Agenix - Revision history

Onny: Use agenix-cli package

2025-12-25T10:02:49Z

Use agenix-cli package

← Older revision		Revision as of 10:02, 25 December 2025
Line 43:		Line 43:
	</translate>		</translate>
	<syntaxhighlight lang="nix">		<syntaxhighlight lang="nix">
	~~{ config, pkgs, lib, inputs, ... }:{~~		environment.systemPackages = [ pkgs.agenix-cli ];
	environment.systemPackages = [
	~~inputs~~.agenix~~.packages."${system}".default~~
	];
	}
	</syntaxhighlight>		</syntaxhighlight>
	<translate>		<translate>

Layer-09: Translate tags

2025-10-18T05:26:11Z

Translate tags

Show changes

Layer-09: Adherence to the manual

2025-10-18T05:04:45Z

Adherence to the manual

Show changes

Dbrgn: Fix comment

2025-10-17T22:00:22Z

Fix comment

← Older revision		Revision as of 22:00, 17 October 2025
Line 161:		Line 161:
	imports = [ agenix.nixosModules.default ]; # import agenix-module into the nixos-container		imports = [ agenix.nixosModules.default ]; # import agenix-module into the nixos-container

	age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; # ~~isn't~~ set ~~automatically for some reason~~		age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; # needed when OpenSSH is not set up in container

	# import the secret		# import the secret

Pigs: /* Choose a Public/Private Key */ link to ssh pages

2025-05-15T17:14:14Z

Choose a Public/Private Key: link to ssh pages

← Older revision		Revision as of 17:14, 15 May 2025
Line 39:		Line 39:
	=== Choose a Public/Private Key ===		=== Choose a Public/Private Key ===

	First, we have to decide which SSH public key to use to encrypt the secrets. (The private key will be used to decrypt the secrets when loading the NixOS configuration.)		First, we have to decide which [[SSH public key authentication\|SSH public key]] to use to encrypt the secrets. (The private key will be used to decrypt the secrets when loading the NixOS configuration.)

	Assuming that you have SSH already installed on your NixOS server (with i.e. <code>services.openssh.enable = true;</code>), you will already have two different SSH keypairs that are intended to be used by the system itself, located at:		Assuming that you have [[SSH]] already installed on your NixOS server (with i.e. <code>services.openssh.enable = true;</code>), you will already have two different SSH keypairs that are intended to be used by the system itself, located at:

	* <code>/etc/ssh/ssh_host_rsa_key</code> / <code>/etc/ssh/ssh_host_rsa_key.pub</code>		* <code>/etc/ssh/ssh_host_rsa_key</code> / <code>/etc/ssh/ssh_host_rsa_key.pub</code>

Phanirithvij: imported from old wiki

2025-03-13T03:31:56Z

imported from old wiki

← Older revision		Revision as of 03:31, 13 March 2025
Line 37:		Line 37:
	== Configuration ==		== Configuration ==

	First create a directory where secrets are going to be stored. In this example we~~'re~~ creating the directory <code>secrets</code> inside the NixOS system configuration path <code>/etc/nixos</code>		=== Choose a Public/Private Key ===

			First, we have to decide which SSH public key to use to encrypt the secrets. (The private key will be used to decrypt the secrets when loading the NixOS configuration.)

			Assuming that you have SSH already installed on your NixOS server (with i.e. <code>services.openssh.enable = true;</code>), you will already have two different SSH keypairs that are intended to be used by the system itself, located at:

			* <code>/etc/ssh/ssh_host_rsa_key</code> / <code>/etc/ssh/ssh_host_rsa_key.pub</code>
			* <code>/etc/ssh/ssh_host_ed25519_key</code> / <code>/etc/ssh/ssh_host_ed25519_key.pub</code>

			If you load your NixOS config using the root user, then you can use these public keys to encrypt your secrets.

			However, if you load your NixOS config using some other user, then you will have to use <code>ssh-keygen</code> to generate a keypair for that user, which typically lives in:

			* <code>~/.ssh/id_rsa</code> / <code>~/.ssh/id_rsa.pub</code>
			* <code>~/.ssh/id_ed25519</code> / <code>~/.ssh/id_ed25519.pub</code>

			For more information, see [[SSH_public_key_authentication\|the SSH public key authentication page]].

			=== Create the Secrets ===

			Next, create a directory where secrets are going to be stored. In this example we are creating the directory <code>secrets</code> inside the NixOS system configuration path <code>/etc/nixos</code>

	<syntaxhighlight lang="bash">		<syntaxhighlight lang="bash">
Line 57:		Line 77:
	}		}
	</nowiki>}}		</nowiki>}}

	SSH public keys for a specific user or system can be generated with <code>ssh-keygen</code>, see [[SSH_public_key_authentication\|this page]] for more information. Usually the public key of your user can be found in <code>~/.ssh/id_rsa.pub</code> and the system one in <code>/etc/ssh/ssh_host_rsa_key.pub</code>.

