`nixos-anywhere` and private repo for `sops-nix`

Help
1

I have a private GitHub repo that I call nix-secrets, which contains my sops files (i.e. .sops.yaml and some secret files). Currently I pass this as an input to my nix-config. This setup has so far worked quite nicely: I have an age key on my MacBook and can encrypt/decrypt secrets as needed during builds, etc.

I would now like to use nixos-anywhere to install my config on a vm/remote server/etc. and as part of that also access my nix-secrets, in which the user-passwords for those machines are configured. My nixos-anywhere command looks something like this

nix run github:nix-community/nixos-anywhere --                   \
       --flake '.#hostname'                                      \
       --build-on-remote                                         \
       --build-on remote                                         \
       --disk-encryption-keys disko_key_local disko_key_remote   \
       --target-host root@hostname

During evaluation/build it will try to decrypt the nix-secrets but ofc. the remote machine does not have any secrets since it’s an empty NixOS installer boot.

It seems that the solution is to use the --extra-files flag when running nixos-anywhere to pass public and private ssh-keys to the installer, which are part of the sops setup…

Is this a good idea, safe to do? Do I need to take care of anything else? Is it recommended to have a separate key for just this purpose?

2

With remote machine you mean the kexec-installer? This does not need to decrypt the secrets at any point in time, sops-nix does not need to decrypt those for eval or build purpose.

Did you stumbled across nixos-anywhere/docs/howtos/secrets.md at ff87db6a952191648ffaea97ec5559784c7223c6 · nix-community/nixos-anywhere · GitHub yet?

The extra-files will be copied over to the freshly installed system making activation of sops-nix possible (e.g. age keys were copied over).

3

Ah, your link did the trick. Did not see that page, sorry and thanks for this!

1 Like