NixOS Secrets Management - Part 1/3

Part 1 of 3 in my series on secrets management in NixOS using sops-nix as a part of a nix-config. The series covers information about sops, generating keys, storing secrets, programmatic access, and storing secrets in private repository separate from your main, nix-config repo.
OUTLINE
0:00 Introduction
0:32 Thank you
0:43 Sops overview
2:45 Enabling sops-nix
3:16 Access keys
4:15 Generating keys
5:17 Setting up a standalone dev access key
7:00 Creating the .sops.yaml file
8:28 Setting up a host access key
10:00 secrets.yaml
OTHER VIDEOS IN THIS SERIES
Part 2: • NixOS Secrets Manageme...
Part 3: • NixOS Secrets Manageme...
SUPPORT
If you find what I do helpful, please consider supporting my work on Ko-fi.
ko-fi.com/unmovedcentre
I intentionally keep my content ad free.
ADDITIONAL MATERIAL
- My nix-config on GitHub: github.com/EmergentMind/nix-c...
- A related article on my website Unmoved Centre: unmovedcentre.com/technology/...
EXTERNAL REFERENCES
- sops-nix: github.com/Mic92/sops-nix
- age file encryption: github.com/FiloSottile/age
Note: I discovered after recording audio that "age" in this case is the Italian word for needles is pronounced with a hard "g". translate.google.com/?sl=it&t...
CONNECT
- Subscribe to this KZbin channel
- My website: www.unmovedcentre.com
- X / Twitter: / emergent_mind
- GitHub: github.com/EmergentMind
- GitLab: gitlab.com/emergentmind

[@luisliz]

Holly shit can’t believe the insane quality of nix KZbinrs that is starting out. Tyyyyyy!!!

[@Emergent_Mind]

Thanks for the compliment!

[@vernonhinkelschmidt]

I am coming here to say this: This is 100% the best series on this topic! These videos along with your accompanying website were an insane blessing to have. Outside of this tutorial there are exactly 0 articles, or guides on how to set up sops-nix with a git private key. Everyone has tutorials over how to setup Wireguard, Passwords, but no one has put in what seemingly to many is such a small detail. When I adapted your code from the home manager section to actually place the key at the correct location, and did a rebuild it worked flawlessly. Cannot thank you enough for this series!

[@Emergent_Mind]

Thank you for the kind compliment. I'm glad it was helpful!

[@aimpizza6823]

Just from watching the first part I am amazed of the quality of your teaching. Really appreciate it as the topic is a bit niche :]

[@Emergent_Mind]

Thank you for the kind compliment! More to come.

[@christopherchalcraft1134]

amazing video. great quality and so clearly explained for a for a fomplef topic. i watch a lot of tech content and nix specifically and this is close to the top.

[@Emergent_Mind]

Thanks for watching and for the compliment.

[@Dyrgrip]

Awesome content! Thank you for sharing your secrets! :)

[@Emergent_Mind]

Thank you for watching!

[@Julien-rc1bi]

Thanks for the great video. I'm using sops-nix with an age text file key and it works great. I'm a bit confused about the use of the public ssh key to generate an age public key: how do you manage the ssh key upon reinstall of the system? In other words, can you make your ssh key invariant to ensure that the private age key define in .sops.yaml always match your private ssh key in /etc/ssh ?

[@Emergent_Mind]

Thanks for the compliment, I'm glad you enjoyed the video. There two ways to handle the ssh key situation on reinstall. The first would be to copy the system's ssh key prior to reinstall and then write it to the reinstalled system after. Actually, when you're booted to the nixos installer environment you can write the ssh key pair to `/mnt/etc/ssh` and then when the install is executed the keys are written to the system. Pro: no need to update .sops.yaml and updatekeys on secrets.yaml Con: need to copy or have a back up of the original ssh key and put it on the reinstalled system The second would be to accept that the old ssh key will be paved and instead, generate a new age key for the system derived from the new ssh key. You'd just update the .sops.yaml to replace the original age public key with the new one and run a sops updatekeys command to encrypt the secrets appropriate. Pro: no need to move copies of the ssh key around Con: you need to update .sops.yaml and updatekys on secrets.yaml There may actually be other options but those are the two that I would consider. They both require a similar amount of effort but in different ways. If it's a scenario that you're running into frequently you could look into automating parts of the process with scripts. I'm experimenting with automating remote installation at the moment and currently have it set up so that, prior to install, an ssh key for the target system is generated on a source system, age keys are derived, my .sops.yaml and secrets are updated, and the ssh keys are injected into the installer. It's been a lot of fun trial and error but it's all automatic. Is that helpful? Let me know how it goes.

