Nix only uses GH tokens when running as root

Help
1

I have a a GH token configured via the usual:

    extraOptions = ''
      !include ${config.age.secrets.nix-tokens.path}
    '';

But nix only appears to use it when running, v.g nix update, as root via sudo.

I am sure it’s me holding it wrong, I just don’t know how! :sweat_smile:

Thanks in advance!

2

Which user has access to that secret? I’m sure you’ll find that it’s only root-accessible.

1 Like
3

by default secrets are 400 and root owned, if you need different permissions you have to be explicit when creating the secret.

something like this should do:

age.secrets.nix-tokens = {
    file = ../secrets/nix-tokens.age; # or whatever location it lives at.
    mode = "444";
    owner = "root";
    group = "root";
  };
1 Like
4

Thank you both @waffle8946 and @NobbZ for your input, it was spot on.

The permissions were constrained to 0400. Making the file accessible to everyone solved the issue. But I thought the nix-daemon process ran as root and thus had access to that file just fine despite my user not.

Is it then possible to have separate tokens for different users (ideally configured declaratively)? :thinking:

Anyway, thanks again. :slight_smile:

5

the deamon runs as root, though the deamon only orchestratest the builds, it does not evaluate the expression at hand.

But indeed, you can have per user nix config, which also can contain the tokens.

This is how I deal with it via HM per user.

2 Likes