Open snylonue opened 5 months ago
No you should use the NixOS module, not the HM module.
From the error, I have a suspicion that you didn't share your full config, because that error is a generic one from the module system that you get when you put attributes in the top-level module scope together with an explicit options or config attribute.
Do you by any chance have something like this?
{
sops = { ... };
config = { ... };
}
In that case you'd need to move the sops
part inside config
.
If you introduce an options
attribute, you also need to put the actual config inside config
.
That being said, I didn't test sops-nix with system-manager, so I'm not sure if it works.
No you should use the NixOS module, not the HM module.
From the error, I have a suspicion that you didn't share your full config, because that error is a generic one from the module system that you get when you put attributes in the top-level module scope together with an explicit options or config attribute.
Do you by any chance have something like this?
{ sops = { ... }; config = { ... }; }
In that case you'd need to move the
sops
part insideconfig
. If you introduce anoptions
attribute, you also need to put the actual config insideconfig
.That being said, I didn't test sops-nix with system-manager, so I'm not sure if it works.
Yes, I didn't upload the full config. I would upload a minimum reproduction if needed.
However, there are still errors if I move sops options into config, or even I import sops nixos module only. I will upload such error messages later since they may contain some more helpful information.
{
imports = [ ./../../modules/system/xray.nix ];
config = {
nixpkgs.hostPlatform = "x86_64-linux";
sops = {
age.sshKeyPaths = [ "/etc/ssh/nix-sops" ];
secrets = {
secret = {
sopsFile = ./secrets/secret.json;
format = "json";
};
};
};
# other config
};
}
After moving sops into config, I got:
Right, you'd need to add system
as an option in https://github.com/numtide/system-manager/blob/55b5f097e79b97223a60785cf76ecc48caef4885/nix/modules/upstream/nixpkgs/default.nix#L18-L27
options = {
system = lib.mkOption { type = lib.types.raw; };
services.openssh = {
enable = lib.mkOption {
type = lib.types.bool;
default = false;
};
};
};
I managed to make it work after adding such options. However, the secret file couldn't be read at runtime (and there is no /run/secrets
).
It seems that system-manager needs to handle system.activationScripts
It seems that system-manager needs to handle
system.activationScripts
A better solution would be for sops to decrypt secrets through a systemd service instead of an activation script, which is the general direction in which things are going anyway, with systemd initrd and such.
relevant: Mic92/sops-nix#39
But the pr has been opened for 3 years. Could we do something now?
Describe the bug
I'm trying to use
nix-sops
to handle some secrets, but I can't make it.To Reproduce
In flake.nix
In system/minami/default.nix
nix repl --extra-experimental-features 'flakes repl-flake' flake.nix --show-trace
Expected behavior
The configure can be built normally.
System information
latest system-manager and nix-sops
Ubuntu 22.04
Additional context
It seems that system-manager cannot use nixos modules. I'm wondering if the home-manager module can be used.