feat: add age plugin and fido2 hmac support

[brianmcgee]

No description provided.

[Mic92]

Nice. Should we also point to your sops changes?

[Mic92]

Doesn't that also require age plugin support in sops?

[brianmcgee]

I don't follow.

We should probably add the fido2-hmac plugin as a default in this option though.

[Mic92]

Do we not need sops-nix to recognise these age plugin style age keys to not fail to run, even if they are not used?

[brianmcgee]

Nice. Should we also point to your sops changes?

This points to my patched version of sops, which in turn relies on the patched versioned of age (purely as a lib).

[brianmcgee]

To be quite honest I just looked at your PR and adapted it to use my sops. Maybe there's some extra steps missing here.

[Mic92]

sops-nix/go.mod

Line 8 in 53c853f

github.com/getsops/sops/v3 v3.8.1

this also needs to be replaced as far as I remember

[brianmcgee]

I'll have a proper look rather than just copy pasta.

[OliverGeneser]

@brianmcgee what is the current status?

[brianmcgee]

@OliverGeneser hoping to finish this during the holidays.

[Ramblurr]

Replying to this quote from the previous PR

@OliverGeneser you can help if you want. Rather than my pull request this should than use FiloSottile/age#591 and getsops/sops#1641 And instead of the yubikey plugin I would now actually prefer https://github.com/olastor/age-plugin-fido2-hmac because it not only works with yubikeys but all sorts of fido2 token (less vendor login)

That sounds to me like it's one or the other? Or at least a plugin needs to be explicitly supported? Is it possible to support both? For those of us already using the yubikey plugin (there are many I think because that plugin predates the FIDO2 one) that would be really great!

Edit: and thanks @Mic92 and @brianmcgee for all your efforts getting this feature supported in sops, I saw it hasn't been straightforward and also required changes to age. ❤️

[SuperSandro2000]

Please drop that otherwise go while whine about toolchaik incompatibles and create useless friction.

[SuperSandro2000]

We want a final newline here

[SuperSandro2000]

Same here and the next file

[SuperSandro2000]

That should be just two spaces

[nazarewk]

I'm encountering:

       error: The option `systemd.services.sops-install-secrets.environment.PATH' has conflicting definition values:
┃        - In `/nix/store/1862gdmpsaavxfkapwh1r6qdpmnpc1yl-source/nixos/modules/system/boot/systemd.nix': "/nix/store/4s9rah4cwaxflicsk5cndnknqlk9n4p3-coreutils-9.5/bin:/nix/store/jqrz1vq5nz4lnv9pqzydj0ir58wbjfy1-findutils-4.10.0/bin:/nix/store/aap6cq56amx4mzbyxp2wpgsf1kqjcr1f-gnugrep-3.11/bin:/nix/store/abm77lnrkrkb58z6xp1qwjcr1xgkcfwm-gnused-4.9/bin:/nix/store/lji0hh2…
┃        - In `/nix/store/2ryxcg9kzlm2xbvcvg19mwhpsczlr68z-source/modules/sops': "/nix/store/x2avxsab6fzc7jbwlvgr3a51mchd9cc5-age-plugin-fido2-hmac-0.2.4/bin"
┃        Use `lib.mkForce value` or `lib.mkDefault value` to change the priority on any of these definitions.

should probably be just:

systemd.services.sops-install-secrets.path = cfg.age.plugins;

I'm working around it by:

      # fix for https://github.com/Mic92/sops-nix/pull/680#issuecomment-2580744439
      # see https://github.com/NixOS/nixpkgs/blob/b33acd9911f90eca3f2b11a0904a4205558aad5b/nixos/lib/systemd-lib.nix#L473-L473
      systemd.services.sops-install-secrets.environment.PATH = let
        path = config.systemd.services.sops-install-secrets.path;
      in
        lib.mkForce "${lib.makeBinPath path}:${lib.makeSearchPathOutput "bin" "sbin" path}";
      systemd.services.sops-install-secrets.path = lib.lists.optionals (config.sops.environment ? PATH) (lib.pipe config.sops.environment.PATH [
        (lib.strings.splitString ":")
        (builtins.map (lib.strings.removeSuffix "/bin"))
      ]);

[brianmcgee]

I played around with this a bit over the Xmas holidays and paired with @Mic92 for a while too.

Creating secrets is easy enough with https://github.com/age-sops/sops. I can't find a good story for installing secrets though, both at a system level and a user level, with graphical sessions to add some extra spice to the mix.

The arbitrary nature of the terminal based UI's that plugins can bring into the mix complicates things even further.

Some form of unlock on system start / user login is needed. But I've reached the limits of my knowledge on this one. Happy for others to chime in.

[Mic92]

I played around with this a bit over the Xmas holidays and paired with @Mic92 for a while too.

Creating secrets is easy enough with https://github.com/age-sops/sops. I can't find a good story for installing secrets though, both at a system level and a user level, with graphical sessions to add some extra spice to the mix.

The arbitrary nature of the terminal based UI's that plugins can bring into the mix complicates things even further.

Some form of unlock on system start / user login is needed. But I've reached the limits of my knowledge on this one. Happy for others to chime in.

Looks like the TPM plugin actually supports environment variables: https://github.com/Foxboron/age-plugin-tpm?tab=readme-ov-file#with-pin

Maybe the better option for machines rather than yubikeys.

[brianmcgee]

Looks like the TPM plugin actually supports environment variables: https://github.com/Foxboron/age-plugin-tpm?tab=readme-ov-file#with-pin

So one approach could be in your NixOS config to set a user secret which contains the PIN, and then the home-manager sops module can go from there with the TPM? I guess on a per user basis you would want to generate a separate identity with the TPM on a machine.