This error can be puzzling if you're not already aware of how this
works, pointing users in the direction of openssh (which I suspect is
the most common way to populate `identityPaths`) while also keeping the
original message seems instructive.
This can happen if for example a secret is used in the initrd, which
materializes it as a directory, which then causes agenix to silently
create an incorrect link when switching to stage2. This ensures that
agenix will abort with an error.
Why
===
* Someone said age works better with password protected keys,
requiring entering the password less often.
* We switched to rage from age in
07ce686870
because it was limiting recipients to 20. This was fixed
https://github.com/FiloSottile/age/issues/139
What changed
===
* Switch from rage back to age (the reference implementation) in all
the spots
* Update the docs to show how to switch back to Rage
* Skip keys that are empty files, which fixes the integration test.
Change the order of operations to:
1. create new generation
2. decrypt secrets into new generation
3. symlink and remove old generation/secrets
Signed-off-by: Jeroen Simonetti <jeroen@simonetti.nl>
There are some cases where it may be better or even required to have the
secret be a file that is not a symlink. Setting
age.secrets.some-secret.symlink = false;
will disable the default functionality of symlinking secrets and instead
just forcibly move them to their `path`.
This follows sops-nix's implementation, where it creates a
`/run/secrets.d` ramfs mountpoint and a "generation" each time
the activation script runs, and then symlinks `/run/secrets` to
`/run/secrets.d/[generation]`.
This assumes that the root user is always uid 0 and gid 0, which I
believe is a safe assumption. The reason to add this is because when a
declarative VM (for example, a NixOS test) or image boots the first
time, the installRootOwnedSecrets activation script runs BEFORE the
"users" and "groups" activation scripts, so the user and group for
root is not created. Using uid 0 and gid 0 gets around the root user
not being set up yet.
