pkg/sops-nix
1
0
Fork 0
mirror of https://github.com/Mic92/sops-nix.git synced 2026-05-05 05:26:05 +08:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

feat(nixos): add age key generation args option

Browse source
This commit is contained in:
Lucas Wagler 2026-04-08 12:56:27 -04:00 • committed by Lucas Wagler
parent d7cbc61787
commit 1721fd4324
2 changed files with 61 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

51
checks/nixos-test.nix
View file

@ -198,6 +198,57 @@ in
'';
};
# This test should be altered or removed if `age-keygen` switches its default to match the post-quantum `-pq` behavior.
age-extra-generate-key-args = testers.runNixOSTest {
name = "age-generate-key-args";
nodes.machine =
{ ... }:
{
imports = [ ../modules/sops ];
sops = {
age = {
keyFile = "/run/age-keys-args.txt";
generateKey = true;
extraGenerateKeyArgs = [ "-pq" ];
};
defaultSopsFile = testAssets + "/secrets.yaml";
secrets.test_key = { };
};
};
testScript = ''
start_all()
machine.succeed("cat /run/age-keys-args.txt | grep -q AGE-SECRET-KEY-PQ-")
'';
};
age-extra-generate-key-args-override-keyfile = testers.runNixOSTest {
name = "age-generate-key-args-override-keyfile";
nodes.machine =
{ ... }:
{
imports = [ ../modules/sops ];
sops = {
age = {
keyFile = "/run/age-keys-args-fail.txt";
generateKey = true;
extraGenerateKeyArgs = [
"-o"
"/run/age-keys-args-succeed.txt"
];
};
defaultSopsFile = testAssets + "/secrets.yaml";
secrets.test_key = { };
};
};
testScript = ''
start_all()
machine.fail("find /run/age-keys-args-fail.txt")
machine.succeed("find /run/age-keys-args-succeed.txt")
'';
};
age-ssh-keys = testers.runNixOSTest {
name = "sops-age-ssh-keys";
nodes.machine = {

11
modules/sops/default.nix
View file

@ -361,6 +361,15 @@ in
'';
};
extraGenerateKeyArgs = lib.mkOption {
type = lib.types.listOf lib.types.str;
default = [ ];
example = [ "-pq" ];
description = ''
List of arguments to use when generating the age key.
'';
};
sshKeyPaths = lib.mkOption {
type = lib.types.listOf lib.types.path;
default = defaultImportKeys "ed25519";
@ -511,7 +520,7 @@ in
echo generating machine-specific age key...
mkdir -p $(dirname ${escapedKeyFile})
# age-keygen sets 0600 by default, no need to chmod.
${pkgs.age}/bin/age-keygen -o ${escapedKeyFile}
${pkgs.age}/bin/age-keygen -o ${escapedKeyFile} ${lib.join " " cfg.age.extraGenerateKeyArgs}
fi
''
);