mirrors/sops-nix
1
0
Fork 0
mirror of https://github.com/Mic92/sops-nix.git synced 2024-12-14 11:57:52 +00:00
Code Activity

Merge pull request #138 from Mic92/fix/user-secrets

Browse source 
Fix user passwords disappearing
This commit is contained in:
Jörg Thalheim 2021-11-13 22:27:26 +00:00 committed by GitHub
commit 9a961ab91c
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 9 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
modules/sops/default.nix
View file

@ -127,7 +127,7 @@ let
manifest = manifestFor "" regularSecrets {}; manifest = manifestFor "" regularSecrets {};
manifestForUsers = manifestFor "-for-users" secretsForUsers { manifestForUsers = manifestFor "-for-users" secretsForUsers {
secretsMountPoint = "/run/secrets.d/users"; secretsMountPoint = "/run/secrets-for-users.d";
symlinkPath = "/run/secrets-for-users"; symlinkPath = "/run/secrets-for-users";
}; };

11
pkgs/sops-install-secrets/nixos-test.nix
View file

@ -25,7 +25,7 @@
user-passwords = makeTest { user-passwords = makeTest {
name = "sops-user-passwords"; name = "sops-user-passwords";
machine = { machine = { config, ... }: {
imports = [ ../../modules/sops ]; imports = [ ../../modules/sops ];
sops = { sops = {
age.keyFile = ./test-assets/age-keys.txt; age.keyFile = ./test-assets/age-keys.txt;
@ -36,7 +36,7 @@
users.users.example-user = { users.users.example-user = {
isNormalUser = true; isNormalUser = true;
passwordFile = "/run/secrets-for-users/test_key"; passwordFile = config.sops.secrets.test_key.path;
}; };
}; };
@ -44,7 +44,12 @@
start_all() start_all()
machine.succeed("getent shadow example-user | grep -q :test_value:") # password was set machine.succeed("getent shadow example-user | grep -q :test_value:") # password was set
machine.succeed("cat /run/secrets/nested/test/file | grep -q 'another value'") # regular secrets work... machine.succeed("cat /run/secrets/nested/test/file | grep -q 'another value'") # regular secrets work...
machine.succeed("[ $(stat -c%U /run/secrets/nested/test/file) = example-user ]") # ...and are owned machine.succeed("[ $(stat -c%U /run/secrets/nested/test/file) = example-user ]") # ...and are owned...
machine.succeed("cat /run/secrets-for-users/test_key | grep -q 'test_value'") # the user password still exists
machine.succeed("/run/current-system/bin/switch-to-configuration test")
machine.succeed("cat /run/secrets/nested/test/file | grep -q 'another value'") # the regular secrets still work after a switch
machine.succeed("cat /run/secrets-for-users/test_key | grep -q 'test_value'") # the user password is still present after a switch
''; '';
} { } {
inherit pkgs; inherit pkgs;