sops-nix

sops-nix provides atomic, declarative, and reproducible secret provisioning for NixOS based on sops. It decrypts secrets from sops files during activation time and stores them as individual files with access-controlled users, permissions, and groups.

Key features include:

• Compatibility: Works with NixOps, nixos-rebuild, krops, morph, nixus, and home-manager.
• Version Control Friendly: Encrypted files can be committed to version control; diffs can be shown in cleartext via sops.
• CI Friendly: Secrets can be added to the Nix store without leaking them, allowing full machine builds from a repository.
• Atomic & Rollback Support: New secrets are written to a new directory and replaced atomically. Rollback support is available if sops files are added to the Nix store.
• Flexible Formats: Supports YAML, dotenv, INI, JSON, or binary storage formats.
• Cloud KMS Support: While not officially supported by sops-nix yet, AWS KMS, GCP KMS, Azure Key Vault, and Hashicorp Vault can be controlled via environment variables passed to sops.

You can install sops-nix using several methods depending on your Nix setup.

Flakes (Recommended)

Add sops-nix as an input in your flake and include the sops-nix.nixosModules.sops module in your NixOS configuration.

nix-darwin

For macOS users using nix-darwin, use the sops-nix.darwinModules.sops module.

niv

If you are not using flakes, add the repository via niv and import the module from the resulting source path.

fetchTarball

Manually fetch the repository using builtins.fetchTarball and import the module directly from the archive.

# Flakes example
{
  inputs.sops-nix.url = "github:Mic92/sops-nix";
  inputs.sops-nix.inputs.nixpkgs.follows = "nixpkgs";

  outputs = { self, nixpkgs, sops-nix }: {
    nixosConfigurations.yourhostname = nixpkgs.lib.nixosSystem {
      system = "x86_64-linux";
      modules = [
        ./configuration.nix
        sops-nix.nixosModules.sops
      ];
    };
  };
}

The template feature allows you to inject secrets into configuration files during the activation phase.

1. Define the secret: Add the secret to sops.secrets.
2. Create a template: Use sops.templates.<name>.content and reference the secret using ${config.sops.placeholder.<secret-name>}.
3. Reference the template: Use the .path attribute of the template in your service configuration (e.g., in ExecStart).

{
  # 1. Define secret
  sops.secrets.your-secret = { };

  # 2. Create template
  sops.templates."your-config-with-secrets.toml".content = ''
    password = "${config.sops.placeholder.your-secret}"
  '';
  sops.templates."your-config-with-secrets.toml".owner = "serviceuser";

  # 3. Use in service
  systemd.services.myservice = {
    serviceConfig = {
      ExecStart = "${pkgs.myservice}/bin/myservice --config ${config.sops.templates."your-config-with-secrets.toml".path}";
      User = "serviceuser";
    };
  };
}

To edit secrets, you need a private key. You can use age or GnuPG.

age

Generate an age key pair:

$ mkdir -p ~/.config/sops/age
$ age-keygen -o ~/.config/sops/age/keys.txt

Or convert an existing SSH Ed25519 key to age:

$ mkdir -p ~/.config/sops/age
$ nix-shell -p ssh-to-age --run "ssh-to-age -private-key -i ~/.ssh/id_ed25519 > ~/.config/sops/age/keys.txt"

GnuPG

Generate a GPG key using gpg --full-generate-key.

You can also convert an RSA SSH key to a GPG key using ssh-to-pgp:

$ nix-shell -p gnupg -p ssh-to-pgp --run "ssh-to-pgp -private-key -i $HOME/.ssh/id_rsa | gpg --import --quiet"

Note for nix-darwin users: Save the age key to $HOME/Library/Application Support/sops/age/keys.txt or set a custom configuration directory.

# Generate age key
$ mkdir -p ~/.config/sops/age
$ age-keygen -o ~/.config/sops/age/keys.txt