feat: add age plugin and fido2 hmac support #680

brianmcgee · 2024-11-23T13:52:22Z

No description provided.

Mic92 · 2024-11-23T14:57:24Z

Nice. Should we also point to your sops changes?

Mic92 · 2024-11-23T14:58:39Z

modules/sops/default.nix

+        description = ''
+          List of plugins to use for sops decryption.
+        '';
+      };


Doesn't that also require age plugin support in sops?

I don't follow.

We should probably add the fido2-hmac plugin as a default in this option though.

Do we not need sops-nix to recognise these age plugin style age keys to not fail to run, even if they are not used?

brianmcgee · 2024-11-23T15:09:07Z

Nice. Should we also point to your sops changes?

This points to my patched version of sops, which in turn relies on the patched versioned of age (purely as a lib).

brianmcgee · 2024-11-23T15:11:12Z

To be quite honest I just looked at your PR and adapted it to use my sops. Maybe there's some extra steps missing here.

Mic92 · 2024-11-23T16:13:42Z

sops-nix/go.mod

Line 8 in 53c853f

github.com/getsops/sops/v3 v3.8.1

this also needs to be replaced as far as I remember

brianmcgee · 2024-11-23T18:41:37Z

I'll have a proper look rather than just copy pasta.

OliverGeneser · 2024-12-26T09:20:50Z

@brianmcgee what is the current status?

brianmcgee · 2024-12-26T11:30:37Z

@OliverGeneser hoping to finish this during the holidays.

Ramblurr · 2024-12-29T18:28:25Z

Replying to this quote from the previous PR

@OliverGeneser you can help if you want. Rather than my pull request this should than use FiloSottile/age#591 and getsops/sops#1641 And instead of the yubikey plugin I would now actually prefer https://github.com/olastor/age-plugin-fido2-hmac because it not only works with yubikeys but all sorts of fido2 token (less vendor login)

That sounds to me like it's one or the other? Or at least a plugin needs to be explicitly supported? Is it possible to support both? For those of us already using the yubikey plugin (there are many I think because that plugin predates the FIDO2 one) that would be really great!

Edit: and thanks @Mic92 and @brianmcgee for all your efforts getting this feature supported in sops, I saw it hasn't been straightforward and also required changes to age. ❤️

SuperSandro2000 · 2025-01-01T01:32:45Z

go.mod

-go 1.18
+go 1.22
+
+toolchain go1.23.3


Please drop that otherwise go while whine about toolchaik incompatibles and create useless friction.

SuperSandro2000 · 2025-01-01T01:33:22Z

pkgs/age-fido2-hmac/default.nix

+  mkdir -p $out/bin
+  makeWrapper ${age}/bin/age $out/bin/age \
+    --prefix PATH : ${lib.makeBinPath [ age-plugin-fido2-hmac ]}
+''


We want a final newline here

SuperSandro2000 · 2025-01-01T01:33:45Z

pkgs/sops-fido2-hmac/default.nix

+  mkdir -p $out/bin
+  makeWrapper ${sops}/bin/sops $out/bin/sops \
+    --prefix PATH : ${lib.makeBinPath [ age-plugin-fido2-hmac ]}
+''


Same here and the next file

SuperSandro2000 · 2025-01-01T01:34:00Z

pkgs/sops/default.nix

+    version = "age-sops";
+
+    src = fetchFromGitHub {
+        owner = "age-sops";


That should be just two spaces

nazarewk · 2025-01-09T16:30:17Z

I'm encountering:

