mirror of
https://github.com/Mic92/sops-nix.git
synced 2024-12-14 11:57:52 +00:00
readme: improve
This commit is contained in:
parent
716ccf8147
commit
a45636d7a5
1 changed files with 8 additions and 4 deletions
12
README.md
12
README.md
|
@ -50,7 +50,7 @@ format to `age` keys.
|
|||
<details>
|
||||
<summary><b>1. Install sops-nix</b></summary>
|
||||
|
||||
Choose one of the following methods:
|
||||
Choose one of the following methods. When using it non-globally with home-manager, refer to [Use with home-manager](#use-with-home-manager).
|
||||
|
||||
#### Flakes (current recommendation)
|
||||
|
||||
|
@ -744,7 +744,7 @@ And instead of decrypting to `/run/secrets`, the secrets are decrypted to `$XDG_
|
|||
**Since the secrets are decrypted there, it's highly recommended to use a tmpfs for `$XDG_RUNTIME_DIR` to avoid storing secrets in plain text on persistent storage. Linux distributions using systemd-logind do that out-of-the-box.**
|
||||
|
||||
Depending on whether you use home-manager system-wide or using a home.nix, you have to import it in a different way.
|
||||
This example show the `channel` approach from the usage example above for simplicity, but all other methods work as well.
|
||||
This example show the `channel` approach from the example [Install: nix-channel](#nix-channel) for simplicity, but all other methods work as well.
|
||||
|
||||
```nix
|
||||
{
|
||||
|
@ -772,9 +772,13 @@ The actual sops configuration is in the `sops` namespace in your home.nix (or in
|
|||
# It's alos possible to use a ssh key, but only when it has no password:
|
||||
#age.sshKeyPaths = [ "/home/user/path-to-ssh-key" ];
|
||||
defaultSopsFile = ./secrets.yaml;
|
||||
sops.secrets.test = {
|
||||
secrets.test = {
|
||||
# sopsFile = ./secrets.yml.enc; # optionally define per-secret files
|
||||
path = "%r/test.txt"; # %r gets replaced with your $XDG_RUNTIME_DIR, use %% to specify a '%' sign
|
||||
|
||||
# %r gets replaced with a runtime directory, use %% to specify a '%'
|
||||
# sign. Runtime dir is $XDG_RUNTIME_DIR on linux and $(getconf
|
||||
# DARWIN_USER_TEMP_DIR) on darwin.
|
||||
path = "%r/test.txt";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue