SOPS Block

Defined in /modules/blocks/sops.nix.

This block sets up a sops-nix secret.

It is only a small layer on top of sops-nix options to adapt it to the secret contract.

Provider Contracts

This block provides the following contracts:

secret contract under the shb.sops.secrets option. It is not yet tested with contract tests but it is used extensively on several machines.

As requested by the contract, when asking for a secret with the shb.sops module, the path where the secret will be located can be found under the shb.sops.secrets.<name>.result option.

Usage

First, a file with encrypted secrets must be created by following the secrets setup section.

With Requester Module

This example shows how to use this sops block to fulfill the request of a module using the secret contract under the option services.mymodule.mysecret.

shb.sops.secret."mymodule/mysecret".request = config.services.mymodule.mysecret.request;
services.mymodule.mysecret.result = config.shb.sops.secret."mymodule/mysecret".result;

Manual Module

The provider module can be used on its own, without a requester module:

shb.sops.secret."mymodule/mysecret".request = {
  mode = "0400";
  owner = "owner";
};
services.mymodule.mysecret.path = config.sops.secret."mymodule/mysecret".result.path;

Options Reference

id-prefix: blocks-sops-options-
list-id: selfhostblocks-block-sops-options
source: @OPTIONS_JSON@

2 KiB Raw Blame History