       error: The option `systemd.services.sops-install-secrets.environment.PATH' has conflicting definition values:
┃        - In `/nix/store/1862gdmpsaavxfkapwh1r6qdpmnpc1yl-source/nixos/modules/system/boot/systemd.nix': "/nix/store/4s9rah4cwaxflicsk5cndnknqlk9n4p3-coreutils-9.5/bin:/nix/store/jqrz1vq5nz4lnv9pqzydj0ir58wbjfy1-findutils-4.10.0/bin:/nix/store/aap6cq56amx4mzbyxp2wpgsf1kqjcr1f-gnugrep-3.11/bin:/nix/store/abm77lnrkrkb58z6xp1qwjcr1xgkcfwm-gnused-4.9/bin:/nix/store/lji0hh2…
┃        - In `/nix/store/2ryxcg9kzlm2xbvcvg19mwhpsczlr68z-source/modules/sops': "/nix/store/x2avxsab6fzc7jbwlvgr3a51mchd9cc5-age-plugin-fido2-hmac-0.2.4/bin"
┃        Use `lib.mkForce value` or `lib.mkDefault value` to change the priority on any of these definitions.

should probably be just:

systemd.services.sops-install-secrets.path = cfg.age.plugins;

I'm working around it by:

      # fix for https://github.com/Mic92/sops-nix/pull/680#issuecomment-2580744439
      # see https://github.com/NixOS/nixpkgs/blob/b33acd9911f90eca3f2b11a0904a4205558aad5b/nixos/lib/systemd-lib.nix#L473-L473
      systemd.services.sops-install-secrets.environment.PATH = let
        path = config.systemd.services.sops-install-secrets.path;
      in
        lib.mkForce "${lib.makeBinPath path}:${lib.makeSearchPathOutput "bin" "sbin" path}";
      systemd.services.sops-install-secrets.path = lib.lists.optionals (config.sops.environment ? PATH) (lib.pipe config.sops.environment.PATH [
        (lib.strings.splitString ":")
        (builtins.map (lib.strings.removeSuffix "/bin"))
      ]);

brianmcgee · 2025-01-11T17:42:32Z

I played around with this a bit over the Xmas holidays and paired with @Mic92 for a while too.

Creating secrets is easy enough with https://github.com/age-sops/sops. I can't find a good story for installing secrets though, both at a system level and a user level, with graphical sessions to add some extra spice to the mix.

The arbitrary nature of the terminal based UI's that plugins can bring into the mix complicates things even further.

Some form of unlock on system start / user login is needed. But I've reached the limits of my knowledge on this one. Happy for others to chime in.

Mic92 · 2025-01-15T22:42:29Z

I played around with this a bit over the Xmas holidays and paired with @Mic92 for a while too.

Creating secrets is easy enough with https://github.com/age-sops/sops. I can't find a good story for installing secrets though, both at a system level and a user level, with graphical sessions to add some extra spice to the mix.

The arbitrary nature of the terminal based UI's that plugins can bring into the mix complicates things even further.

Some form of unlock on system start / user login is needed. But I've reached the limits of my knowledge on this one. Happy for others to chime in.

Looks like the TPM plugin actually supports environment variables: https://github.com/Foxboron/age-plugin-tpm?tab=readme-ov-file#with-pin

Maybe the better option for machines rather than yubikeys.

brianmcgee · 2025-01-17T08:43:33Z

Looks like the TPM plugin actually supports environment variables: https://github.com/Foxboron/age-plugin-tpm?tab=readme-ov-file#with-pin

So one approach could be in your NixOS config to set a user secret which contains the PIN, and then the home-manager sops module can go from there with the TPM? I guess on a per user basis you would want to generate a separate identity with the TPM on a machine.

brianmcgee · 2025-04-01T10:14:16Z

Going to add some helpers for wrapping sops with age plugins into nixpkgs directly.

Ramblurr · 2025-04-01T10:41:51Z

@brianmcgee Could you share the nixpkgs PR here when you submit it (so I can follow it)?

brianmcgee · 2025-04-01T14:08:31Z

@Ramblurr PR is here NixOS/nixpkgs#395189

NovaViper · 2025-04-18T08:54:22Z

@brianmcgee hey now that the Nixpkg PR is merged, what else is required to get sops-nix to read the keys? I still haven't been able to make sops-nix to acknowledge anything other than the ssh age keys for secrets like user passwords.

nazarewk · 2025-04-18T09:10:28Z

@brianmcgee hey now that the Nixpkg PR is merged, what else is required to get sops-nix to read the keys? I still haven't been able to make sops-nix to acknowledge anything other than the ssh age keys for secrets like user passwords.

I'm successfully running it in my nixos configs at https://github.com/nazarewk-iac/nix-configs/tree/789882037c8c360bb18b84881c7854069e3459cc/modules/nixos/security/secrets , most of the tweaks should be under age/default.nix

NovaViper · 2025-04-18T23:40:52Z

@nazarewk Hey I pulled over the changes you made to the systemd service for sops but it still doesn't work sadly. Are you using the PR's sops-nix fork or the main sops-nix branch?

{
  config,
  lib,
  pkgs,
  inputs,
  ...
}: let
  isEd25519 = k: k.type == "ed25519";
  getKeyPath = k: k.path;
  keys = builtins.filter isEd25519 config.services.openssh.hostKeys;
in {
  imports = lib.singleton inputs.sops-nix.nixosModules.sops;

  sops = {
    defaultSopsFile = ../secrets.yaml;
    validateSopsFiles = false;
    gnupg.sshKeyPaths = [];
    age = {
      # Automatically import host SSH keys as age keys
      #sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
      sshKeyPaths = [];
      # This will use an age key that is expected  to already be in the filesystem
      #keyFile = "/var/lib/sops-nix/key.txt"; # Use age-key present on filesystem
      keyFile = "/home/novaviper/.config/sops/age/keys.txt"; # This is the yubikey public key file
      # Generate a new key if the key specified above does not exist
      generateKey = false;
    };
  };

  # fix for https://github.com/Mic92/sops-nix/pull/680#issuecomment-2580744439
  # see https://github.com/NixOS/nixpkgs/blob/b33acd9911f90eca3f2b11a0904a4205558aad5b/nixos/lib/systemd-lib.nix#L473-L473
  systemd.services.sops-install-secrets-for-users.environment.PATH = let
    path = config.systemd.services.sops-install-secrets-for-users.path;
  in
    lib.mkForce "${lib.makeBinPath path}:${lib.makeSearchPathOutput "bin" "sbin" path}";
  systemd.services.sops-install-secrets-for-users.path = with pkgs; [coreutils age-plugin-yubikey];
  systemd.services.sops-install-secrets-for-users.after = ["pcscd.socket"];
  systemd.services.sops-install-secrets-for-users.requires = ["pcscd.socket"];
}

nazarewk · 2025-04-19T06:31:47Z

Are you using the PR's sops-nix fork or the main sops-nix branch?

Looks like I'm using branch of sops-nix and main from sops, see https://github.com/nazarewk-iac/nix-configs/blob/789882037c8c360bb18b84881c7854069e3459cc/flake.nix#L62

NovaViper · 2025-04-19T15:52:33Z

Adding that made it work! 🥳 But I'm running into another issue now with the devshell. I apply the sops-nix overlay to my devshell but I get this error when it loads:

direnv: loading ~/Documents/NixConfig/.envrc
direnv: using flake
error:
       … while calling the 'derivationStrict' builtin
         at <nix/derivation-internal.nix>:37:12:
           36|
           37|   strict = derivationStrict drvAttrs;
             |            ^
           38|

       … while evaluating derivation 'nix-shell'
         whose name attribute is located at /nix/store/lfi38xy85xji8vmfjkqrq6lpy4g0sai2-source/pkgs/stdenv/generic/make-derivation.nix:438:13

       … while evaluating attribute 'nativeBuildInputs' of derivation 'nix-shell'
         at /nix/store/lfi38xy85xji8vmfjkqrq6lpy4g0sai2-source/pkgs/stdenv/generic/make-derivation.nix:490:13:
          489|             depsBuildBuild = elemAt (elemAt dependencies 0) 0;
          490|             nativeBuildInputs = elemAt (elemAt dependencies 0) 1;
             |             ^
          491|             depsBuildTarget = elemAt (elemAt dependencies 0) 2;

       (stack trace truncated; use '--show-trace' to show the full, detailed trace)

       error: infinite recursion encountered
       at /nix/store/2ryxcg9kzlm2xbvcvg19mwhpsczlr68z-source/pkgs/sops/default.nix:4:4:
            3|     fetchFromGitHub,
            4| }: sops.overrideAttrs {
             |    ^
            5|

Perhaps @brianmcgee can give some insight to why this particular issue is occurring since it appears to stem from the PR's side

Here's the accompanying commit I made to show what I have so far NovaViper/NixConfig@a2291a7

Edit: I also just noticed it doesn't work with sops on home-manager at all because the plugin support wasn't added onto the home-manager module 😭

NovaViper · 2025-04-24T04:07:10Z

I'm working on adding getting the age plugin support added into sops-nix, basing off the work started here. So far I can get sops on the system level (NixOS Module) and user level (home-manager) to decrypt the secrets upon rebuilding the system! I'm still testing the changes to see if it can activate when rebooting the system. Will create a draft PR in the meantime and link it 👍🏾

brianmcgee mentioned this pull request Nov 23, 2024

add sops-yubikey support #516

Closed

Mic92 reviewed Nov 23, 2024

View reviewed changes

feat: add age plugin and fido2 hmac support

467f85d

brianmcgee force-pushed the feat/age-plugins branch from faef2bd to 93bdb70 Compare December 31, 2024 10:48

wip

268afb1

brianmcgee force-pushed the feat/age-plugins branch from 93bdb70 to 268afb1 Compare December 31, 2024 11:11

SuperSandro2000 reviewed Jan 1, 2025

View reviewed changes

brianmcgee closed this Apr 1, 2025

NovaViper mentioned this pull request Apr 24, 2025

feat: add age plugin support, take 2 #781

Open

feat: add age plugin and fido2 hmac support #680

feat: add age plugin and fido2 hmac support #680

Uh oh!

Conversation

brianmcgee commented Nov 23, 2024

Uh oh!

Mic92 commented Nov 23, 2024

Uh oh!

Mic92 Nov 23, 2024

Choose a reason for hiding this comment

Uh oh!

brianmcgee Nov 23, 2024

Choose a reason for hiding this comment

Uh oh!

Mic92 Nov 23, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

brianmcgee commented Nov 23, 2024

Uh oh!

brianmcgee commented Nov 23, 2024

Uh oh!

Mic92 commented Nov 23, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

brianmcgee commented Nov 23, 2024

Uh oh!

OliverGeneser commented Dec 26, 2024

Uh oh!

brianmcgee commented Dec 26, 2024

Uh oh!

Ramblurr commented Dec 29, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

SuperSandro2000 Jan 1, 2025

Choose a reason for hiding this comment

Uh oh!

SuperSandro2000 Jan 1, 2025

Choose a reason for hiding this comment

Uh oh!

SuperSandro2000 Jan 1, 2025

Choose a reason for hiding this comment

Uh oh!

SuperSandro2000 Jan 1, 2025

Choose a reason for hiding this comment

Uh oh!

nazarewk commented Jan 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

brianmcgee commented Jan 11, 2025

Uh oh!

Mic92 commented Jan 15, 2025

Uh oh!

brianmcgee commented Jan 17, 2025

Uh oh!

brianmcgee commented Apr 1, 2025

Uh oh!

Ramblurr commented Apr 1, 2025

Uh oh!

brianmcgee commented Apr 1, 2025

Uh oh!

NovaViper commented Apr 18, 2025

Uh oh!

nazarewk commented Apr 18, 2025

Uh oh!

NovaViper commented Apr 18, 2025

Uh oh!

nazarewk commented Apr 19, 2025

Uh oh!

NovaViper commented Apr 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

NovaViper commented Apr 24, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Mic92 Nov 23, 2024 •

edited

Loading

Mic92 commented Nov 23, 2024 •

edited

Loading

Ramblurr commented Dec 29, 2024 •

edited

Loading

nazarewk commented Jan 9, 2025 •

edited

Loading

NovaViper commented Apr 19, 2025 •

edited

Loading