security.nix-secrets.enable
Whether to enable nix-secrets integration.
Type: boolean
Default:
false
Example:
true
Declared by:
security.nix-secrets.package
nix-secrets package used by activation scripts and services.
It can also be installed into the system by enabling
security.nix-secrets.installPackage, which is enabled by default.
Type: package
Default:
<derivation nix-secrets-0.4.0>
Declared by:
security.nix-secrets.activate.enable
Whether to enable automatic activation of nix-secrets secrets and templates.
Type: boolean
Default:
true
Example:
false
Declared by:
security.nix-secrets.activate.command
Command used to activate nix-secrets secrets and templates.
The function receives whether it should activate secrets and templates
with neededForUsers enabled and returns the command to execute.
Type: function that evaluates to a(n) string
Default:
neededForUsers: "${lib.getExe cfg.package} activate ${builtins.toJSON "nix-secrets-manifest.json" cfg.manifest} --needed-for-users ${lib.boolToString neededForUsers}"
Declared by:
security.nix-secrets.activate.method
Method used to activate nix-secrets secrets and templates.
The systemd method uses systemd services, while the activationScripts
method uses the system activation scripts mechanism.
The systemd method requires systemd.sysusers.enable or
services.userborn.enable to be enabled. It does not work correctly for
secrets and templates with neededForUsers enabled without one of these options.
Type: one of “systemd”, “activationScripts”
Default:
if config.systemd.sysusers.enable or false || config.services.userborn.enable or false
then "systemd"
else "activationScripts"
Example:
"systemd"
Declared by:
security.nix-secrets.ciMode.enableDangerously
Whether to enable insecure CI mode options.
This option enables features that may weaken secret protection and should only be used in disposable CI environments or isolated test environments.
Type: boolean
Default:
false
Declared by:
security.nix-secrets.ciMode.debugPackage
Whether to use a debug build of security.nix-secrets.package.
The debug build enables additional logging.
Type: boolean
Default:
false
Declared by:
security.nix-secrets.ciMode.storePathIdentities
Whether to allow identity files stored in the Nix store.
Identity files should not normally be stored in the Nix store because its contents are world-readable and therefore unsuitable for keeping confidential information.
Type: boolean
Default:
false
Declared by:
security.nix-secrets.ciMode.usePlaceholders
Whether to use placeholder values instead of decrypted secrets.
This is intended for CI and testing environments where real secret values are not available or should not be used.
Type: boolean
Default:
false
Declared by:
security.nix-secrets.defaultRecipients
Recipients automatically added to every secret.
Entries may be age recipients, SSH public keys, or aliases defined in
security.nix-secrets.recipientAliases.
To override this list for a specific secret, use lib.mkForce.
Type: list of string
Default:
[ ]
Example:
[ config.networking.hostname "someAlias" "age1nr6qkv2y49g5pvkswskyy3nzazsp9wy3gxyxzxlutqgq2ejec4xqpmjzh5" ]
Declared by:
security.nix-secrets.extraPackages
Additional packages made available to nix-secrets during activation scripts and services.
This is primarily intended for age plugins such as pkgs.age-plugin-yubikey.
Type: list of package
Default:
[ ]
Example:
[ pkgs.age-plugin-yubikey ]
Declared by:
security.nix-secrets.generatorBuildCommand
Command used by the nix-secrets CLI to build secret generators.
The command must contain the {{input}} placeholder, which is replaced with
the derivation path of the generator.
Type: null or string
Default:
"${config.nix.package}/bin/nix-store --realise {{input}}"
Declared by:
security.nix-secrets.generators
Predefined secret generators referenced by name from
security.nix-secrets.secrets.<name>.generator.
Each generator is a function that accepts an attribute set of arguments and returns a package or a generator specification.
A generator without arguments can be referenced by name:
generator = "uuid";
A generator with arguments can be referenced using an attribute set:
generator.uuid = {
count = 5;
raw = true;
};
Type: attribute set of ((function that evaluates to a(n) (string or package or (attribute set))) or (string or function that evaluates to a(n) (string or package or (attribute set))) convertible to it)
Default:
{ }
Example:
{
password =
{ length ? 32 }:
pkgs.writeShellScriptBin "generate-password" ''
head -c ${toString length} /dev/urandom | base64
'';
uuid = {}: pkgs.writeShellScriptBin "generate-uuid" ''
uuidgen
'';
}
Declared by:
security.nix-secrets.identityPaths
Paths to identity files used for secret encryption and decryption.
