#home-manager on 2020-07-22

2019-03-22 01:06 rycee changed the topic of #home-manager to: Support and discussion around the Home Manager project (https://github.com/rycee/home-manager) | Logs: https://logs.nix.samueldr.com/home-manager

00:39 maier has joined #home-manager

00:43 maier has quit [Ping timeout: 240 seconds]

02:39 maier has joined #home-manager

02:44 maier has quit [Ping timeout: 240 seconds]

02:48 quinn has quit [Ping timeout: 240 seconds]

02:50 quinn has joined #home-manager

04:40 maier has joined #home-manager

04:45 maier has quit [Ping timeout: 240 seconds]

05:47 maier has joined #home-manager

06:30 dermetfan has joined #home-manager

06:49 dermetfan has quit [Remote host closed the connection]

06:49 dermetfan has joined #home-manager

07:00 malSet has quit [Read error: Connection reset by peer]

07:02 malSet has joined #home-manager

07:09 cole-h has quit [Quit: Goodbye]

07:13 dermetfan has quit [Ping timeout: 260 seconds]

07:14 dermetfan has joined #home-manager

08:31 ohhaimark[m] has quit [Quit: Idle for 30+ days]

08:51 quinn has quit [Quit: ZNC 1.8.1 - https://znc.in]

09:57 asymptotically has joined #home-manager

10:39 <asymmetric> how are people dealing with secrets in their HM configs?

10:40 <NobbZ[m]> Currently I have a conditionally loaded module which contains the secrets, which I do not commit to git.

10:41 <NobbZ[m]> https://gitlab.com/NobbZ/nix-home-manager-dotfiles/-/blob/master/home.nix#L8-9

10:43 <dutchie> for my old dotfiles repo i used git-crypt: https://github.com/AGWA/git-crypt

10:43 <NobbZ[m]> The problem with this approach is, that those secrets also end up in plaintext and world readable in the store, I can live with that currently, as all PCs where I use that technique are used by me only. I'm searching for alternatives, as I might give my sone more PC time in not so far future.

11:03 maier has quit [Ping timeout: 264 seconds]

11:06 <asymmetric> right. i considered pushing my HM config to cachix, which made me realize that everything in the store would be there on their servers

11:07 <asymmetric> i think encryption at rest is the way to go, will look into git-crypt

11:10 <dutchie> i don't think it solves the problem of plaintext secrets in nix store

11:14 <immae> A way to do it and not be worried about cachix having them on their server would be to generate an encrypted tar file, and deencrypt it during activation phase

11:14 <eyJhb> asymmetric: try to get it from a program instead or read it from a file

11:15 <eyJhb> Not from Nix of course

11:15 <eyJhb> Do you have any examples of programs?

11:15 <immae> (but I’m not sure it’s feasible without leaking the secrets in drv files)

11:16 <eyJhb> Pretty sure it would leak in the drv files, sadly

11:21 <immae> (I’m considering having a big look at https://elvishjerricco.github.io/2018/06/24/secure-declarative-key-management.html some day, maybe it would solve these issues)

11:23 <asymmetric> eyJhb: wdym with examples of programs?

11:23 <eyJhb> More if there were any specific programs you had in mind

11:24 <eyJhb> THat needs the secrets

11:24 <asymmetric> ah, well there are some env vars with API tokens in my fish config

11:25 <eyJhb> API_TOKEN=(cat /path/to/file) ?

11:26 <eyJhb> And then have a encrypted dir some place, with the files in. Keeping them together, but only owned by you

11:32 maier has joined #home-manager

11:32 <asymmetric> immae: the link is pretty cool, but i don't think it will avoid stuff ending in plaintext in the store

11:33 <eyJhb> asymmetric: why wouldn't it?

11:33 <asymmetric> deployment.keys.secret-foo.text = builtins.extraBuiltins.pass "secret-foo";

11:33 <asymmetric> wouldn't this result in a drv file with the plaintext?

11:38 <eyJhb> asymmetric: Not sure with .text, but there is keyfile as well which won't

11:38 <eyJhb> But ping adisbladis in #nixos, I am sure he knows what is up

11:38 <eyJhb> Or elvis...

