12:51 <Mic92> mdlayher: cool!

12:53 <mdlayher> Yep yep. Just merged thanks to flokli!

12:53 <Mic92> mdlayher: I really needs for some machines that crashes in a building I am not allowed to access bc of covid.

12:55 <mdlayher> Excellent. I am not surprised that systemd has this functionality but I didn't know about it until just recently, so I figured it would be good to add searchable options to enable that functionality

12:56 <Mic92> I knew it before, but I thought that my hardware does not support it.

12:56 <Mic92> but appearantly I have /dev/watchdog

12:58 <Mic92> aanderse: private ssh key support: https://github.com/Mic92/sops-nix/blob/master/pkgs/sops-install-secrets/nixos-test.nix#L13

12:58 <Mic92> Next on the list is to write documentation.

12:58 <Mic92> And get the CI ready

13:35 <mdlayher> Mic92: oooh, Go and Nix secrets management. Nice, these are problems relevant to my interests. What's your plan here?

15:02 <Mic92> mdlayher: At the moment its an ssh key or gpg based secret management with atomic upgrades. It's compatible with all deployment frameworks: nixops/krops/morph/nixos-rebuild. I plan systemd integration to restart/reload changed services and GCP/AWS KMS. Since sops stores data in encrypted json/yaml files it is easy to integrate into version control. Once systemd services are restart also

15:02 <Mic92> automatic key rotation can be implemented.

15:03 <mdlayher> Sounds perfect for what I need

15:17 <Mic92> mdlayher: I will finish up CI + docs today. Than it should be general usuable.

15:17 <mdlayher> Sure thing

15:33 <flokli> Mic92: is it possible to handle all this without having it inside the nix store one way or another?

15:33 <flokli> as in, can I switch generations back and forth without switching secrets back and forth?

15:34 <Mic92> flokli: yes. It's up to you if you add the sops file to the nix store.

15:34 <flokli> so how do you detect which units to restart when swapping secrets?

15:35 <Mic92> flokli: I have not implemented that yet but the new secrets will be put into a new directory so I can diff them.

15:35 <flokli> also, very related: https://github.com/systemd/systemd/issues/15778#issuecomment-646572005

15:35 <Mic92> It's also put into RAMFS at the moment.

15:37 <Mic92> And than check all referenced services before and after nixos has restarted services. There is a monotonic counter I can use for this.

19:07 <aanderse> sounds awesome

21:26 <flokli> finally! https://github.com/NixOS/nixpkgs/pull/93024

21:26 <{^_^}> #93024 (by flokli, 10 minutes ago, open): lvm: cleanups

21:27 <flokli> that was a sunday full of fiddling with low level foo, and rebuilding the world quite often ;-)