Sops-nix with SSH host key

Help
1

I was able to edit the file the first time when it didn‘t need to be decrypted before, but now I can‘t because sops doesn‘t look for the ssh host key.

The one secret I‘ve set is rolled out fine at startup or rebuild, but I get this error when trying to edit my secrets.

    - | failed to load age identities. Did not find keys in
      | locations 'SOPS_AGE_SSH_PRIVATE_KEY_FILE',
      | 'SOPS_AGE_SSH_PRIVATE_KEY_CMD', '/root/.ssh/id_ed25519',
      | '/root/.ssh/id_rsa', 'SOPS_AGE_KEY', 'SOPS_AGE_KEY_FILE',
      | 'SOPS_AGE_KEY_CMD', and '/root/.config/sops/age/keys.txt'.

It should also look at /etc/ssh/ssh_host_ed25519_key .

I could set “SOPS_AGE_SSH_PRIVATE_KEY_FILE” but I‘d like to avoid that.

Any ideas?

2

Add the pubkey of a user SSH key to the yaml so it can be keyed against multiple keys. You can do your user if you don’t want to have to use sudi to modify secrets.

2 Likes
3

Since this is a server I don‘t have user keys on there yet, is there a way I can use my ssh client key?

Or is there any simpler way forward? Maybe I‘ll just have to set the env var in my nixos config.

Also since this is a server I don‘t want my user account to be able to access secrets without password so I‘d prob do it with root anyway.

4

You fundamentally need a key intended for editing the sops secrets. Your client’s ssh key can be used with key forwarding, I believe.

That said, the intent is to develop your server’s configuration on another host, where you have access to a key with permissions to encrypt/decrypt those secrets, and to push the resulting sops file to the server, which can decrypt it later.

You can use the --target-host flag, or a tool like deploy-rs, to push your configuration to a remote server.

1 Like
5

Well I went with the approach to set SOPS_AGE_KEY_FILE in my HM config and edit with “sudo -E sops secrets.yaml”.
My current workflow works around local rebuilds on the servers.