NixOS 密钥管理实战：sops-nix、agenix 与声明式秘钥分发

# 生成 age 密钥对
mkdir -p ~/.config/sops/age
nix run nixpkgs#age -- --generate-key -o ~/.config/sops/age/keys.txt
# 查看公钥
nix run nixpkgs#age-keygen -- -y ~/.config/sops/age/keys.txt

# 用 sops 加密 secrets.yaml，age 公钥为接收者
nix shell nixpkgs#sops -c sops --age <age1...> \
  --encrypt secrets.yaml > secrets.enc.yaml
# 或先创建空白加密文件再编辑
nix shell nixpkgs#sops -c sops --age <age1...> -e -i secrets.yaml

{ config, pkgs, inputs, ... }:
{
  imports = [ inputs.sops-nix.nixosModules.sops ];
  sops = {
    defaultSopsFile = ./secrets.enc.yaml;   # 加密文件
    age.keyFile = "/home/user/.config/sops/age/keys.txt";
    secrets = {
      "db_password" = { };                     # 声明一个密钥
      "api_key" = { owner = "myapp"; };
    };
  };
}

cat /run/secrets/db_password

systemd.services.myapp = {
  # 方式一：环境变量（注意：会暴露在进程环境中）
  serviceConfig.EnvironmentFile = [
    config.age.secrets.myapp_env.path
  ];

  # 方式二：读文件路径（推荐）
  serviceConfig.ExecStart = ''
    ${pkgs.bash}/bin/bash -c \
      'DB_PASS=$(cat ${config.age.secrets.db_password.path}) \
       exec ${pkgs.myapp}/bin/myapp'
  '';
};

sops.secrets.db_password = {
  owner = "myapp";
  group = "myapp";
  mode = "0440";   # 仅属主组可读
};

{ config, pkgs, ... }:
{
  imports = [ "${inputs.agenix}/modules/age.nix" ];
  age.secrets.db_password = {
    file = ./db_password.age;      # 用 agenix 加密的文件
    owner = "myapp";
  };
}
systemd.services.myapp = {
  # agenix 解密到 /run/agenix/<name>
  serviceConfig.ExecStart = "${pkgs.myapp}/bin/myapp --pw ${config.age.secrets.db_password.path}";
};

# 加密时把多台主机的公钥都作为 recipient
sops --age age1host1...,age1host2... -e -i secrets.yaml

# 每台机器配置自己的私钥路径
sops.age.keyFile = "/var/lib/secrets/keys.txt";   # 各主机不同

# 用 GitHub Actions + sops + age
steps:
  - uses: actions/checkout@v4
  - uses: nix-community/setup-nix-action@v6
  - name: Decrypt secrets
    run: |
      echo "$AGE_SECRET_KEY" > ~/.config/sops/age/keys.txt
      sops -d secrets.enc.yaml > /tmp/secrets.yaml
    env:
      AGE_SECRET_KEY: ${{ secrets.AGE_SECRET_KEY }}   # 存于 GitHub Secrets

# 重新加密（换公钥或轮换数据密钥）
sops --age <new-age-key> -e -i secrets.yaml
# 部署后旧私钥可作废