'ssh-add -L | sops-ssh-to-age'
``` ```
Ssh public key files may also be piped into the `sops-ssh-to-age` tool.
### 3a. Get a PGP Public key for your machine ### 3a. Get a PGP Public key for your machine
The easiest way to add new hosts is using ssh host keys (requires openssh to be enabled). The easiest way to add new hosts is using ssh host keys (requires openssh to be enabled).
@ -408,6 +411,10 @@ If you derived your server public key from ssh, all you need in your configurati
sops.secrets.example-key = {}; sops.secrets.example-key = {};
# This is using ssh keys in the age format: # This is using ssh keys in the age format:
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
# This is using an age key that is expected to already be in the filesystem
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
# This will generate a new key if the key specified above does not exist
sops.age.generateKey = true;
} }
``` ```

2
modules/sops/default.nix
View file

@ -156,7 +156,7 @@ in {
sshKeyPaths = mkOption { sshKeyPaths = mkOption {
type = types.listOf types.path; type = types.listOf types.path;
default = []; # If we set this like the gnupg option, we would use age by default default = []; # If we set this like the gnupg option, we would use ed25519 by default
description = '' description = ''
Path to ssh keys added as age keys during sops description. Path to ssh keys added as age keys during sops description.
This option must be explicitly unset if <literal>config.sops.age.keyFile</literal> is set. This option must be explicitly unset if <literal>config.sops.age.keyFile</literal> is set.