Skip to content

Commit 702347c

Browse files
weriomatweriomat
committed
chore: add an example on how to use the sops feature
1 parent 830f634 commit 702347c

File tree

11 files changed

+305
-0
lines changed

11 files changed

+305
-0
lines changed

‎examples/sops/.sops.yaml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
keys:
2+
- &primary age179s8jnppgy9kwakmva8av6frpnhgg9myrvk3xlfpanmhvvzyh96sdygfcm
3+
creation_rules:
4+
- path_regex: passwords.yaml
5+
key_groups:
6+
- age:
7+
- *primary

‎examples/sops/README.md

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# Example NixOS system deployment where password is passed via sops
2+
3+
This is an example of how to use the sops integration for deploy-rs.
4+
5+
To decrypt the password manually use `SOPS_AGE_KEY_FILE=$(pwd)/age_private.txt sops -d passwords.yaml`.
6+
Note that sops will try to search for the private key for age in `$XDG_CONFIG_HOME/sops/age/keys.txt` by default,
7+
but this can be overridden with `SOPS_AGE_KEY_FILE`. For more information please see the [sops documentation](https://getsops.io/docs/#encrypting-using-age).
8+
9+
1. Run bare system from `.#nixosConfigurations.sops`
10+
11+
- `nix build .#nixosConfigurations.sops.config.system.build.vm`
12+
- `QEMU_NET_OPTS=hostfwd=tcp::2221-:22 ./result/bin/run-sops-vm`
13+
- you can manually ssh into the machine via `ssh deploy@localhost -p 2221 -i ./hello_ed25519`
14+
15+
2. Develop the devshell via `nix develop .` to get sops, age and `deploy` added to $PATH
16+
3. Run via `deploy .` to deploy the "new" Configuration updated
17+
4. ???
18+
5. PROFIT!!!

‎examples/sops/age_private.txt

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# created: 2025-06-05T11:36:08+02:00
2+
# public key: age179s8jnppgy9kwakmva8av6frpnhgg9myrvk3xlfpanmhvvzyh96sdygfcm
3+
AGE-SECRET-KEY-1L8HTRL2THGGZLXQQDTDLDG0U8EL4RSSAMVT9RYUG5JWPUJW49N9QS0EFSZ

‎examples/sops/age_public.txt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
age179s8jnppgy9kwakmva8av6frpnhgg9myrvk3xlfpanmhvvzyh96sdygfcm

‎examples/sops/configuration.nix

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
{ pkgs, ... }:
2+
{
3+
networking.hostName = "sops";
4+
nix.settings = {
5+
# allow the `deploy` user to push unsigned NARs
6+
allowed-users = [ "deploy" ];
7+
trusted-users = [ "deploy" ];
8+
};
9+
10+
# setup a user for the deployment
11+
users.users.deploy = {
12+
isNormalUser = true;
13+
password = "heloWorld";
14+
openssh.authorizedKeys.keys = [
15+
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFnXmG3pSC8+UfmrHH0L5UtT++KqTmLp+1B3oWIJ1IBB hello@localhost"
16+
];
17+
extraGroups = [
18+
"wheel"
19+
"sudo"
20+
]; # for sudo su
21+
uid = 1010;
22+
};
23+
24+
# setup the rest of the system
25+
boot.loader = {
26+
systemd-boot.enable = true;
27+
efi.canTouchEfiVariables = true;
28+
};
29+
30+
services.openssh.enable = true;
31+
32+
nix.settings = {
33+
substituters = pkgs.lib.mkForce [ ];
34+
experimental-features = "nix-command flakes";
35+
trusted-public-keys = [ "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" ];
36+
};
37+
38+
# settings for the vm
39+
virtualisation = {
40+
useBootLoader = true;
41+
writableStore = true;
42+
useEFIBoot = true;
43+
};
44+
}

‎examples/sops/flake.lock

Lines changed: 114 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎examples/sops/flake.nix

