Comparison of secret managing schemes - Revision history

Woile: keep consistency, remove code blocks for projects

2026-05-20T08:57:07Z

keep consistency, remove code blocks for projects

← Older revision		Revision as of 08:57, 20 May 2026
Line 67:		Line 67:
	\|		\|
	\|-		\|-
	\| ~~<code>~~[https://github.com/oddlama/agenix-rekey agenix-rekey]~~</code>~~		\| [https://github.com/oddlama/agenix-rekey agenix-rekey]
	\| Extended <code>agenix</code>.		\| Extended <code>agenix</code>.
	\| N/A		\| N/A
Line 153:		Line 153:
	\|		\|
	\|-		\|-
	\| [https://elvishjerricco.github.io/2018/06/24/secure-declarative-key-management.html Blog Entry]: wrapper around <code>pass</code> based on ~~<code>~~[https://github.com/shlevy/nix-plugins nix-plugins]~~</code>~~.		\| [https://elvishjerricco.github.io/2018/06/24/secure-declarative-key-management.html Blog Entry]: wrapper around <code>pass</code> based on [https://github.com/shlevy/nix-plugins nix-plugins].
	\| Stored in [https://www.passwordstore.org/ the password store].		\| Stored in [https://www.passwordstore.org/ the password store].
	\| Data is retrieved/decrypted with <code>pass</code> during evaluation time.		\| Data is retrieved/decrypted with <code>pass</code> during evaluation time.

MrVanDalo at 07:42, 10 May 2026

2026-05-10T07:42:38Z

@@ Line 175: / Line 175: @@
 | The referenced NixOS Discourse discussion is about a signing key that is only needed during build time and should not be stored in the nix store at all.
 |-
 ! Scheme
 ! Pre-build

Raboof: recommend agenix and sops-nix before getting into the nitty-gritty details.

2025-11-13T12:13:58Z

recommend agenix and sops-nix before getting into the nitty-gritty details.

← Older revision		Revision as of 12:13, 13 November 2025
Line 4:		Line 4:

	While this paradigm is still available to NixOS users, a Nix-managed system is in an unique position to leverage <b>secret managing schemes</b>: special software capable of deploying secret information securely. Instead of writing the secret information unencrypted to a NixOS configuration, the software described below can decrypt the relevant secrets and deploy them at various stages of the NixOS system deployment process. This advanced form of secrets configuration is even more important for NixOS configurations tracked with Git or [[Flakes]], as one will be able to store these encrypted secrets in the Git repository and still be able to upload the repository on the public Internet.		While this paradigm is still available to NixOS users, a Nix-managed system is in an unique position to leverage <b>secret managing schemes</b>: special software capable of deploying secret information securely. Instead of writing the secret information unencrypted to a NixOS configuration, the software described below can decrypt the relevant secrets and deploy them at various stages of the NixOS system deployment process. This advanced form of secrets configuration is even more important for NixOS configurations tracked with Git or [[Flakes]], as one will be able to store these encrypted secrets in the Git repository and still be able to upload the repository on the public Internet.

			The most popular options for secrets management are [[Agenix]], [https://github.com/Mic92/sops-nix sops-nix] or the secrets management solution native to the deployment tool you chose. Below follows a more in-depth comparison including less well-known solutions.

	== Definitions ==		== Definitions ==

Malix: /* Comparison */ fix table

2025-11-08T15:47:50Z

Comparison: fix table

← Older revision		Revision as of 15:47, 8 November 2025
Line 63:		Line 63:
	\| Yes		\| Yes
	\| No		\| No
			\|
	\|-		\|-
	\| <code>[https://github.com/oddlama/agenix-rekey agenix-rekey]</code>		\| <code>[https://github.com/oddlama/agenix-rekey agenix-rekey]</code>
Line 73:		Line 74:
	\| Yes		\| Yes
	\| No		\| No
			\|
	\|-		\|-
	\| [https://github.com/yaxitech/ragenix ragenix]		\| [https://github.com/yaxitech/ragenix ragenix]
Line 83:		Line 85:
	\| Yes		\| Yes
	\| No		\| No
			\|
	\|-		\|-
	\| [https://github.com/Mic92/sops-nix sops-nix]		\| [https://github.com/Mic92/sops-nix sops-nix]

SigmaSquadron: Rewrite to follow the Manual of Style and a general cleanup of outdated information. TODO: the rest of the table needs a cleanup.

2025-02-23T17:46:31Z

Rewrite to follow the Manual of Style and a general cleanup of outdated information. TODO: the rest of the table needs a cleanup.

Show changes

Timka: grammar

2024-12-28T23:38:58Z

grammar

← Older revision		Revision as of 23:38, 28 December 2024
Line 26:		Line 26:
	: the name of the scheme, if possible a link to the official website or source, maybe a short description		: the name of the scheme, if possible a link to the official website or source, maybe a short description
	; pre build		; pre build
	: Where does the secret reside before the configuration is ~~build~~? In a file, in a nix expression, in an external database (password manager)? Is it encrypted?		: Where does the secret reside before the configuration is built? In a file, in a nix expression, in an external database (password manager)? Is it encrypted?
	; build time		; build time
	: what happens at build time, is the secret decrypted or encrypted, which master passwords, passphrases or helper programs are needed		: what happens at build time, is the secret decrypted or encrypted, which master passwords, passphrases or helper programs are needed

Secirian: /* Comparison */ migrate changes from old wiki

2024-12-09T10:03:57Z

Comparison: migrate changes from old wiki

@@ Line 76: / Line 76: @@
 | yes
 | no
+|
 |-
 | [https://github.com/Mic92/sops-nix sops-nix]
@@ Line 121: / Line 140: @@
 | no
 | Focuses on trying to keep secrets decrypted for a minimal amount of time
 |-
 |[https://github.com/brizzbuzz/opnix brizzbuzz/opnix]

1abcdef: add two opnix projects

2024-11-23T07:13:01Z

add two opnix projects

@@ Line 121: / Line 121: @@
 | no
 | Focuses on trying to keep secrets decrypted for a minimal amount of time
 |-
 ! scheme

Tboston: align wording

2024-08-11T13:14:45Z

align wording

← Older revision		Revision as of 13:14, 11 August 2024
Line 130:		Line 130:
	! encryption technology		! encryption technology
	! "official" project		! "official" project
	! ~~templates~~		! templating support
	! notes		! notes
	\|-		\|-

Tboston: that a header cell

2024-08-11T13:12:19Z

that a header cell

← Older revision		Revision as of 13:12, 11 August 2024
Line 178:		Line 178:
	! "official" project		! "official" project
	! templating support		! templating support
	\|'''notes'''		!'''notes'''
	\|}		\|}

	[[Category:Guide]]		[[Category:Guide]]