search

Mic92 / sops-nix

Atomic secret provisioning for NixOS based on sops
MIT License
1.62k stars 155 forks source link

Have a systemd target to indicate successful decryption? #217

Open bjornfor opened 2 years ago

bjornfor commented 2 years ago

Hi, I recently started using sops-nix and I'm very happy with it.

However, one thing that bothered me today is I found I had forgotten to add keys for a machine I deployed to and the only indication it didn't work was this log output in the journal:

Aug 07 11:43:50 router stage-2-init: running activation script...
Aug 07 11:43:50 router stage-2-init: setting up /etc...
Aug 07 11:43:50 router stage-2-init: setting up secrets...
Aug 07 11:43:50 router stage-2-init: sops-install-secrets: Imported /etc/ssh/ssh_host_rsa_key as GPG key with fingerprint d2411f16aadd8e571a33a3457cfd5ea65672c891
Aug 07 11:43:50 router stage-2-init: sops-install-secrets: Imported /etc/ssh/ssh_host_ed25519_key as age key with fingerprint age1gl894t4k9wpyljcymqgye3nl6pn0c8tykuprulmprsqa5wc2mdzqsfq52v
Aug 07 11:43:50 router stage-2-init: /nix/store/935f3w8131d4v573766xxid7mdz1q9gf-sops-install-secrets-0.0.1/bin/sops-install-secrets: Failed to decrypt '/nix/store/ijlzpzv97nxjgl2khxvi0jbhgnphp5mr-sops.yaml': Error getting data key: 0 suc>
Aug 07 11:43:50 router stage-2-init: Activation script snippet 'setupSecrets' failed (1)

I was hoping to find some unit error in systemd --failed, but there is none.

Is there anything sops-nix can/should do to indicate to systemd that it failed to decrypt the secrets? Or is that impossible since it's implemented as a NixOS activation scripts? Perhaps this should be seen as a general issue with NixOS activation scripts?

Mic92 commented 2 years ago

Since it's implemented as an activation script, this seems hard. We could somehow write a state file that makes a service fail.

bjornfor commented 1 year ago

Any thoughts on what the state file should look like?

Here's an idea (JSON):

{
  "exit_code": 1,   # definitely a field like this must exist
  "stderr": ...,    # could be used to forward error message to the service?
  "stdout": ...
}

I guess the format doesn't need to be very stable, only the sops-nix service should know about it.

bjornfor commented 1 year ago

Or is this something that is better implemented in NixOS, for example nixos-activation-scripts.service, that indicates success/failure for all activation scripts combined?

Mic92 commented 1 year ago

Or is this something that is better implemented in NixOS, for example nixos-activation-scripts.service, that indicates success/failure for all activation scripts combined?

Sounds like a good idea.

bjornfor commented 1 year ago

PR to implement this: https://github.com/NixOS/nixpkgs/pull/208942

SuperSandro2000 commented 1 year ago

Since it's implemented as an activation script

Wouldn't it be a better idea to implement it via a systemd service? Then secrets could also survive a soft-reboot.