There are a number of different approaches available for NixOS users to handle secrets. The most popular tend to be git-crypt, agenix and sops-nix. But which one should you use?
To hopefully help you in answering this question for yourself, here is an overview of a few common use cases and what I think is most appropriate for each.
Managing Your Own Physical Machines Maybe you have a desktop, a Macbook and a Raspberry Pi which you are managing from a single NixOS flake repo.
Isn’t sops / agenix basically the same thing except instead of you manually putting the secret in foo/secret it’s stored encrypted in the Git repo and then it automatically decrypts it at execution time into /var/wherever?
I’ve spent a significant amount of time over the past two weeks evaluating the differences and pros/cons between agenix and sops-nix. And a bit of time looking over your wall of text.
The reality is that your thinking/comic is completely backwards.
Isn’t sops / agenix basically the same thing except instead of you manually putting the secret in foo/secret it’s stored encrypted in the Git repo and then it automatically decrypts it at execution time into /var/wherever?
No?
I’ve spent a significant amount of time over the past two weeks evaluating the differences and pros/cons between agenix and sops-nix. And a bit of time looking over your wall of text.
The reality is that your thinking/comic is completely backwards.