Skip to content

secretsDir and secretsMountPoint: helping with impermanence and accessing secrets after (re)boot, maybe? #850

@fooness

Description

@fooness

I just switched from agenix to sops-nix, hoping it would solve some problems I experience, but unfortunately sops-nix also comes (for me) with some problems. re: #149

agenix allows setting the secretsDir and secretsMountpoint, for example:

  age = {
    secretsDir = "/persist/secrets/run/agenix";
    secretsMountPoint = "/persist/secrets/run/agenix.d";
  };

If these options were available in sops-nix, for example …

  sops = {
    secretsDir = "/persist/secrets/run/secrets";
    secretsMountPoint = "/persist/secrets/run/secrets.d";
  };

… wouldn’t this help with fixing impermance issues without marking filesystems as neededForBoot, like the following?

  fileSystems = {
    "/persist" = {
      neededForBoot = true;
    };
  };

PS: I’m not even really sure why I need to set that fileSystems = { … }; block for sops-nix to work, as agenix did not need this block, and I somewhat assume that agenix works somewhat similar in regards to when files are accessed, so if agenix was able to access the necessary files located on my /persist filesystem (which is mounted during boot stage 2, but after /root), then why does sops-nix not work without this block?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions