Skip to content

Commit

Permalink
home-manager: Change defaultSymlinkPath to "<xdg-config-home>/sops-ni…
Browse files Browse the repository at this point in the history
…x/secrets"
  • Loading branch information
SebTM authored and mergify[bot] committed Apr 18, 2024
1 parent 74f03c1 commit a9795d1
Show file tree
Hide file tree
Showing 2 changed files with 4 additions and 2 deletions.
4 changes: 3 additions & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -734,7 +734,9 @@ sops-nix also provides a home-manager module.
This module provides a subset of features provided by the system-wide sops-nix since features like the creation of the ramfs and changing the owner of the secrets are not available for non-root users.

Instead of running as an activation script, sops-nix runs as a systemd user service called `sops-nix.service`.
And instead of decrypting to `/run/secrets`, the secrets are decrypted to `$XDG_RUNTIME_DIR/secrets` that is located on a tmpfs or similar non-persistent filesystem.
And instead of decrypting to `/run/secrets`, the secrets are stored decrypted to `$XDG_RUNTIME_DIR/secrets` that is located on a tmpfs or similar non-persistent filesystem. Additionally secrets are symlinked to the user home-directory in the `.secrets`-directory which is used as reference
for the `.path` value in nix. Because of that, the home-manager option `home.homeDirectory` is used to determinate the home-directory on evaluation,
this has to be set manually if home-manager is used standalone or on non NixOS systems.

Depending on whether you use home-manager system-wide or using a home.nix, you have to import it in a different way.
This example shows the `flake` approach from the recommended example [Install: Flakes (current recommendation)](#Flakes (current recommendation))
Expand Down
2 changes: 1 addition & 1 deletion modules/home-manager/sops.nix
Original file line number Diff line number Diff line change
Expand Up @@ -143,7 +143,7 @@ in {

defaultSymlinkPath = lib.mkOption {
type = lib.types.str;
default = "%r/secrets";
default = "${config.xdg.configHome}/sops-nix/secrets";
description = ''
Default place where the latest generation of decrypt secrets
can be found.
Expand Down

2 comments on commit a9795d1

@firecat53
Copy link

@firecat53 firecat53 commented on a9795d1 Apr 19, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This commit seems to create the default links in XDG_CONFIG_HOME (~/.config/sops-nix/secrets) instead of XDG_RUNTIME_DIR as noted in the README. Is this intentional? Thanks!

@Mic92
Copy link
Owner

@Mic92 Mic92 commented on a9795d1 Apr 23, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes. It's intentional and the documentation is wrong now and needs to be fixed: #549 (comment)

Please sign in to comment.