For security reasons, identity files are kept outside of the Nix store.
Type: list of path not in the Nix store
Default:
[ ]
Example:
[
"/home/user/keys.txt"
"/home/user/.ssh/id_ed25519"
]
Declared by:
security.nix-secrets.installPackage
Whether to enable installation of security.nix-secrets.package into environment.systemPackages.
Type: boolean
Default:
true
Example:
false
Declared by:
security.nix-secrets.nixEvalCommand
Command used by the nix-secrets CLI to evaluate the
security.nix-secrets.manifest option.
The command must contain the {{input}} placeholder, which is replaced with
the flake reference provided to the CLI followed by the manifest option path.
Type: null or string
Default:
"${lib.getExe config.nix.package} --extra-experimental-features 'nix-command flakes' eval --raw {{input}}"
Declared by:
security.nix-secrets.recipientAliases
Recipient aliases used when defining secret recipients.
An alias may refer to one or more recipients or to other aliases. Alias references are resolved recursively. Cyclic references result in an evaluation error.
Type: attribute set of ((list of string) or (string or list of string) convertible to it)
Default:
{ }
Example:
{
all = [
"pc"
"server"
];
pc = "age14e2jdmau7tpau9emcn6gmg26vfl0uyf6cfd9lz85jml6ttv9wq2qphps4t";
server = [
"age1ls5m8ml8cdu202xakl56lspqrccgln4kfx8q7c6v7qdex92xryhs03v6re"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEuUsB0HH//1qkvgQMWTEoNd0riZpk+8A5w1Ep2vGKk0"
];
}
Declared by:
security.nix-secrets.secrets
Secrets managed by nix-secrets.
Type: attribute set of (submodule)
Default:
{ }
Declared by:
security.nix-secrets.secrets.<name>.generator
Package used to generate the secret.
Can be either:
- a derivation,
- a generator name from
config.security.nix-secrets.generators, - an attribute set with a single attribute, where the attribute name selects
a generator from
config.security.nix-secrets.generatorsand its value is passed to that generator, - an attribute set containing
derivationand optionallyexecutable.derivationcan be either a derivation or a path to a.drvfile.executablecan be either a derivation or a path to an executable file.
Type: null or (attribute set) or absolute path or string
Default:
null
Declared by:
security.nix-secrets.secrets.<name>.group
Group of the file created at path.
May be specified as either a group name or a numeric GID.
Cannot be set when neededForUsers is enabled because users and groups are
not available at this stage of activation. In this case, the file group is
set to root.
Type: signed integer or string
Default:
0
Example:
"users"
Declared by:
security.nix-secrets.secrets.<name>.mode
Permissions of the file created at path.
Type: string
Default:
"0400"
Example:
"0660"
Declared by:
security.nix-secrets.secrets.<name>.name
Secret name used as its path in the storage.
For example, the secret named "forgejo/token" is stored as
forgejo/token.enc in the storage.
Type: string
Default:
"‹name›"
Example:
"forgejo/token"
Declared by:
security.nix-secrets.secrets.<name>.neededForUsers
Whether the secret must be available before users and groups are created.
Enable this for secrets referenced before or during user creation, such as
users.users.<name>.hashedPasswordFile.
Type: boolean
Default:
false
Example:
true
Declared by:
security.nix-secrets.secrets.<name>.owner
Owner of the file created at path.
May be specified as either a user name or a numeric UID.
Cannot be set when neededForUsers is enabled because users and groups are
not available at this stage of activation. In this case, the file owner is
set to root.
Type: signed integer or string
Default:
0
Example:
"forgejo"
Declared by:
security.nix-secrets.secrets.<name>.path
Path where the decrypted secret will be mounted.
By default, the secret is mounted under “/run/nix-secrets”, or under
“/run/nix-secrets-for-users” when neededForUsers is enabled.
Secrets using the default paths are activated atomically together. When a custom path is specified, secrets are updated individually and atomicity is only guaranteed for each individual secret.
Type: string
Default:
"/run/nix-secrets/secrets/‹name›"
Example:
"/var/lib/forgejo/token"
Declared by:
security.nix-secrets.secrets.<name>.placeholder
Placeholder content used instead of decrypting secret.
