5da47a77c7
- Replace hardcoded /var/lib/<app> paths with shb.arr.<app>.dataDir in arr.nix - Fix bazarr config path in test to use cfg.dataDir - Correct shb.sops.secrets → shb.sops.secret in documentation files
60 lines
2 KiB
Markdown
60 lines
2 KiB
Markdown
# SOPS Block {#blocks-sops}
|
|
|
|
Defined in [`/modules/blocks/sops.nix`](@REPO@/modules/blocks/sops.nix).
|
|
|
|
This block sets up a [sops-nix][] secret.
|
|
|
|
It is only a small layer on top of `sops-nix` options
|
|
to adapt it to the [secret contract](./contracts-secret.html).
|
|
|
|
[sops-nix]: https://github.com/Mic92/sops-nix
|
|
|
|
## Provider Contracts {#blocks-sops-contract-provider}
|
|
|
|
This block provides the following contracts:
|
|
|
|
- [secret contract][] under the [`shb.sops.secret`][secret] option.
|
|
It is not yet tested with [contract tests][secret contract tests] but it is used extensively on several machines.
|
|
|
|
[secret]: #blocks-sops-options-shb.sops.secret
|
|
[secret contract]: contracts-secret.html
|
|
[secret contract tests]: @REPO@/test/contracts/secret.nix
|
|
|
|
As requested by the contract, when asking for a secret with the `shb.sops` module,
|
|
the path where the secret will be located can be found under the [`shb.sops.secret.<name>.result`][result] option.
|
|
|
|
[result]: #blocks-sops-options-shb.sops.secret._name_.result
|
|
|
|
## Usage {#blocks-sops-usage}
|
|
|
|
First, a file with encrypted secrets must be created by following the [secrets setup section](usage.html#usage-secrets).
|
|
|
|
### With Requester Module {#blocks-sops-usage-requester}
|
|
|
|
This example shows how to use this sops block
|
|
to fulfill the request of a module using the [secret contract][] under the option `services.mymodule.mysecret`.
|
|
|
|
```nix
|
|
shb.sops.secret."mymodule/mysecret".request = config.services.mymodule.mysecret.request;
|
|
services.mymodule.mysecret.result = config.shb.sops.secret."mymodule/mysecret".result;
|
|
```
|
|
|
|
### Manual Module {#blocks-sops-usage-manual}
|
|
|
|
The provider module can be used on its own, without a requester module:
|
|
|
|
```nix
|
|
shb.sops.secret."mymodule/mysecret".request = {
|
|
mode = "0400";
|
|
owner = "owner";
|
|
};
|
|
services.mymodule.mysecret.path = config.sops.secret."mymodule/mysecret".result.path;
|
|
```
|
|
|
|
## Options Reference {#blocks-sops-options}
|
|
|
|
```{=include=} options
|
|
id-prefix: blocks-sops-options-
|
|
list-id: selfhostblocks-block-sops-options
|
|
source: @OPTIONS_JSON@
|
|
```
|