mirrors/sops-nix
1
0
Fork 0
mirror of https://github.com/Mic92/sops-nix.git synced 2024-12-14 11:57:52 +00:00
Code Activity

home-manager: Change defaultSymlinkPath to "<xdg-config-home>/sops-nix/secrets"

Browse source
This commit is contained in:
Sebastian Sellmeier 2024-04-16 17:09:00 +02:00 committed by mergify[bot]
parent 74f03c1a51
commit a9795d1959
2 changed files with 4 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
README.md
View file

@ -734,7 +734,9 @@ sops-nix also provides a home-manager module.
This module provides a subset of features provided by the system-wide sops-nix since features like the creation of the ramfs and changing the owner of the secrets are not available for non-root users. This module provides a subset of features provided by the system-wide sops-nix since features like the creation of the ramfs and changing the owner of the secrets are not available for non-root users.
Instead of running as an activation script, sops-nix runs as a systemd user service called `sops-nix.service`. Instead of running as an activation script, sops-nix runs as a systemd user service called `sops-nix.service`.
And instead of decrypting to `/run/secrets`, the secrets are decrypted to `$XDG_RUNTIME_DIR/secrets` that is located on a tmpfs or similar non-persistent filesystem. And instead of decrypting to `/run/secrets`, the secrets are stored decrypted to `$XDG_RUNTIME_DIR/secrets` that is located on a tmpfs or similar non-persistent filesystem. Additionally secrets are symlinked to the user home-directory in the `.secrets`-directory which is used as reference
for the `.path` value in nix. Because of that, the home-manager option `home.homeDirectory` is used to determinate the home-directory on evaluation,
this has to be set manually if home-manager is used standalone or on non NixOS systems.
Depending on whether you use home-manager system-wide or using a home.nix, you have to import it in a different way. Depending on whether you use home-manager system-wide or using a home.nix, you have to import it in a different way.
This example shows the `flake` approach from the recommended example [Install: Flakes (current recommendation)](#Flakes (current recommendation)) This example shows the `flake` approach from the recommended example [Install: Flakes (current recommendation)](#Flakes (current recommendation))

2
modules/home-manager/sops.nix
View file

@ -143,7 +143,7 @@ in {
defaultSymlinkPath = lib.mkOption { defaultSymlinkPath = lib.mkOption {
type = lib.types.str; type = lib.types.str;
default = "%r/secrets"; default = "${config.xdg.configHome}/sops-nix/secrets";
description = '' description = ''
Default place where the latest generation of decrypt secrets Default place where the latest generation of decrypt secrets
can be found. can be found.