11:39 <asymmetric> is .keyfile a nixops specific thing? i know they do some magic with values kept in ram

11:39 <eyJhb> It is all nixos magic

11:39 <eyJhb> nixops**

11:39 <eyJhb> Sorry

11:40 <asymmetric> yeah i would rather not add a dep to nixops

11:40 <asymmetric> but one could emulate their approach, i guess

11:41 <asymmetric> eyJhb: your approach (with the token coming from a file at runtime) seems like it would work

11:41 <eyJhb> It is the easiest way to do it

11:42 <asymmetric> i wonder if this rfc has some relevance to this too https://github.com/NixOS/rfcs/pull/59

11:42 <{^_^}> rfcs#59 (by d-goldin, 35 weeks ago, open): [RFC 0059]: Systemd Service Secrets

11:42 <eyJhb> Depending on the amout of sercets

11:51 <immae> Yes I was more thinking about the approach itself (adding an ad hoc builtins to make the store oblivious to plain text versions)

11:51 <immae> (the builtins could for instance generate a gpg file that would be decrypted at the last moment)

11:54 <rycee> I haven't followed but I'd suggest reading through https://github.com/NixOS/nix/issues/8 and https://github.com/NixOS/rfcs/pull/5 if you are thinking about putting secrets in the Nix store.

11:54 <{^_^}> nix#8 (by edolstra, 8 years ago, open): Support private files in the Nix store

11:54 <{^_^}> rfcs#5 (by edolstra, 3 years ago, closed): [RFC 0005] Nix encryption

12:13 <rycee> Would be lovely to have something like that but it seems like a pretty subtle problem :-)

12:13 <rycee> I imagine it would make for a good master's thesis or something of that kind.

12:21 maier has quit [Ping timeout: 256 seconds]

12:30 <eyJhb> So, something you are up for rycee ? ;)

12:30 <eyJhb> However, not sure where you are regarding education

12:30 <rycee> Absolutely not. I'm not looking for a new masters in the CS field.

12:30 <eyJhb> PhD maybe ?

12:30 <eyJhb> ;) :p

12:31 <rycee> No new PhD in CS either :-)

12:31 <eyJhb> Doctorate?

12:32 <eyJhb> Higher Doctorate I suppose. The terms are confusing compared to Danish

12:32 <eyJhb> But nice! What did you do a PhD on?

12:36 <rycee> I did some work on representation of non-classical logics using category theory. Fuzzy logic being the simplest case but also handling of logics where the operations themselves are uncertain or many-valued, for example.

12:38 Ericson2314 has quit [*.net *.split]

12:38 enick_164 has quit [*.net *.split]

12:38 AsbjrnOlling[m] has quit [*.net *.split]

12:38 tristan[m] has quit [*.net *.split]

12:38 ZerataX has quit [*.net *.split]

12:38 jschievink has quit [*.net *.split]

12:38 benkolera has quit [*.net *.split]

12:38 M0-[m] has quit [*.net *.split]

12:38 Ke has quit [*.net *.split]

12:38 colemickens has quit [*.net *.split]

12:38 ldlework has quit [*.net *.split]

12:40 mathyouguy has quit [Read error: Connection reset by peer]

12:40 philipp[m] has quit [Read error: Connection reset by peer]

12:40 theduke has quit [Read error: Connection reset by peer]

12:40 nicolas[m]1 has quit [Read error: Connection reset by peer]

12:40 freeman42x[m] has quit [Read error: Connection reset by peer]

12:40 alexarice[m] has quit [Read error: Connection reset by peer]

12:40 rschulman has quit [Read error: Connection reset by peer]

12:40 dash has quit [Read error: Connection reset by peer]

12:40 siraben has quit [Read error: Connection reset by peer]

12:40 toraritte has quit [Read error: Connection reset by peer]

12:40 Gav[m] has quit [Read error: Connection reset by peer]

12:40 maralorn has quit [Read error: Connection reset by peer]

12:40 NobbZ[m] has quit [Read error: Connection reset by peer]

12:40 aterius has quit [Read error: Connection reset by peer]

12:40 sparogy has quit [Write error: Connection reset by peer]

12:40 Dandellion has quit [Write error: Connection reset by peer]

12:40 hpfr[m] has quit [Write error: Connection reset by peer]

12:40 bbigras has quit [Write error: Connection reset by peer]

12:40 JJJollyjim has quit [Write error: Connection reset by peer]

12:40 DamienCassou has quit [Write error: Connection reset by peer]

12:40 Notkea[m] has quit [Read error: Connection reset by peer]

12:40 rycee has quit [Read error: Connection reset by peer]

12:40 Ox4A6F1 has quit [Write error: Connection reset by peer]