This option exists for CI and testing purposes. It replaces the decrypted
secret only when security.nix-secrets.ciMode.usePlaceholders is enabled.
It must not be used for real secrets.
Type: absolute path or (string or absolute path) convertible to it
Default:
"REPLACE WITH YOUR SECRET"
Example:
"insecurePassword"
Declared by:
security.nix-secrets.secrets.<name>.recipients
Recipients allowed to decrypt the secret.
Entries may be age recipients, SSH public keys, or aliases defined in
security.nix-secrets.recipientAliases.
Type: list of string
Default:
[ ]
Example:
[
"alias"
"age1ls5m8ml8cdu202xakl56lspqrccgln4kfx8q7c6v7qdex92xryhs03v6re"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEuUsB0HH//1qkvgQMWTEoNd0riZpk+8A5w1Ep2vGKk0"
]
Declared by:
security.nix-secrets.secrets.<name>.templateKey
Placeholder string used to reference this secret in templates.
Type: string (read only)
Default:
"{{NIX_SECRETS-${builtins.hashString "sha256" config.name}}}"
Example:
"{{NIX_SECRETS-2bb80d537b1da3e38bd30361aa855686bde0eacd7162fef6a25fe97bf527a25b}}"
Declared by:
security.nix-secrets.storage
Path to the nix-secrets storage.
The path is used by activation scripts and services and must be specified as a path
rather than a relative path string. For example, use ./storage instead
of "./storage".
For improved security, it is recommended to keep the storage in a private repository and reference it through a flake input.
Type: absolute path
Example:
inputs.my-secrets + /storage
Declared by:
security.nix-secrets.storagePath
Default storage path used by the nix-secrets CLI.
The path must be absolute and outside of the Nix store.
When set, the CLI does not require the --storage argument.
Type: null or absolute path not in the Nix store
Default:
null
Example:
"/etc/nixos/secrets"
Declared by:
security.nix-secrets.templates
Templates managed by nix-secrets.
Type: attribute set of (submodule)
Default:
{ }
Declared by:
security.nix-secrets.templates.<name>.content
Template content. May be either a string or a path to file.
Secret references can be inserted using
security.nix-secrets.secrets.<name>.templateKey or by converting a secret
option to a string: "${security.nix-secrets.secrets.<name>}".
References are replaced with the corresponding secret values when the template is activated.
Type: absolute path in the Nix store or (string or absolute path in the Nix store) convertible to it
Example:
''
NAME="Git Server"
TURNSTILE_SECRET="''${config.security.nix-secrets.secrets."forgejo/turnstile/secret"}"
TURNSTILE_SITEKEY="''${config.security.nix-secrets.secrets."forgejo/turnstile/sitekey"}"
''
Declared by:
security.nix-secrets.templates.<name>.group
Group of the file created at path.
May be specified as either a group name or a numeric GID.
Cannot be set when neededForUsers is enabled because users and groups are
not available at this stage of activation. In this case, the file group is
set to root.
Type: signed integer or string
Default:
0
Example:
"users"
Declared by:
security.nix-secrets.templates.<name>.mode
Permissions of the file created at path.
Type: string
Default:
"0400"
Example:
"0660"
Declared by:
security.nix-secrets.templates.<name>.name
Template name used as part of the default path.
Type: string
Default:
"‹name›"
Example:
"forgejo/env"
Declared by:
security.nix-secrets.templates.<name>.neededForUsers
Whether the template must be available before users and groups are created.
Enable this for templates referenced before or during user creation.
Type: boolean
Default:
false
Example:
true
Declared by:
security.nix-secrets.templates.<name>.owner
Owner of the file created at path.
May be specified as either a user name or a numeric UID.
Cannot be set when neededForUsers is enabled because users and groups are
not available at this stage of activation. In this case, the file owner is
set to root.
Type: signed integer or string
Default:
0
Example:
"forgejo"
Declared by:
security.nix-secrets.templates.<name>.path
Path where the rendered template file will be mounted.
By default, the template is mounted under “/run/nix-secrets/templates”, or under
“/run/nix-secrets-for-users/templates” when neededForUsers is enabled.
Templates using the default paths are activated atomically together. When a custom path is specified, templates are updated individually and atomicity is only guaranteed for each individual secret.
Type: string
Default:
"/run/nix-secrets/templates/‹name›"
Example:
"/var/lib/forgejo/.env"
Declared by: