Keyboard shortcuts

Press or to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

security.nix-secrets.enable

Whether to enable nix-secrets integration.

Type: boolean

Default:

false

Example:

true

Declared by:

security.nix-secrets.package

nix-secrets package used by activation scripts and services.

It can also be installed into the system by enabling security.nix-secrets.installPackage, which is enabled by default.

Type: package

Default:

<derivation nix-secrets-0.4.0>

Declared by:

security.nix-secrets.activate.enable

Whether to enable automatic activation of nix-secrets secrets and templates.

Type: boolean

Default:

true

Example:

false

Declared by:

security.nix-secrets.activate.command

Command used to activate nix-secrets secrets and templates.

The function receives whether it should activate secrets and templates with neededForUsers enabled and returns the command to execute.

Type: function that evaluates to a(n) string

Default:

neededForUsers: "${lib.getExe cfg.package} activate ${builtins.toJSON "nix-secrets-manifest.json" cfg.manifest} --needed-for-users ${lib.boolToString neededForUsers}"

Declared by:

security.nix-secrets.activate.method

Method used to activate nix-secrets secrets and templates.

The systemd method uses systemd services, while the activationScripts method uses the system activation scripts mechanism.

The systemd method requires systemd.sysusers.enable or services.userborn.enable to be enabled. It does not work correctly for secrets and templates with neededForUsers enabled without one of these options.

Type: one of “systemd”, “activationScripts”

Default:

if config.systemd.sysusers.enable or false || config.services.userborn.enable or false
then "systemd"
else "activationScripts"

Example:

"systemd"

Declared by:

security.nix-secrets.ciMode.enableDangerously

Whether to enable insecure CI mode options.

This option enables features that may weaken secret protection and should only be used in disposable CI environments or isolated test environments.

Type: boolean

Default:

false

Declared by:

security.nix-secrets.ciMode.debugPackage

Whether to use a debug build of security.nix-secrets.package.

The debug build enables additional logging.

Type: boolean

Default:

false

Declared by:

security.nix-secrets.ciMode.storePathIdentities

Whether to allow identity files stored in the Nix store.

Identity files should not normally be stored in the Nix store because its contents are world-readable and therefore unsuitable for keeping confidential information.

Type: boolean

Default:

false

Declared by:

security.nix-secrets.ciMode.usePlaceholders

Whether to use placeholder values instead of decrypted secrets.

This is intended for CI and testing environments where real secret values are not available or should not be used.

Type: boolean

Default:

false

Declared by:

security.nix-secrets.defaultRecipients

Recipients automatically added to every secret.

Entries may be age recipients, SSH public keys, or aliases defined in security.nix-secrets.recipientAliases.

To override this list for a specific secret, use lib.mkForce.

Type: list of string

Default:

[ ]

Example:

[ config.networking.hostname "someAlias" "age1nr6qkv2y49g5pvkswskyy3nzazsp9wy3gxyxzxlutqgq2ejec4xqpmjzh5" ]

Declared by:

security.nix-secrets.extraPackages

Additional packages made available to nix-secrets during activation scripts and services.

This is primarily intended for age plugins such as pkgs.age-plugin-yubikey.

Type: list of package

Default:

[ ]

Example:

[ pkgs.age-plugin-yubikey ]

Declared by:

security.nix-secrets.generatorBuildCommand

Command used by the nix-secrets CLI to build secret generators.

The command must contain the {{input}} placeholder, which is replaced with the derivation path of the generator.

Type: null or string

Default:

"${config.nix.package}/bin/nix-store --realise {{input}}"

Declared by:

security.nix-secrets.generators

Predefined secret generators referenced by name from security.nix-secrets.secrets.<name>.generator.

Each generator is a function that accepts an attribute set of arguments and returns a package or a generator specification.

A generator without arguments can be referenced by name:

generator = "uuid";

A generator with arguments can be referenced using an attribute set:

generator.uuid = {
  count = 5;
  raw = true;
};

Type: attribute set of ((function that evaluates to a(n) (string or package or (attribute set))) or (string or function that evaluates to a(n) (string or package or (attribute set))) convertible to it)

Default:

{ }

Example:

{
  password =
    { length ? 32 }:
    pkgs.writeShellScriptBin "generate-password" ''
      head -c ${toString length} /dev/urandom | base64
    '';

  uuid = {}: pkgs.writeShellScriptBin "generate-uuid" ''
    uuidgen
  '';
}

Declared by:

security.nix-secrets.identityPaths

Paths to identity files used for secret encryption and decryption.

