- Notifications
You must be signed in to change notification settings - Fork137
Add a integration where the sudo password can be specified in a sops encrypted file#324
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
base:master
Are you sure you want to change the base?
Uh oh!
There was an error while loading.Please reload this page.
Conversation
…either interactive_sudo or sops decryption is used
cinderisles commentedSep 5, 2025 • edited
Loading Uh oh!
There was an error while loading.Please reload this page.
edited
Uh oh!
There was an error while loading.Please reload this page.
@weriomat I tried your fork on the master branch and kept running into an issue with parsing the sops YAML file in my case, my secrets.yaml looks like this userPassword:some-password-hash# for use with hashedPasswordFile to set the password for another userdeployPassword:some password This caused an error parsing the Your example yaml like below worked, but that error would happen if I tried to add anything else password:deploy:something Seems like check-jsonschema usesthis for JSON schema, so I just changed the type for This one commit in my fork seems to be enough to fix it based on my testing |
weriomat commentedSep 8, 2025
Thank you for investigating this fix, I will update |
As I use sudo on my machines (to elevate the privileges from the "deploy" user) and don't want to manually type the sudo password every time I run a deployment, I implemented a solution where the password is retrieved from a sops encrypted file.
This is especially nice since I usesops-nix to set the password of the user and now can reuse this fact to run the deployment.
In particular, we need to specify
sudoFileas well assudoSecretfor a node.I introduced a NixOS test for this use case as well as provided an example and explained on how
sudoSecretsworks.Currently, the only drawback I see with this approach is that
SOPS_AGE_KEY_FILE(sops will look for age private keys under$XDG_CONFIG_HOME/sops/age/keys.txtby default) will not be respected by this implementation and therefore forcing users to put the keys under the aforementioned directory (I have not tested that it won't work, but I assume that).P.S. The flake under
example/sopscurrently points to my fork and should be changed when this gets merged :)