Skip to content

feature: enable one-way encrypted secrets #157

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
ryantm wants to merge 2 commits into
base: main
Choose a base branch
from
Draft

feature: enable one-way encrypted secrets #157

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
797ee44
test: add tests for one-way encrypted secrets
ryantm Feb 20, 2023
2cf2bf1
feature: enable one-way encrypted secrets
ryantm Feb 20, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions pkgs/agenix.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -130,7 +130,7 @@ function decrypt {
err "There is no rule for $FILE in $RULES."
fi

if [ -f "$FILE" ]
if [ -f "$FILE" ] && [ -t 0 ]
then
DECRYPT=("${DEFAULT_DECRYPT[@]}")
if [[ "${DECRYPT[*]}" != *"--identity"* ]]; then
Expand Down Expand Up @@ -171,7 +171,7 @@ function edit {
warn "$FILE wasn't created."
return
fi
[ -f "$FILE" ] && [ "$EDITOR" != ":" ] && @diffBin@ -q -- "$CLEARTEXT_FILE.before" "$CLEARTEXT_FILE" && warn "$FILE wasn't changed, skipping re-encryption." && return
[ -f "$FILE" ] && [ "$EDITOR" != ":" ] && [ -f "$CLEARTEXT_FILE.before" ] && @diffBin@ -q "$CLEARTEXT_FILE.before" "$CLEARTEXT_FILE" && warn "$FILE wasn't changed, skipping re-encryption." && return

ENCRYPT=()
if [[ "$ARMOR" == "true" ]]; then
Expand Down
6 changes: 6 additions & 0 deletions test/fixtures/one-way/secrets.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
let
system1 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPJDyIr/FSz1cJdcoW69R+NrWzwGK/+3gJpqD1t8L2zE";
in
{
"one-way.age".publicKeys = [ system1 ];
}
4 changes: 4 additions & 0 deletions test/install_ssh_host_keys.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,5 +25,9 @@
cp -r "${../example}" /tmp/secrets
chmod -R u+rw /tmp/secrets
chown -R $USER1_UID:$USERS_GID /tmp/secrets

cp -r "${./fixtures/one-way}" /tmp/secrets-one-way
chmod -R u+rw /tmp/secrets-one-way
chown -R $USER1_UID:$USERS_GID /tmp/secrets-one-way
'';
}
11 changes: 11 additions & 0 deletions test/integration.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,6 +108,9 @@ pkgs.nixosTest {

assert "${hyphen-secret}" in system1.succeed("cat /run/agenix/leading-hyphen")

userDir = "/tmp/secrets"
userDo = lambda input : f"sudo -u user1 -- bash -c 'set -eou pipefail; cd {userDir}; {input}'"

userDo = lambda input : f"sudo -u user1 -- bash -c 'set -eou pipefail; cd /tmp/secrets; {input}'"

before_hash = system1.succeed(userDo('sha256sum passwordfile-user1.age')).split()
Expand Down Expand Up @@ -138,5 +141,13 @@ pkgs.nixosTest {

# finally, the plain text should not linger around anywhere in the filesystem.
system1.fail("grep -r secret1234 /tmp")

# user1 can make a one-way secret, but cannot see the contents, and host can decrypt
userDir = "/tmp/secrets-one-way"
system1.succeed(userDo("echo eye1234 | agenix -e one-way.age"))
system1.fail(userDo("EDITOR=cat agenix -e one-way.age"))
assert "eye1234" in system1.succeed(f"cd {userDir};EDITOR=cat agenix -e one-way.age -i /etc/ssh/ssh_host_ed25519_key")
system1.succeed(userDo("echo nose1234 | agenix -e one-way.age"))
assert "nose1234" in system1.succeed(f"cd {userDir};EDITOR=cat agenix -e one-way.age -i /etc/ssh/ssh_host_ed25519_key")
'';
}
Loading