12:40 khassanov[m] has quit [Write error: Connection reset by peer]

12:40 jonge[m] has quit [Remote host closed the connection]

12:42 ldlework has joined #home-manager

12:45 maier has joined #home-manager

12:48 tristan[m] has joined #home-manager

13:11 toraritte has joined #home-manager

13:11 sparogy has joined #home-manager

13:11 NobbZ[m] has joined #home-manager

13:11 Ke has joined #home-manager

13:11 alexarice[m] has joined #home-manager

13:11 Dandellion has joined #home-manager

13:11 ZerataX has joined #home-manager

13:11 hpfr[m] has joined #home-manager

13:11 philipp[m] has joined #home-manager

13:11 Notkea[m] has joined #home-manager

13:11 M0-[m] has joined #home-manager

13:11 DamienCassou has joined #home-manager

13:11 mathyouguy has joined #home-manager

13:11 Ericson2314 has joined #home-manager

13:11 theduke has joined #home-manager

13:11 khassanov[m] has joined #home-manager

13:11 siraben has joined #home-manager

13:11 rycee has joined #home-manager

13:11 dash has joined #home-manager

13:11 maralorn has joined #home-manager

13:11 Ox4A6F has joined #home-manager

13:11 jonge[m] has joined #home-manager

13:11 colemickens has joined #home-manager

13:11 benkolera has joined #home-manager

13:11 freeman42x[m] has joined #home-manager

13:11 JJJollyjim has joined #home-manager

13:11 aterius has joined #home-manager

13:11 bbigras has joined #home-manager

13:11 nicolas[m]1 has joined #home-manager

13:11 jschievink has joined #home-manager

13:11 rschulman has joined #home-manager

13:11 enick_900 has joined #home-manager

13:11 Gav[m] has joined #home-manager

13:11 AsbjrnOlling[m] has joined #home-manager

14:08 ardumont has quit [Ping timeout: 256 seconds]

14:32 ardumont has joined #home-manager

14:44 andi- has quit [Ping timeout: 260 seconds]

14:45 __monty__ has joined #home-manager

14:49 dermetfan has quit [Ping timeout: 260 seconds]

15:06 maier has quit [Ping timeout: 240 seconds]

15:14 maier has joined #home-manager

15:19 maier has quit [Ping timeout: 240 seconds]

15:20 andi- has joined #home-manager

17:06 dermetfan has joined #home-manager

17:13 cole-h has joined #home-manager

17:15 maier has joined #home-manager

17:20 maier has quit [Ping timeout: 260 seconds]

18:42 ardumont_ has joined #home-manager

18:43 ardumont has quit [Ping timeout: 244 seconds]

19:16 maier has joined #home-manager

19:21 maier has quit [Ping timeout: 264 seconds]

19:36 zoickx has joined #home-manager

19:45 zoickx has quit [Remote host closed the connection]

19:57 asymptotically has quit [Quit: Leaving]

20:06 asymptotically has joined #home-manager

20:40 <eyJhb> Can I pull in e.g. a patch frmo https://patch-diff.githubusercontent.com/raw/rycee/home-manager/pull/1391.patch and apply from with fetchurl?

20:48 <cole-h> eyJhb: Sounds like you're looking for `patches = [ (fetchpatch { url = ....; sha256 = ....; }) ];`

20:49 <eyJhb> Where can I define that, so it is applied to a channel?

20:49 <eyJhb> :p

20:52 <eyJhb> Tagging you cole-h

20:52 <cole-h> What

20:52 <cole-h> You're patching a channel...?

20:53 <eyJhb> I want to apply that patch, to the hame-manager channel I have, or the home-manager dir I have set as a channel, on NIxOS build

20:53 <eyJhb> So that I can place something like patches = [] in my config, but it is applied to home-manager base

20:54 <cole-h> Why not just use a patched h-m directly?

20:55 <eyJhb> I.. I would like the other much better, seems more clean like a overlay :p

21:05 quinn has joined #home-manager

21:17 maier has joined #home-manager

21:21 maier has quit [Ping timeout: 240 seconds]

21:53 __monty__ has quit [Quit: leaving]

22:02 asymptotically has quit [Quit: Leaving]

23:02 dermetfan has quit [Ping timeout: 260 seconds]

23:18 maier has joined #home-manager

23:23 maier has quit [Ping timeout: 256 seconds]

23:35 cole-h has quit [Quit: Goodbye]

23:40 tdeo has quit [Quit: Quit]