oddlama / agenix-rekey

An agenix extension adding secret generation and automatic rekeying using a YubiKey or master-identity
MIT License
190 stars 16 forks source link

Nixbld UID used for cacheDir #38

Open axelkar opened 1 month ago

axelkar commented 1 month ago

My user's UID is 1001 and I'm getting an error during agenix-rekey's Realizing 4 store paths. I modified output-derivation.nix to print out the id command, $HOME, $UID, the target hostname and the cachedir. The path after rekeyed secret: suggested to me that $UID was not working and I was right!

% agenix rekey
Collecting information about hosts. This may take a while...
    Skipping [already rekeyed] NixAx:basic-auth-pw
   Realizing 4 store paths
error: builder for '/nix/store/fkr6gdjfzj7sjxnd3sngk72a7zhd9p04-agenix-rekey-host-secrets.drv' failed with exit code 1;
       last 10 log lines:
       > calling 'envHostTargetHook' function hook 'bintoolsWrapper_addLDVars' /nix/store/pg90p34kys2famxnq7925sbgj4jrnsi8-binutils-wrapper-2.42
       > Running phase: updateAutotoolsGnuConfigScriptsPhase
       > Running phase: installPhase
       > uid=1000(nixbld) gid=100(nixbld) groups=100(nixbld)
       > Home: /homeless-shelter
       > Hostname: NixAx
       > Cache dir: /tmp/agenix-rekey.1000
       > Copying /nix/store/52k45001rb6zp5wb7pm73hiixx3zhp3q-basic-auth-pw.age...
       > At least one rekeyed secret is missing, please run `agenix rekey` again.
       >   rekeyed secret: /tmp/agenix-rekey.1000/secrets/ea01eb6bba6163729aa78d851b512f85676c97f2781c7395c2221f095b05db29-basic-auth-pw.age
       For full logs, run 'nix log /nix/store/fkr6gdjfzj7sjxnd3sngk72a7zhd9p04-agenix-rekey-host-secrets.drv'.
oddlama commented 1 month ago

Hmm interesting, it kind of makes sense that the variable is taken from the daemon. I guess you will have to override the cacheDir setting to a static path to work around this. Alternatively you can switch to the local storage mode which I introduced to remove impurities like this one, since they tend to cause issues from time to time.