agenix

The value brought by NixOS is on line 6. --config ${config.sops.secrets."rclone.conf".path} \ NixOS let you build the abstraction you want, and mix them with abstractions provided by others, and this single line illustrates this point extremely well as `sops` is not yet part of NixOS. Secret management would likely come in NixOS in the future, but in the mean time you can add either use https://github.com/Mic92/sops-nix or https://github.com/ryantm/agenix to make it possible to manage files which have content that should not be public. Other package managers also provide some abstraction over the packages, and would likely see the same systemd configuration abstracted the same way in post-install scripts. Yet, the encrypted file for `rclone.conf` would come as a static path in `/etc`. You could resume NixOS as having moved the post-ins

And for cloud/dedicated servers perhaps https://github.com/nix-community/nixos-anywhere (There's also a terraform module ) And for state changes https://github.com/serokell/deploy-rs Or Colmena /nixops/ and x other For secret handling perhaps https://github.com/ryantm/agenix/ + https://github.com/oddlama/agenix-rekey The ecosystem is in my experience very well fleshed out (7 yrs of use), as long as you don't require a knowledgebase/wiki/ up2date documentation, it's not been a issue for me since I could always fall back on Linux knowledge and just looking for how other distributions do x / how the thing itself is configured , and looking at how perhaps a existing nix module wraps that

Age (and its rust implementation Rage) combined with agenix[0] and age.el[1] has made my self-hosted deployment and management so, so easy without compromising security. That, when combined with general NixOS conveniences is why I'm able to self-host at all. If not for these, just the anxiety of having to setup new server in case of whatever loss and the associated time/opportunity loss kept me from dong the same for years. Anyway, just want to say that Age is great! P.S. The author also did an analysis of Restic the backup tool [2] which also prompted me to setup nice backup solution for my machines. Pretty cool. [0]: https://github.com/ryantm/agenix [1]: https://github.com/anticomputer/age.el [2]: https://words.filippo.io/restic-cryptography/

I don't have a write-up, just my code in git. But it's not public. I'm not using anything out of the ordinary - Nix containers, modules, and functions, and the Agenix module with uses a private key to decrypt secrets at start. The Nix language is inherently composable. If you are familiar with Nix, it should be straightforward, otherwise it would probably be better to learn it first. Perhaps you could use this as a mechanism to learn. Here are some links that explain: Containers: https://nixos.wiki/wiki/NixOS_Containers Modules: https://nixos.wiki/wiki/NixOS_modules Functions: https://www.reddit.com/r/NixOS/comments/zzstun/please_help_m... Agenix: https://github.com/ryantm/agenix

I feel that trying to make SSH keys short-lived is becoming more painful each year because there's an increase of tools that use SSH keys for purposes other than SSH logins. For example, age [1] encrypts files with SSH keys, agenix [2] does secrets management with it, Git can now sign commits with it [3], and even ssh-keygen can now sign arbitrary data [4]. All of these become useless the moment you start using short-lived keys. [1]: https://github.com/FiloSottile/age [2]: https://github.com/ryantm/agenix [3]: https://calebhearth.com/sign-git-with-ssh [4]: https://www.man7.org/linux/man-pages/man1/ssh-keygen.1.html