Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feature: add an option to output secrets in armor #276

Open
wants to merge 8 commits into
base: main
Choose a base branch
from

Conversation

dlubawy
Copy link

@dlubawy dlubawy commented Jul 25, 2024

This solves #269.

Summary: Age implementations support an --armor flag to output encrypted secrets in a PEM format that is human readable. This is useful for storing secrets in git as it makes diffs easier to view. This PR adds the ability to configure this option within the secrets.nix file as such:

{
  "secret1.age" = {
    publicKeys = "age1s4ks3q07t7vawcj4l8uvxvuft0paqwz8wr5f7dgt3ma9ah2nucgsfke7th";
    armor = true;
  };
}

Copy link
Contributor

@fzakaria fzakaria left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me; might want to augment the docs with an example;
might be good to articulate that the benefit to this is you'll store non-binary files in Git

I think a benefit is Git's packfile format handles text better than binary?
(git diff is also a little easier to use)

@DerRockWolf
Copy link

It would be nice if one could also enable armoring on a global level, or are there any downsides when doing this with all secrets? 🤔

@dlubawy
Copy link
Author

dlubawy commented Jul 31, 2024

@fzakaria, I made changes based on your suggestions. Let me know if I should change anything else, or if I should reword the doc edits.

Copy link
Contributor

@fzakaria fzakaria left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice! 🎆 the test is sweet too.

Looks good to me; I'm not a maintainer though.
Let's see what @ryantm thinks.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants