Q&A: environmentFile definition inside config

[caniko]

Was wondering if this is OK in production?

    environmentFile = pkgs.writeText "authentik-secrets.env" ''
      AUTHENTIK_SECRET_KEY=${age.secrets.kingpin-authentik-secret.value}
      AUTHENTIK_EMAIL__PASSWORD=${age.secrets.kingpin-mailersend-smtp-secret.value}
    '';

I generate/bootstrap the authentik secret using agenix-rekey while the email password is an agenix secret, so getting this to work is very useful for me.

[Ma27]

I assume age.secrets.kingpin-mailersend-smtp-secret.value is the actual password? Kinda surprised that you can even get this at eval-time with agenix.

Anyways, under this assumption, you'll have a store-path with the email password and the secret key inside. Store paths are readable by every user (and thus essentially every process) on your system. This is the reason stuff like agenix/sops-nix exists in the first place fwiw. So, personally I'd rather not do this in production.

[caniko]

Yeah, I realized this earlier today. Keeping this open for other ideas

[Ma27]

There are essentially two things you can do:

• put the entire env file into agenix/sops-nix.
• sops-nix supports generating secret files on activation, i.e. with:

{ config, ... }:
{
  sops = {
    secrets = {
      email_password = {};
      authentik_secret_key = {};
      db_password = {};
      ldap_outpost_token = {};
      tls-key = {};
    };
    templates = {
      server-env.content = ''
        AUTHENTIK_EMAIL__PASSWORD=${config.sops.placeholder.email_password}
        AUTHENTIK_SECRET_KEY=${config.sops.placeholder.authentik_secret_key}
        AUTHENTIK_POSTGRESQL__PASSWORD=${config.sops.placeholder.db_password}
      '';
    };
  };
  services.authentik = {
    enable = true;
    environmentFile = config.sops.templates.server-env.path;
    # ...
  };
}

Never used agenix, so I have no idea if they also have a feature like this.

Right now, secret management is effectively an excercise left to the reader, but with a few implementations almost everyone uses (i.e. agenix and sops-nix).

In the context of this repository, there's nothing left to discuss, really, so I'll close this.
If you have further questions, feel free to ask anyways, but I'd suggest to ask around in e.g. Matrix or Discourse, you'll probably get an answer a little quicker there :)