From 3c03464b24e80344cae77697b84952d2087b71c3 Mon Sep 17 00:00:00 2001 From: Sk7Str1p3 Date: Sun, 3 May 2026 00:48:46 +0300 Subject: [PATCH] feat(docs): describe evaluation time secrets --- docs/docgen.nix | 1 + docs/src/evalSecrets.md | 9 +++++++++ 2 files changed, 10 insertions(+) create mode 100644 docs/src/evalSecrets.md diff --git a/docs/docgen.nix b/docs/docgen.nix index b640add..f75cce0 100644 --- a/docs/docgen.nix +++ b/docs/docgen.nix @@ -96,6 +96,7 @@ stdenvNoCC.mkDerivation { [Introduction](README.md) - [Features]() + - [Evaluation time secrets](evalSecrets.md) - [Documentation generation](docGen.md) '' diff --git a/docs/src/evalSecrets.md b/docs/src/evalSecrets.md new file mode 100644 index 0000000..2b76061 --- /dev/null +++ b/docs/src/evalSecrets.md @@ -0,0 +1,9 @@ +# Evaluation time secrets + +Some secrets cannot be left in cleartext (e.g time zone, user's real names), but are required at evaluation time, +and in some cases using sops-nix's template is really inconvenient. +To handle this, __currently__ i use strange approach: I manually encrypt files with sops, commit them and manually decrypt. +[git-agecrypt](https://github.com/vlaci/git-agecrypt) wasn't suitable for me. +In future, i will replace it with my own implementation of transparent git encryption based on sops. + +Also, this used only for secrets which may be safely left in world-readable store. For more sensitive secrets I use `sops-nix`, which decrypts secrets only at runtime. \ No newline at end of file