pkg/sops-nix
1
0
Fork 0
mirror of https://github.com/Mic92/sops-nix.git synced 2025-12-26 14:14:58 +08:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Add configuration option to use tmpfs in place of ramfs (#355)

Browse source 
allow use of tmpfs via option configuration

* Tabs vs Spaces

* Update modules/sops/default.nix

* Update modules/sops/default.nix
This commit is contained in:
Mic92 2023-07-24 11:15:10 +00:00 • committed by Jörg Thalheim
parent 1c673ba105
commit 339a559402
3 changed files with 34 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

21
modules/sops/default.nix
View file

@ -126,6 +126,7 @@ let
sshKeyPaths = cfg.gnupg.sshKeyPaths;
ageKeyFile = cfg.age.keyFile;
ageSshKeyPaths = cfg.age.sshKeyPaths;
useTmpfs = cfg.useTmpfs;
userMode = false;
logging = {
keyImport = builtins.elem "keyImport" cfg.log;
@ -242,6 +243,26 @@ in {
'';
};
useTmpfs = mkOption {
type = types.bool;
default = false;
description = lib.mkDoc ''
Use tmpfs in place of ramfs for secrets storage.
*WARNING*
Enabling this option has the potential to write secrets to disk unencrypted if the tmpfs volume is written to swap. Do not use unless absolutely necessary.
When using a swap file or device, consider enabling swap encryption by setting the `randomEncryption.enable` option
```
swapDevices = [{
device = "/dev/sdXY";
randomEncryption.enable = true;
}];
```
'';
};
age = {
keyFile = mkOption {
type = types.nullOr types.path;