Request to document installation of sops-nix utilities

[kylegentle]

The ssh-to-pgp program and sops-pgp-hook nix-shell hook are essential to follow the documented Usage example. Neither is automatically accessible from importing the NixOS module under modules/sops. For example, #29 and #43 are both related to the accessibility of ssh-to-pgp.

Under the "Create a sops file" section, the example shell.nix uses <sops-nix>, which implies that sops-nix (the expression defined in this repo's default.nix) is in the Nix search path. Simply importing the NixOS module, which is the only documented installation step, leaves users like myself with an error that sops-nix was not found in the Nix search path.

What is the recommended approach to make these utilities accessible on the machine used for setup?

For reference, here are the relevant parts of my config:

{ config, pkgs, ... }:
let
  rev = "b0d764fccdd35588ebda2907911099198f73c89a";
  sops-nix = builtins.fetchTarball {
    url = "https://github.com/Mic92/sops-nix/archive/${rev}.tar.gz";
    sha256 = "0ny2pr3qjmw9jdbr0n2sy3w76f0pxfpjc8qr7x9zmwzlwck5xpc1";
  };
in
{
  imports =
    [
      ./configuration.nix (
      ./hardware-configuration.nix
      "${sops-nix}/modules/sops"
    ];
}

[kylegentle]

One approach would be to create a shell.nix at the beginning of the Usage workflow, along the lines of:

# shell.nix
with import <nixpkgs> {};
let
  rev = "b0d764fccdd35588ebda2907911099198f73c89a";
  sops-nix = builtins.fetchTarball {
    url = "https://github.com/Mic92/sops-nix/archive/${rev}.tar.gz";
    sha256 = "0ny2pr3qjmw9jdbr0n2sy3w76f0pxfpjc8qr7x9zmwzlwck5xpc1";
  };
in
mkShell {
  # imports all files ending in .asc/.gpg and sets $SOPS_PGP_FP.
  sopsPGPKeyDirs = [ 
    "./keys/hosts"
    "./keys/users"
  ];
  # Also single files can be imported.
  #sopsPGPKeys = [ 
  #  "./keys/users/mic92.asc"
  #  "./keys/hosts/server01.asc"
  #];
  nativeBuildInputs = [
    (pkgs.callPackage sops-nix {}).sops-pgp-hook
    (pkgs.callPackage sops-nix {}).ssh-to-pgp
  ];
}

This is a bit inelegant, but it's what I'm doing while I poke around.

[Mic92]

Thanks for the feedback. In the meantime I would actually recommend to always have a .sops.yaml. That seems to work more reliable. I think I will update the pgp-hook to only import gpg keys rather than applying environment variables

[Mic92]

ssh-to-pgp is now part of nixpkgs. I added your shell.nix to the README.