starred/nix-config-ryan4yin
1
0
Fork 0
mirror of https://github.com/ryan4yin/nix-config.git synced 2026-04-26 01:48:27 +02:00
Code Issues Packages Projects Releases 10 Wiki Activity

polish: README for secrets

Browse Source
This commit is contained in:
Ryan Yin
2024-08-18 15:01:13 +08:00
parent 0693713e94
commit e28c7565d7
1 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
secrets/README.md
View File

@@ -6,19 +6,19 @@
All my secrets are safely encrypted via agenix, and stored in a separate private GitHub repository All my secrets are safely encrypted via agenix, and stored in a separate private GitHub repository
and referenced as a flake input in this flake. and referenced as a flake input in this flake.
The encryption is done by using all my host's public keys(`/etc/ssh/ssh_host_ed25519_key`), so that The encryption is done using the public keys of all my hosts (`/etc/ssh/ssh_host_ed25519_key`), so
they can only be decrypted on any of my configured hosts. The host keys are generated locally on that they can only be decrypted on any of my configured hosts. The host keys are generated locally
each host by openssh without passphrase, and are only readable by `root`, and will never leave the on each host by OpenSSH without a passphrase and are only readable by `root`. The host keys will
host. never leave the host.
In this way, all secrets is still encrypted when transmitted over the network and written to In this way, all secrets are still encrypted when transmitted over the network and written to
`/nix/store`, they are decrypted only when they are finally used. `/nix/store`. They are decrypted only when they are finally used.
In addition, we further improve the security of secrets files by storing them in a separate private In addition, we further improve the security of secret files by storing them in a separate private
repository. repository.
This directory contains this README.md, and a `nixos.nix`/`darwin.nix` that used to decrypt all my This directory contains this `README.md`, and a `nixos.nix`/`darwin.nix` file that is used to
secrets via agenix, and then I can use them in this flake. decrypt all my secrets via `agenix`. Then, I can use them in this flake.
## Adding or Updating Secrets ## Adding or Updating Secrets