feat(sops): bring up sops-nix, read fj fallback forge host from encrypted secret#86
Merged
Conversation
…pted secret fj resolves its instance from the cwd git remote and, failing that, from FJ_FALLBACK_HOST. The forge host URL is private, so instead of a plaintext nix-store literal it now lives in a SOPS-encrypted secret: - flake input sops-nix (nixpkgs follows) - .sops.yaml with the personal age recipient (public key only) - secrets/secrets.enc.yaml holding fj-fallback-host - modules/user/sops: home-manager sops-nix bring-up (age keyFile, default sops file); secrets decrypt via launchd agent at login - modules/user/git: declares the secret and exports FJ_FALLBACK_HOST in zsh init by reading the decrypted file at runtime
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Brings SOPS-encrypted secrets to the dotfiles via sops-nix's home-manager module, and uses it for the first secret: the
fj(forgejo-cli) fallback forge host.Why
fjresolves its target instance from the cwd's git remote and, failing that, from theFJ_FALLBACK_HOSTenv var (resolution order, confirmed by the maintainer in forgejo-cli#444). Without the fallback, every command outside a repo with a forge remote needs-H <host>.The forge host URL is private, so it can't be a plaintext literal in nix code (anything in
home.sessionVariableslands world-readable in the nix store). It now lives only inside a SOPS-encrypted file.How
flake.nix:sops-nixinput (nixpkgsfollows);...added to the outputs destructure.sops.yaml: personal age recipient (public key only)secrets/secrets.enc.yaml: encrypted payload holdingfj-fallback-hostmodules/user/sops/: generic bring-up — imports the sops-nix HM module, pointsage.keyFileat the local age key; secrets decrypt once per login via launchd agent to a user-owned 0400 filemodules/user/git/: declares the secret next topkgs.forgejo-cliand exportsFJ_FALLBACK_HOSTin zsh init by reading the decrypted file at runtimeVerified
darwin-rebuild buildpassesswitch: launchd agentorg.nix-community.home.sops-nixexits 0, secret decrypted with mode 0400fj whoamisucceeds with no-HNote: the export runs in
.zshrc, so non-interactive shells don't get the var — acceptable for interactive CLI use; move to.zshenvlater if scripts ever need it.