pkg/sops-nix
1
0
Fork 0
mirror of https://github.com/Mic92/sops-nix.git synced 2026-05-12 02:45:55 +08:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

add native support for ssh keys for age

Browse source
This commit is contained in:
musjj 2025-04-22 06:16:55 +07:00
parent 61154300d9
commit 4fb1eef0c0
6 changed files with 90 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

28
modules/sops/default.nix
View file

@ -339,12 +339,24 @@ in
'';
};
sshKeyFile = lib.mkOption {
type = lib.types.nullOr pathNotInStore;
default = null;
example = "/etc/ssh/ssh_host_ed25519_key";
description = ''
Path to ssh key file that will be used by age for sops decryption.
'';
};
sshKeyPaths = lib.mkOption {
type = lib.types.listOf lib.types.path;
default = defaultImportKeys "ed25519";
defaultText = lib.literalMD "The ed25519 keys from {option}`config.services.openssh.hostKeys`";
description = ''
Paths to ssh keys added as age keys during sops description.
Paths to ssh keys added as age keys during sops description. The ssh
keys will be converted into age keys manually using ssh-to-age.
This option is deprecated and will be removed in the future. Use sops.age.sshKeyFile instead.
'';
};
};
@ -405,6 +417,7 @@ in
cfg.gnupg.home != null
|| cfg.gnupg.sshKeyPaths != [ ]
|| cfg.age.keyFile != null
|| cfg.age.sshKeyFile != null
|| cfg.age.sshKeyPaths != [ ];
message = "No key source configured for sops. Either set services.openssh.enable or set sops.age.keyFile or sops.gnupg.home";
}
@ -483,6 +496,19 @@ in
};
})
{
warnings = [
(lib.mkIf
(
cfg.age.sshKeyPaths != [ ]
&& cfg.gnupg.sshKeyPaths == [ ]
&& cfg.gnupg.home == null
&& cfg.age.keyFile == null
&& cfg.age.sshKeyFile == null
)
"The option sops.age.sshKeyPaths has been deprecated, since age now has native SSH support. Use option sops.age.sshKeyFile instead."
)
];
system.build.sops-nix-manifest = manifest;
}
];

1
modules/sops/manifest-for.nix
View file

@ -40,6 +40,7 @@ else
gnupgHome = cfg.gnupg.home;
sshKeyPaths = cfg.gnupg.sshKeyPaths;
ageKeyFile = cfg.age.keyFile;
ageSshKeyFile = cfg.age.sshKeyFile;
ageSshKeyPaths = cfg.age.sshKeyPaths;
useTmpfs = cfg.useTmpfs;
placeholderBySecretName = cfg.placeholder;