For security reasons, identity files are kept outside of the Nix store.

Type: list of path not in the Nix store

Default:

[ ]

Example:

[
  "/home/user/keys.txt"
  "/home/user/.ssh/id_ed25519"
]

Declared by:

security.nix-secrets.installPackage

Whether to enable installation of security.nix-secrets.package into environment.systemPackages.

Type: boolean

Default:

true

Example:

false

Declared by:

security.nix-secrets.nixEvalCommand

Command used by the nix-secrets CLI to evaluate the security.nix-secrets.manifest option.

The command must contain the {{input}} placeholder, which is replaced with the flake reference provided to the CLI followed by the manifest option path.

Type: null or string

Default:

"${lib.getExe config.nix.package} --extra-experimental-features 'nix-command flakes' eval --raw {{input}}"

Declared by:

security.nix-secrets.recipientAliases

Recipient aliases used when defining secret recipients.

An alias may refer to one or more recipients or to other aliases. Alias references are resolved recursively. Cyclic references result in an evaluation error.

Type: attribute set of ((list of string) or (string or list of string) convertible to it)

Default:

{ }

Example:

{
  all = [
    "pc"
    "server"
  ];
  pc = "age14e2jdmau7tpau9emcn6gmg26vfl0uyf6cfd9lz85jml6ttv9wq2qphps4t";
  server = [
    "age1ls5m8ml8cdu202xakl56lspqrccgln4kfx8q7c6v7qdex92xryhs03v6re"
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEuUsB0HH//1qkvgQMWTEoNd0riZpk+8A5w1Ep2vGKk0"
  ];
}

Declared by:

security.nix-secrets.secrets

Secrets managed by nix-secrets.

Type: attribute set of (submodule)

Default:

{ }

Declared by:

security.nix-secrets.secrets.<name>.generator

Package used to generate the secret.

Can be either:

  • a derivation,
  • a generator name from config.security.nix-secrets.generators,
  • an attribute set with a single attribute, where the attribute name selects a generator from config.security.nix-secrets.generators and its value is passed to that generator,
  • an attribute set containing derivation and optionally executable. derivation can be either a derivation or a path to a .drv file. executable can be either a derivation or a path to an executable file.

Type: null or (attribute set) or absolute path or string

Default:

null

Declared by:

security.nix-secrets.secrets.<name>.group

Group of the file created at path.

May be specified as either a group name or a numeric GID.

Cannot be set when neededForUsers is enabled because users and groups are not available at this stage of activation. In this case, the file group is set to root.

Type: signed integer or string

Default:

0

Example:

"users"

Declared by:

security.nix-secrets.secrets.<name>.mode

Permissions of the file created at path.

Type: string

Default:

"0400"

Example:

"0660"

Declared by:

security.nix-secrets.secrets.<name>.name

Secret name used as its path in the storage.

For example, the secret named "forgejo/token" is stored as forgejo/token.enc in the storage.

Type: string

Default:

"‹name›"

Example:

"forgejo/token"

Declared by:

security.nix-secrets.secrets.<name>.neededForUsers

Whether the secret must be available before users and groups are created.

Enable this for secrets referenced before or during user creation, such as users.users.<name>.hashedPasswordFile.

Type: boolean

Default:

false

Example:

true

Declared by:

security.nix-secrets.secrets.<name>.owner

Owner of the file created at path.

May be specified as either a user name or a numeric UID.

Cannot be set when neededForUsers is enabled because users and groups are not available at this stage of activation. In this case, the file owner is set to root.

Type: signed integer or string

Default:

0

Example:

"forgejo"

Declared by:

security.nix-secrets.secrets.<name>.path

Path where the decrypted secret will be mounted.

By default, the secret is mounted under “/run/nix-secrets”, or under “/run/nix-secrets-for-users” when neededForUsers is enabled.

Secrets using the default paths are activated atomically together. When a custom path is specified, secrets are updated individually and atomicity is only guaranteed for each individual secret.

Type: string

Default:

"/run/nix-secrets/secrets/‹name›"

Example:

"/var/lib/forgejo/token"

Declared by:

security.nix-secrets.secrets.<name>.placeholder

Placeholder content used instead of decrypting secret.

