0xrsydn/dotfiles
1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
dotfiles/secrets/README.md

2.6 KiB
Raw Blame History

Secrets with sops-nix

This repository uses sops-nix with Home Manager. SOPS keeps encrypted values in Git. Home Manager decrypts each global environment variable to a separate runtime file under ~/.config/secrets/global-env/.

One-time setup

  1. Enter nix develop so age and sops are available.

  2. Generate or import an Age key. Home Manager can generate one during activation. You can also run:

    age-keygen -o ~/.config/sops/age/keys.txt

  3. Get the public key:

    age-keygen -y -f ~/.config/sops/age/keys.txt

  4. Add the public key as a recipient in each encrypted SOPS file.

  5. Store the private key in a secure backup such as 1Password or macOS Keychain.

Global environment secrets

The encrypted source is secrets/global-env.sops.yaml. It contains a flat map of environment variable names and encrypted values.

Home Manager declares each key in modules/darwin/home/default.nix. During activation, sops-nix writes one mode 0400 file per key:

~/.config/secrets/global-env/OPENAI_API_KEY
~/.config/secrets/global-env/ANTHROPIC_API_KEY

Zsh and Nushell read these files and export each filename as an environment variable. The loaders do not evaluate secret values as shell code.

Edit the encrypted source with:

SOPS_AGE_KEY_FILE=$HOME/.config/sops/age/keys.txt \
  sops secrets/global-env.sops.yaml

Use a flat YAML structure:

OPENAI_API_KEY: sk-...
ANTHROPIC_API_KEY: sk-ant-...
GITHUB_TOKEN: ghp_...

When you add or remove a key, also update globalEnvironmentSecretNames in modules/darwin/home/default.nix. Then apply the configuration:

darwin-rebuild switch --flake .#macbook-pro

Open a new Zsh or Nushell session after activation. Access values as follows:

print -r -- "$OPENAI_API_KEY"

$env.OPENAI_API_KEY

Do not print real secret values during routine validation. Test only whether a variable exists.

File-based secrets

Secrets that applications consume as files should stay file-based. Declare each entry under rsydn.secrets.secrets with its own path, format, and key.

For project-specific environment variables, use an encrypted project file with sops exec-env through direnv. Do not add project secrets to the global shell environment.

Rotating keys

If you replace an Age key, update the recipients:

sops updatekeys secrets/global-env.sops.yaml

Remove old recipients, then validate the configuration:

darwin-rebuild --dry-run --flake .#macbook-pro

Only encrypted SOPS files belong in Git. Never add decrypted files from ~/.config/secrets/.