Comparison of secret managing schemes
Introduction
Sometimes you need to use secrets in you system configuration. Those can range from user passwords and Wifi passwords over private keys (ssh, ssl, ...) to API tokens and similar things. Normally one would store this kind of information in files with restricted access writes (only readable by some Unix user) or even encrypt them on disk. Nix and NixOS store a lot of information in the Nix store where at least the former is not possible. People who track their configuration with Git (or even use Flakes) might even want to store these secrets in the Git repository but still upload the repository somewhere.
In these cases it is necessary to think about a suitable scheme to manage the relevant secrets so that they are only readable by the right people or machines. This page tries to give an overview of different schemes that can be used and outlines the aims, requirements and implications of each.
Definitions
The properties of the different schemes that are listed in the table below are explained in detail here. You are welcome to add more schemes (rows) to the table; please try to fill in as many of the properties as you can.
- scheme
- the name of the scheme, if possible a link to the official website or source, maybe a short description
- "official" project
- whether this is a software project published (maybe even actively developed) or just some notes in a forum or a blog entry
TODO: more (when the table takes shape)
Comparison
| scheme | pre build | build time | /nix/store (or on disk)
|
system activation | runtime | "official" project | notes |
|---|---|---|---|---|---|---|---|
| NixOps keys
(is there a better link to the docs that does not depend on a hydra build id?) |
plain text in a nix expression | no, stored outside of the store (TODO more info) | unencrypted in /run/keys/..., the user has to run nixops
|
yes | "out of band", secret management happens outside of nixos-rebuild
| ||
| agenix | yes | ||||||
| sops-nix | yes | ||||||
| krops | yes | ||||||
buildins.readfile
|
no | ||||||
buildins.exec
|
no | ||||||
| Blog entry 1
based on age and the ssh host key of the target machine |
plain text file (unencrypted), can be stored in git | encryption | encrypted, in the store | decrypted by a systemd unit | no, blog, | ||
| Blog entry 2 | no |