beatzaplenty/nixos
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ipa): use in-place sops encryption in module docs

Browse Source 
sops matches creation rules against the input file path, so encrypting
/tmp/<host>.keytab directly with stdout redirect fails to find the rule.
Copy to secrets/ first, then use -i to encrypt in-place.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
beatzaplenty
2026-07-28 07:19:53 +10:00
co-authored by Claude Sonnet 4.6
parent a4b49c9909
commit 8955840f0a
1 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/ipa/client.nix
+5 -3
View File
@@ -20,9 +20,11 @@
# ipa host-add <fqdn> --ip-address=<ip>
# ipa-getkeytab -s <ipa-server> -p host/<fqdn> -k /tmp/<host>.keytab
#
# 3. sops-encrypt the keytab as a binary secret from your admin machine:
# sops -e --input-type binary /tmp/<host>.keytab \
# > secrets/<host>.keytab
# 3. sops-encrypt the keytab as a binary secret from your admin machine
# (must run from repo root; sops matches creation rules against the file
# path, so copy to secrets/ first and encrypt in-place):
# cp /tmp/<host>.keytab secrets/<host>.keytab
# sops -e --input-type binary -i secrets/<host>.keytab
# Add secrets/<host>.keytab to .sops.yaml with the host's age key as a
# recipient (see the nix-cache.keytab entry for the pattern), then run:
# scripts/secrets/sync-host-keys.sh <target> # if not done yet