This option exists for CI and testing purposes. It replaces the decrypted secret only when security.nix-secrets.ciMode.usePlaceholders is enabled. It must not be used for real secrets.

Type: absolute path or (string or absolute path) convertible to it

Default:

"REPLACE WITH YOUR SECRET"

Example:

"insecurePassword"

Declared by:

security.nix-secrets.secrets.<name>.recipients

Recipients allowed to decrypt the secret.

Entries may be age recipients, SSH public keys, or aliases defined in security.nix-secrets.recipientAliases.

Type: list of string

Default:

[ ]

Example:

[
  "alias"
  "age1ls5m8ml8cdu202xakl56lspqrccgln4kfx8q7c6v7qdex92xryhs03v6re"
  "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEuUsB0HH//1qkvgQMWTEoNd0riZpk+8A5w1Ep2vGKk0"
]

Declared by:

security.nix-secrets.secrets.<name>.templateKey

Placeholder string used to reference this secret in templates.

Type: string (read only)

Default:

"{{NIX_SECRETS-${builtins.hashString "sha256" config.name}}}"

Example:

"{{NIX_SECRETS-2bb80d537b1da3e38bd30361aa855686bde0eacd7162fef6a25fe97bf527a25b}}"

Declared by:

security.nix-secrets.storage

Path to the nix-secrets storage.

The path is used by activation scripts and services and must be specified as a path rather than a relative path string. For example, use ./storage instead of "./storage".

For improved security, it is recommended to keep the storage in a private repository and reference it through a flake input.

Type: absolute path

Example:

inputs.my-secrets + /storage

Declared by:

security.nix-secrets.storagePath

Default storage path used by the nix-secrets CLI.

The path must be absolute and outside of the Nix store.

When set, the CLI does not require the --storage argument.

Type: null or absolute path not in the Nix store

Default:

null

Example:

"/etc/nixos/secrets"

Declared by:

security.nix-secrets.templates

Templates managed by nix-secrets.

Type: attribute set of (submodule)

Default:

{ }

Declared by:

security.nix-secrets.templates.<name>.content

Template content. May be either a string or a path to file.

Secret references can be inserted using security.nix-secrets.secrets.<name>.templateKey or by converting a secret option to a string: "${security.nix-secrets.secrets.<name>}".

References are replaced with the corresponding secret values when the template is activated.

Type: absolute path in the Nix store or (string or absolute path in the Nix store) convertible to it

Example:

''
  NAME="Git Server"
  TURNSTILE_SECRET="''${config.security.nix-secrets.secrets."forgejo/turnstile/secret"}"
  TURNSTILE_SITEKEY="''${config.security.nix-secrets.secrets."forgejo/turnstile/sitekey"}"
''

Declared by:

security.nix-secrets.templates.<name>.group

Group of the file created at path.

May be specified as either a group name or a numeric GID.

Cannot be set when neededForUsers is enabled because users and groups are not available at this stage of activation. In this case, the file group is set to root.

Type: signed integer or string

Default:

0

Example:

"users"

Declared by:

security.nix-secrets.templates.<name>.mode

Permissions of the file created at path.

Type: string

Default:

"0400"

Example:

"0660"

Declared by:

security.nix-secrets.templates.<name>.name

Template name used as part of the default path.

Type: string

Default:

"‹name›"

Example:

"forgejo/env"

Declared by:

security.nix-secrets.templates.<name>.neededForUsers

Whether the template must be available before users and groups are created.

Enable this for templates referenced before or during user creation.

Type: boolean

Default:

false

Example:

true

Declared by:

security.nix-secrets.templates.<name>.owner

Owner of the file created at path.

May be specified as either a user name or a numeric UID.

Cannot be set when neededForUsers is enabled because users and groups are not available at this stage of activation. In this case, the file owner is set to root.

Type: signed integer or string

Default:

0

Example:

"forgejo"

Declared by:

security.nix-secrets.templates.<name>.path

Path where the rendered template file will be mounted.

By default, the template is mounted under “/run/nix-secrets/templates”, or under “/run/nix-secrets-for-users/templates” when neededForUsers is enabled.

Templates using the default paths are activated atomically together. When a custom path is specified, templates are updated individually and atomicity is only guaranteed for each individual secret.

Type: string

Default:

"/run/nix-secrets/templates/‹name›"

Example:

"/var/lib/forgejo/.env"

Declared by: