Comparison of different key/secret managing schemes

happysalada · June 3, 2021, 3:22pm

Thanks it makes sense!

Also one small update. In agenix you can actually set permissions.

ryantm/agenix/blob/e543aa7d68f222e1e771165da9e9a64b5bf7b3e3/modules/age.nix#L62


      
              Age file the secret is loaded from.
            '';
          };
          path = mkOption {
            type = types.str;
            default = "/run/secrets/${config.name}";
            description = ''
              Path where the decrypted secret is installed.
            '';
          };
          mode = mkOption {
            type = types.str;
            default = "0400";
            description = ''
              Permissions mode of the in octal.
            '';
          };
          owner = mkOption {
            type = types.str;
            default = "0";
            description = ''

and it defaults to 0400 !