48 commits

Author	SHA1	Message	Date
Jörg Thalheim	c5e0f55d8d	nixos-tests: fix identations	2021-09-30 21:09:26 +02:00
Janne Heß	4cebc08062	Fix age key generation and test it	2021-09-30 15:28:39 +02:00
Janne Heß	5db02f2939	Import age keyfile and ssh keys at the same time	2021-09-30 15:07:30 +02:00
Janne Heß	9083e64fb9	Swap order of age ssh keys and the key file ... It makes more sense to import the key when we have one and ignore the SSH keys instead of only importing the key when we have no SSH keys. This is because we import all SSH keys by default in the module and using a key file means the use has to explicitly unset the SSH keys.	2021-09-30 14:05:38 +02:00
Jörg Thalheim	a38ba56ca2	import ssh keys both for gpg and age	2021-09-28 14:07:26 +02:00
Janne Heß	77d0fa5920	Simplify age logic in sops-install-secrets	2021-09-24 12:09:54 +02:00
Janne Heß	f636296aff	Switch the libs to now external ones	2021-09-24 12:09:53 +02:00
Janne Heß	4568162629	Import age ssh keys by default	2021-09-24 12:09:53 +02:00
Janne Heß	db8fcb50a3	Add support for ssh-generated age keys	2021-09-24 12:09:52 +02:00
Janne Heß	b21c0ce3a8	Group gnupg and age in the module	2021-09-24 12:09:52 +02:00
Janne Heß	f5a2ba217b	Add age support	2021-09-24 12:09:52 +02:00
Janne Heß	ebfa120b52	Fix pipeline on unstable	2021-09-17 21:08:34 +02:00
Jörg Thalheim	3e2aefbc61	switch to maintained openpgp library	2021-08-29 15:24:07 +02:00
Jörg Thalheim	34a650555e	fix nixos-test ... We no longer require membership in keys group.	2021-07-03 08:20:27 +02:00
Jörg Thalheim	351c716739	allow non-key group users to access /run/secrets ... This does not significantly decrease security while making it a lot more convinient. There are also services, where it is not possible to set the keys group i.e. if a daemon unsets all groups. Processes still won't be able to list other secrets if they are not in the secret group. fixes #86	2021-06-05 17:59:22 +02:00
Jörg Thalheim	f540b74ced	remove ssh-to-pgp from sops-nix	2021-02-22 06:49:46 +01:00
Jörg Thalheim	d665aecd88	fix 32-bit build	2021-02-01 13:50:17 +01:00
Bernardo Meurer	dd7dfdcb6a	pkgs: don't reference deprecated stdenv.lib ... `stdenv.lib` has been deprecated in favor of using `lib` directly.	2021-01-31 18:02:23 -08:00
Jörg Thalheim	4de7358a2b	only mount ramfs once	2021-01-28 22:36:12 +01:00
Jörg Thalheim	47a99b6957	Merge branch 'master' into lists	2021-01-27 06:23:50 +00:00
Jörg Thalheim	80ad73c347	fix sops files that contains lists ... fixes #68	2021-01-27 07:22:56 +01:00
Eduard Bopp	0be44e088b	Fix impurity in test invocation ... The system must be specified, as its default is `builtins.currentSystem`, which is disallowed as an impure function during flake evaluation.	2021-01-26 15:48:56 +01:00
Jörg Thalheim	378fe484f9	fix sops-install-secrets with nixpkgs unstable	2020-11-18 16:08:59 +01:00
Jörg Thalheim	c7826f534e	parallelize CI	2020-11-13 12:54:33 +01:00
Cole Mickens	24fd158fe6	sops-install-secrets: symlinkSecret: set uid/gid (with Fchownat) (#32) ... Co-authored-by: Jörg Thalheim <Mic92@users.noreply.github.com>	2020-08-24 09:24:43 +01:00
Jörg Thalheim	7d2b22a18d	sops-install-secrets: disable tests	2020-08-10 18:22:59 +01:00
Jörg Thalheim	01e4038c9a	don't print full executable path logging key import	2020-07-30 16:19:51 +01:00
Jörg Thalheim	9cd8bb080f	sops-install-secrets: use %w for fmt.Errorf calls	2020-07-30 16:19:14 +01:00
Jörg Thalheim	b8d91d61ac	restrict sops-install-secrets to linux ... ramfs is not available elswhere.	2020-07-22 23:46:05 +01:00
Jörg Thalheim	4a41039ab3	mark sops-install-secrets as Linux only	2020-07-22 23:12:13 +01:00
Jörg Thalheim	bffb0afb48	fix replace existing files	2020-07-19 23:23:38 +01:00
Jörg Thalheim	59803f7530	fix user manifest validation in sandbox ... we should not lookup users there	2020-07-19 21:04:58 +01:00
Jörg Thalheim	30c6879b42	add validation mode	2020-07-19 17:09:27 +01:00
Jörg Thalheim	4224ec9ede	add validate flag	2020-07-19 11:32:59 +01:00
Jörg Thalheim	b1131e035d	sops-install-secrets: improve error message	2020-07-14 13:49:54 +01:00
Jörg Thalheim	6508df75b6	sops-install-secrets: include newline in log	2020-07-14 13:48:30 +01:00
Jörg Thalheim	cf34042dc2	sops-install-secrets: log gpg fingerprint	2020-07-14 13:42:32 +01:00
Jörg Thalheim	8cdca9dd6d	secring: open with more secure umask	2020-07-14 13:41:03 +01:00
Jörg Thalheim	4eda6711ba	fix /etc/secrets.d permissions	2020-07-14 13:21:07 +01:00
Jörg Thalheim	7bd84011ef	fix sops nixos module	2020-07-12 17:52:03 +01:00
Jörg Thalheim	1745bb9f95	build nixos tests on CI.	2020-07-12 17:45:31 +01:00
Jörg Thalheim	5ee7f3d73e	add ci	2020-07-12 17:36:14 +01:00
Jörg Thalheim	81f9f69b84	add ssh-to-pgp package	2020-07-12 17:18:12 +01:00
Jörg Thalheim	cbf6c6b93a	add project-wide shell.nix	2020-07-12 17:06:59 +01:00
Jörg Thalheim	38e71e351c	reference nixos tests in sops-install-secrets	2020-07-12 16:59:20 +01:00
Jörg Thalheim	b75e51c423	add tests + ssh key support	2020-07-12 13:50:55 +01:00
Jörg Thalheim	bb21643ce1	sops-install-secrets: get rid of delve import	2020-07-06 09:36:56 +01:00
Jörg Thalheim	8ccd9ba269	first commit	2020-07-06 07:31:57 +01:00