Alternative script to manage encrypted files

[jcszymansk]

Hi,

As much as I love agenix, I never really liked the secrets.nix file and the workflow it requires. After several abortive attempts to populate it from my flakes' configuration, I decided to try another approach.

So here it is. The main idea is that configurations, and thus secrets, are usually somehow grouped, say systems/linux/hostX, hostY etc. and most if not all secrets on hostX will share the same decryption key, but also that key will not necessarily be the same that is used where the configuration is maintained. So here's where it would look for public keys to encrypt the systems/linux/hostX/secret.txt.age file:

systems/linux/hostX/.secret.txt.agekey
systems/linux/hostX/.agekey
systems/linux/.agekey
systems/.agekey
.agekey
.agemaster

Not all of these files need to exist and .agemaster may be empty, any keys found will be used and at least one key must be there; I myself have the hosts' ssh key in hostname/.agekey and my own in .agemaster, the identity being .ssh/id_ed25519. Each of those files can also contain more keys, one per line.

Operations now supported are:

  cat <file>        Decrypt <file> and print it to stdout
  add <src> <dst>   Encrypt <src> and store it in <dst>
  edit <file>       Decrypt <file> to a temporary file and open it in an editor
  keys <dst>        Show the keys that would be used to encrypt <dst> (see below)
  rekey [<dst>]     Re-encrypt (see below)
  list [<dir>]      List all encrypted files (see below)
  help              Show this help message

It is available here, it can be also run without installing via the flake: nix run github:jacekszymanski/nur-packages#manage -- help.

That's it. It's now "works for me pre-alpha", usual warnings etc., but I'm using it for all my configurations now and didn't have to restore anything from backup so far, so it might work for someone else too. :-)

[n8henrie]

Cool, thanks for the share! I'm going to close the issue, but I wonder if we should open discussions (or maybe they're already open? On mobile).

EDIT: oh geez, this is a discussion already! Sorry, thanks for the share!

[cole-h]

There are also these tools:

• https://github.com/cole-h/agenix-cli (oh hey, look who wrote it 😆 )
• https://github.com/yaxitech/ragenix

(from #23)