[@Julien-rc1bi]

@@Emergent_Mind thanks a lot for the detailed answer. It makes lots of sense and I'll experiment a bit with the two options once I'm back from holiday.

[@HyuLilium]

Have you tried to restore the backed up age private key contents? I've tried and I got checksum error when trying to decrypt with it.

[@Emergent_Mind]

Hi there, I have but it not since I was testing it out early on. There are many potential issues that could occur there so I'm not sure how to help. Maybe post your issue with some additional context on discourse.nixos.org/ I'll keep an eye out for it but I do happen to be headed on vacation for a couple of weeks so hopefully someone else can point you in the right direction. Let me know how it goes and thanks for watching!

[@user-yh7gc7lt1r]

I like the option of using ssh-host-key for different hosts, but what about reinstalling the system? I mean, yes, we have a backup dev key and we won’t lose the ability to decrypt secrets.yaml, but with a new installation, the host key will change, which means we need to copy the dev key to the host, then do sops updatekeys and add the new public age key of the host to . sops.yaml. Did I miss anything? Perhaps you know a better way?

[@Emergent_Mind]

What you described is correct. Alternatively, you could backup the 'known' host ssh key prior to reinstall and then overwrite the autogenerated one with it, which would keep the .sops.yaml and age key data unchanged. Hard to say if one is more convenient than the other though. I am working on some remote install automation at the moment, which includes handling secrets management with a private repo, and automatically generates keys and updates .sops.yaml accordingly. It's still a work in progress because of other aspects of the process but it's close to being done. I'll be making some videos to describe it all when it's finished. Thanks for watching!

[@agh0x01]

Am interested to hear you elaborate on why PGP is no good.

[@Emergent_Mind]

Hahaha, I suspected someone would call me out on that at some point. :) My disdain for PGP is specifically from consistently bad experiences using it over a couple decades. Every time I need it for more than a minimal touch, 'out-of-the-box' scenario I run into endless problems and often lose significant amounts of time trying to troubleshoot (often to no avail). I will admit that this is most likely my own failings more than an intrinsic problem with the technoloyg but I do find it needlessly convoluted. So really, I just avoid it whenever I can. Has your experience with it been positive? Thanks for watching and for the comment!

[@agh0x01]

@@Emergent_Mind yeah, I was just genuinely interested to know if it had failings as means of protecting sensitive information, as I use GPG occasionally. It sounds like your concerns were more about usability rather than the security side, although granted, a security product that is difficult or especially confusing to use can result in the security one believes to have not actually being.

[@hikingpete]

At t=663 you have a `cat -p ...`. What's up with that? Do you have a non-standard `cat`? It's a `bat` alias, isn't it. I would encourage you to use the proper names, or the standard utilities.

[@Emergent_Mind]

Thanks for the suggestion!I will keep this in mind for future videos.

[@S4ntia60]

Delve? is this AI?

[@Emergent_Mind]

It seems like you have provided an unrelated statement. I'm not sure what you are asking. To clarify, could you please provide more context or rephrase your question? I'm here to help, and I'll do my best to provide a useful, helpful, and actionable answer once I understand your question. ;P no, I am not AI

[@nixeverything]

I think you should just go for sharing how to do the dual key thing, even if not many may need it. I can tell you no one else will teach it I am also now curious, never even considered it as a possibility tbh

[@Emergent_Mind]

Thanks for the suggestion and your other comment! There are already a few things I would like to improve about how I presented this series. There are a lot of other topics I'm planning to cover in the near future but I've added the multi-key topic as something to go through, when this series eventually gets a revision. It's good to know what people are interested in hearing about!