{"repo":"ryantm/agenix","free":true,"listed":false,"github":"https://github.com/ryantm/agenix","clone":"git clone https://github.com/ryantm/agenix.git","description":"age-encrypted secrets for NixOS and Home manager","language":"Nix","stars":2462,"topics":["nixos","encryption"],"license":"CC0-1.0","category":"security-tools","readme_excerpt":"agenix - age-encrypted secrets for NixOS agenix is a small and convenient Nix library for securely managing and deploying secrets using common public-private SSH key pairs: You can encrypt a secret (password, access-token, etc.) on a source machine using a number of public SSH keys, and deploy that encrypted secret to any another target machine that has the corresponding private SSH key of one of those public keys. This project contains two parts: 1. An agenix commandline app (CLI) to encrypt secrets into secured .age files that can be copied into the Nix store. 2. An agenix NixOS module to conveniently add those encrypted secrets ( .age files) into the Nix store so that they can be deployed like any other Nix package using nixos-rebuild or similar tools. automatically decrypt on a target machine using the private SSH keys on that machine automatically mount these decrypted secrets on a well known path like /run/agenix/... to be consumed. Contents Problem and solution Features Installation niv nix-channel fetchTarball flakes Tutorial Reference age module reference age-home module reference agenix CLI reference Community and Support Threat model/Warnings Contributing Acknowledgements Problem and solution All files in the Nix store are readable by any system user, so it is not a suitable place for including cleartext secrets. Many existing tools (like NixOps deployment.keys) deploy secrets separately from nixos-rebuild , making deployment, caching, and auditing more difficult. ","default_branch":null,"files":null,"tree":[],"storefront":"/r/ryantm","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/ryantm/agenix/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}