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
{
2+
description = "Deploy a full system where the password is supplied via sops";
3+
4+
inputs = {
5+
nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
6+
deploy-rs.url = "github:weriomat/deploy-rs/sops";
7+
};
8+
9+
outputs =
10+
{
11+
self,
12+
nixpkgs,
13+
deploy-rs,
14+
...
15+
}:
16+
let
17+
system = "x86_64-linux";
18+
pkgs = import nixpkgs { inherit system; };
19+
in
20+
{
21+
nixosConfigurations = {
22+
sops = nixpkgs.lib.nixosSystem {
23+
inherit system;
24+
modules = [
25+
./configuration.nix
26+
(pkgs.path + "/nixos/modules/virtualisation/qemu-vm.nix")
27+
];
28+
};
29+
updated = nixpkgs.lib.nixosSystem {
30+
inherit system;
31+
modules = [
32+
(pkgs.path + "/nixos/modules/virtualisation/qemu-vm.nix")
33+
./configuration.nix
34+
./updated.nix
35+
];
36+
};
37+
};
38+
39+
# packages we need to inspect the encrypted files
40+
devShells.x86_64-linux.default = pkgs.mkShell {
41+
buildInputs = [
42+
deploy-rs.packages.default
43+
pkgs.sops
44+
pkgs.age
45+
];
46+
};
47+
48+
deploy.nodes.example = {
49+
sshOpts = [
50+
"-p"
51+
"2221"
52+
];
53+
hostname = "localhost";
54+
fastConnection = true;
55+
sudoFile = ./passwords.yaml;
56+
57+
profiles.system = {
58+
user = "root";
59+
sshUser = "deploy";
60+
61+
# sudo password is gotten via
62+
sudoSecret = "password/deploy";
63+
64+
# we setup ssh auth with this key, these will get merged with the settings above
65+
sshOpts = [
66+
"-i"
67+
"./hello_ed25519"
68+
];
69+
70+
path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.updated; # this is a bit hacky to get a "updated" configuration to deploy
71+
};
72+
};
73+
74+
checks = builtins.mapAttrs (system: deployLib: deployLib.deployChecks self.deploy) deploy-rs.lib;
75+
};
76+
}

‎examples/sops/hello_ed25519

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
-----BEGIN OPENSSH PRIVATE KEY-----
2+
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
3+
QyNTUxOQAAACBZ15ht6UgvPlH5qxx9C+VLU/viqk5i6ftQd6FiCdSAQQAAAJhLKSuiSykr
4+
ogAAAAtzc2gtZWQyNTUxOQAAACBZ15ht6UgvPlH5qxx9C+VLU/viqk5i6ftQd6FiCdSAQQ
5+
AAAECHxBqQ8m4mlSF5N83v6x2XxUZB1ao85TyroGq333v5v1nXmG3pSC8+UfmrHH0L5UtT
6+
++KqTmLp+1B3oWIJ1IBBAAAAD2hlbGxvQGxvY2FsaG9zdAECAwQFBg==
7+
-----END OPENSSH PRIVATE KEY-----

‎examples/sops/hello_ed25519.pub

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFnXmG3pSC8+UfmrHH0L5UtT++KqTmLp+1B3oWIJ1IBB hello@localhost

‎examples/sops/passwords.yaml

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
password:
2+
deploy: ENC[AES256_GCM,data:t8IlqzJr5v+A,iv:L3/+IQ6+gl/az3ya+rc/yFJ89vdjI6NvletIyhO5EcA=,tag:sCzIp1WvRlpLtlm/i1AXmw==,type:str]
3+
sops:
4+
age:
5+
- recipient: age179s8jnppgy9kwakmva8av6frpnhgg9myrvk3xlfpanmhvvzyh96sdygfcm
6+
enc: |
7+
-----BEGIN AGE ENCRYPTED FILE-----
8+
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTUjRhQ2pieU1XakR5eTFH
9+
elpocXhFYUVBL3p4Z0RjcDhvcEZmNEtVWkNvCngvT21NNFpSNENwVVRsemROcGRN
10+
aGJEVWhmWmI2dFQrRWw1RUhudElNMU0KLS0tIFYwUmQzLzVqVzdxSkdZTXIrMGVG
11+
ZGZ4eS82bjZvWmxRRk1wbHFsZ2RlUGcKQeaupX894rGIal5ov0MOSaRVd4OQ7muQ
12+
IkCtwZ+v2nn4xtd9MEdNur8z81civvCz907fmlKxtyk9NSLY8UP54w==
13+
-----END AGE ENCRYPTED FILE-----
14+
lastmodified: "2025-06-05T15:16:06Z"
15+
mac: ENC[AES256_GCM,data:k7mANamp8envEFkAcsbbpvw3GoffaBBI4N7S90QFIX5bxdPsMQvQ9Lddh6nJAjYX0DGBUafVn3c2C1LXTJAmHbrLoqgn5uW18AHhNhnIt9M+5zXcT9olxoMt/aDd6OucCJ0N/vQ5fuD5HfFJwoANIg+2cEONfNoubspiI+K+Y/4=,iv:9GnnM7amxpmFGVpJ4q0pwJDFuldt5bAISrTxdJS9FbU=,tag:0AGdq2+jxQpjRv7zNIXFBg==,type:str]
16+
unencrypted_suffix: _unencrypted
17+
version: 3.10.2

0 commit comments

Comments
 (0)