You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+12-12Lines changed: 12 additions & 12 deletions
Original file line number
Diff line number
Diff line change
@@ -2,8 +2,8 @@
2
2
3
3
`agenix` is a small and convenient Nix library for securely managing and deploying secrets using common public-private SSH key pairs:
4
4
You can encrypt a secret (password, access-token, etc.) on a source machine using a number of public SSH keys,
5
-
and deploy that encrypted secret to any another target machine that has the corresponding private SSH key of one of those public keys.
6
-
This project contains two parts:
5
+
and deploy that encrypted secret to any another target machine that has the corresponding private SSH key of one of those public keys.
6
+
This project contains two parts:
7
7
1. An `agenix` commandline app (CLI) to encrypt secrets into secured `.age` files that can be copied into the Nix store.
8
8
2. An `agenix` NixOS module to conveniently
9
9
* add those encrypted secrets (`.age` files) into the Nix store so that they can be deployed like any other Nix package using `nixos-rebuild` or similar tools.
@@ -250,7 +250,7 @@ To install the `agenix` binary:
When the `age.secrets` attribute set contains a secret, the `agenix` NixOS module will later automatically decrypt and mount that secret under the default path `/run/agenix/secret1`.
359
+
When the `age.secrets` attribute set contains a secret, the `agenix` NixOS module will later automatically decrypt and mount that secret under the default path `/run/agenix/secret1`.
360
360
Here the `secret1.age` file becomes part of your NixOS deployment, i.e. moves into the Nix store.
361
361
362
362
6. Reference the secrets' mount path in your config:
@@ -372,14 +372,14 @@ e.g. inside your `flake.nix` file:
372
372
So `config.age.secrets.secret1.path` will contain the path `/run/agenix/secret1` by default.
373
373
7. Use `nixos-rebuild` or [another deployment tool](https://nixos.wiki/wiki/Applications#Deployment") of choice as usual.
374
374
375
-
The `secret1.age` file will be copied over to the target machine like any other Nix package.
375
+
The `secret1.age` file will be copied over to the target machine like any other Nix package.
376
376
Then it will be decrypted and mounted as described before.
377
377
8. Edit secret files:
378
378
```ShellSession
379
379
$ agenix -e secret1.age
380
380
```
381
-
It assumes your SSH private key is in `~/.ssh/`.
382
-
In order to decrypt and open a `.age` file for editing you need the private key of one of the public keys
381
+
It assumes your SSH private key is in `~/.ssh/`.
382
+
In order to decrypt and open a `.age` file for editing you need the private key of one of the public keys
383
383
it was encrypted with. You can pass the private key you want to use explicitly with `-i`, e.g.
384
384
```ShellSession
385
385
$ agenix -e secret1.age -i ~/.ssh/id_ed25519
@@ -659,7 +659,7 @@ secret. This is the only required secret option.
659
659
#### `age.secrets.<name>.path`
660
660
661
661
`age.secrets.<name>.path` is the path where the secret is decrypted
662
-
to. Defaults to `$XDG_RUNTIME_DIR/agenix/<name>` on Linux and
662
+
to. Defaults to `$XDG_RUNTIME_DIR/agenix/<name>` on Linux and
663
663
`$(getconf DARWIN_USER_TEMP_DIR)/agenix/<name>` on Darwin.
664
664
665
665
#### `age.secrets.<name>.mode`
@@ -681,13 +681,13 @@ This is a required option; there is no default value.
681
681
#### `age.secretsDir`
682
682
683
683
`age.secretsDir` is the directory where secrets are symlinked to by
684
-
default. Defaults to `$XDG_RUNTIME_DIR/agenix` on Linux and
684
+
default. Defaults to `$XDG_RUNTIME_DIR/agenix` on Linux and
685
685
`$(getconf DARWIN_USER_TEMP_DIR)/agenix` on Darwin.
686
686
687
687
#### `age.secretsMountPoint`
688
688
689
689
`age.secretsMountPoint` is the directory where the secret generations
690
-
are created before they are symlinked. Defaults to `$XDG_RUNTIME_DIR/agenix.d`
690
+
are created before they are symlinked. Defaults to `$XDG_RUNTIME_DIR/agenix.d`
691
691
on Linux and `$(getconf DARWIN_USER_TEMP_DIR)/agenix.d` on Darwin.
0 commit comments