refactor secrets

[billimek]

Refactor secrets using using opnix instead of git-crypt

[billimek]

Did some experimentation with negative results (and many hours burned)

One use-case is that I want is to do something like define programs.git.userEmail to a value held in secrets. and attempted to handle this with the tools available with secrets being handled by 1password.

opnix

• No nix-darwin support. May try to PR that as a new feature, but
• Ran into an issue when trying to define a secret using home-manager. opnix currently only allows persisting translated secrets to some file in the filesystem. In the case of home-manager, it will be somewhere off of the users' home directory root. I tried to write the 'secret' to some file in the home directory and read the value using builtins.readFile but nix complains that this is impure because it's referenced outside of the nix store. Based on this, I could not find an acceptable way to handle the example scenario of setting programs.git.userEmail.
• It would be ideal if there was some way to use opnix such that you can reference the contents of a secret declaratively within nix. Not sure that's even possible, but maybe it would help with the use-case above.

ragenix and age-plugin-1p

• There is a new age plugin called age-plugin-1p that works with age to nativley access a ssh key from 1password which opens the door to using something like agenix (really ragenix)
• Was able to validate that this mostly works by installing the modules and doing a test with age CLI and ragenix CLI using commands like,
  • echo 'Hello, world!' | age -r (op read "op://Private/Personal Key - github.com - billimek/public key") -o secret.age
  • age --decrypt -j 1p -o - secret.age
  • ragenix --rules secrets/secrets.nix -e secrets/secret.age -i secrets/AGE-PLUGIN-1P-1X2NELQ.txt
• However trying to use ragenix in nix-darwin resulted in problems where the secret file didn't get created (with no errors to explain why) and also errors trying to reference it with the age.secrets.<secret>.path. I think there is an issue using this properly in nix-darwin
• Similar issues trying to use ragenix in home-manager with the same example use-case but ran into some other issues related to DARWIN_USER_TEMP_DIR and similar problems with the secret file never being generated and errors trying to reference it by path. May be related to this issue

---

In summary, as of May 2025 I haven't found a workable nix secrets solution that will leverage 1password (either as the direct holder of secrets or as the trusted ssh agent). sops-nix seems way too overcomplicated for this use case, and I have no desire to deal with host ssh keys and associated complexities to do something as simple as masking an email address. Will stick with git-crypt for now unless or until there is a better path forward.