	== Usage ==		== Usage ==
Line 89:		Line 107:
	</syntaxhighlight>		</syntaxhighlight>

	Here, the service [[Nextcloud]] requires a password for the administrator account. In this case, the password is stored in an age-encrypted file, so no plaintext passwords will be copied into your world-readable Nix-store. We configure <code>owner</code> and <code>group</code> names to <code>nextcloud</code> so that the webservice has the permissions to read the password ~~wile~~.		Here, the service [[Nextcloud]] requires a password for the administrator account. In this case, the password is stored in an age-encrypted file, so no plaintext passwords will be copied into your world-readable Nix-store. We configure <code>owner</code> and <code>group</code> names to <code>nextcloud</code> so that the webservice has the permissions to read the password file.

	Secrets can be also deployed as file with specific permissions to a target path. In this example the secret is sourced to <code>/home/myuser/.netrc</code> and permissions are set that only <code>myuser</code> is able to read and write the file		Secrets can be also deployed as file with specific permissions to a target path. In this example the secret is sourced to <code>/home/myuser/.netrc</code> and permissions are set that only <code>myuser</code> is able to read and write the file.

	<syntaxhighlight lang="nix">		<syntaxhighlight lang="nix">
Line 174:		Line 192:

	=== Agenix with Impermanence ===		=== Agenix with Impermanence ===


	If your system is configured to be [[Impermanence\|impermanent]], then it's possible the system's ssh keys won't yet be available during boot to decrypt secrets. The solution is to manually set <code>age.identityPaths</code> to the persistent paths of your keys.		If your system is configured to be [[Impermanence\|impermanent]], then it's possible the system's ssh keys won't yet be available during boot to decrypt secrets. The solution is to manually set <code>age.identityPaths</code> to the persistent paths of your keys.


			<syntaxhighlight lang="nix">

	~~<syntaxhighlight lang="nix">~~
	# Direct path to persistent location of system ssh keys		# Direct path to persistent location of system ssh keys

	age.identityPaths = [		age.identityPaths = [

	"/persist/etc/ssh/ssh_host_ed25519_key"		"/persist/etc/ssh/ssh_host_ed25519_key"

	"/persist/etc/ssh/ssh_host_rsa_key"		"/persist/etc/ssh/ssh_host_rsa_key"

	];		];

	</syntaxhighlight>		</syntaxhighlight>

Jasoncg: configuration to support agenix with impermanence

2025-01-15T22:31:34Z

configuration to support agenix with impermanence

← Older revision		Revision as of 22:31, 15 January 2025
Line 172:		Line 172:

	For this workaround you'll have to rebuild twice and reference the secret <code>/etc/initrd-hostkey</code> only after the file is created.		For this workaround you'll have to rebuild twice and reference the secret <code>/etc/initrd-hostkey</code> only after the file is created.

			=== Agenix with Impermanence ===

			If your system is configured to be [[Impermanence\|impermanent]], then it's possible the system's ssh keys won't yet be available during boot to decrypt secrets. The solution is to manually set <code>age.identityPaths</code> to the persistent paths of your keys.

			<syntaxhighlight lang="nix">
			# Direct path to persistent location of system ssh keys
			age.identityPaths = [
			"/persist/etc/ssh/ssh_host_ed25519_key"
			"/persist/etc/ssh/ssh_host_rsa_key"
			];
			</syntaxhighlight>

	== See also ==		== See also ==

imported>Dafitt: Alternate way to access secrets inside container

2024-02-15T10:45:10Z

Alternate way to access secrets inside container

@@ Line 127: / Line 127: @@
 <syntaxhighlight lang="nix">
 containers.mycontainer.bindMounts."${config.agenix.secrets.mysecret.path}".isReadOnly = true;
 </syntaxhighlight>

imported>Onny: Add note on using secrets in initrd

2024-01-13T12:21:35Z

Add note on using secrets in initrd

@@ Line 128: / Line 128: @@
 containers.mycontainer.bindMounts."${config.agenix.secrets.mysecret.path}".isReadOnly = true;
 </syntaxhighlight>
 == See also ==

imported>Onny: Note on how to access secrets inside container

2024-01-12T14:53:09Z

Note on how to access secrets inside container

← Older revision		Revision as of 14:53, 12 January 2024
Line 121:		Line 121:
	</syntaxhighlight>		</syntaxhighlight>

			=== Access secrets inside container ===

			Using the option <code>bindMounts</code> for an example container named <code>mycontainer</code> will provide the secret file inside the container as <code>/run/agenix/mysecret</code>:

			<syntaxhighlight lang="nix">
			containers.mycontainer.bindMounts."${config.agenix.secrets.mysecret.path}".isReadOnly = true;
			</syntaxhighlight>

	== See also ==		== See also ==