1
0
Fork 0
mirror of https://github.com/Mic92/sops-nix.git synced 2024-12-14 11:57:52 +00:00

readme: improve

This commit is contained in:
Pogobanane 2023-02-01 21:19:37 +01:00
parent 716ccf8147
commit a45636d7a5

View file

@ -50,7 +50,7 @@ format to `age` keys.
<details>
<summary><b>1. Install sops-nix</b></summary>
Choose one of the following methods:
Choose one of the following methods. When using it non-globally with home-manager, refer to [Use with home-manager](#use-with-home-manager).
#### Flakes (current recommendation)
@ -744,7 +744,7 @@ And instead of decrypting to `/run/secrets`, the secrets are decrypted to `$XDG_
**Since the secrets are decrypted there, it's highly recommended to use a tmpfs for `$XDG_RUNTIME_DIR` to avoid storing secrets in plain text on persistent storage. Linux distributions using systemd-logind do that out-of-the-box.**
Depending on whether you use home-manager system-wide or using a home.nix, you have to import it in a different way.
This example show the `channel` approach from the usage example above for simplicity, but all other methods work as well.
This example show the `channel` approach from the example [Install: nix-channel](#nix-channel) for simplicity, but all other methods work as well.
```nix
{
@ -772,9 +772,13 @@ The actual sops configuration is in the `sops` namespace in your home.nix (or in
# It's alos possible to use a ssh key, but only when it has no password:
#age.sshKeyPaths = [ "/home/user/path-to-ssh-key" ];
defaultSopsFile = ./secrets.yaml;
sops.secrets.test = {
secrets.test = {
# sopsFile = ./secrets.yml.enc; # optionally define per-secret files
path = "%r/test.txt"; # %r gets replaced with your $XDG_RUNTIME_DIR, use %% to specify a '%' sign
# %r gets replaced with a runtime directory, use %% to specify a '%'
# sign. Runtime dir is $XDG_RUNTIME_DIR on linux and $(getconf
# DARWIN_USER_TEMP_DIR) on darwin.
path = "%r/test.txt";
};
};
}