How I manage secrets in my Guix home config
I use guix home
to manage my configuration files. Naturally, there
are certain files that shouldn’t be publicly accessible, like public
and secret keys. So, how do I manage those files? There are certainly
elegant ways to deal with this, but I choose the lazy option and just
encrypt a tarball.
First, I define the paths to include in the tarball by setting the argument list.
set -- \ cancername-git-config-service.scm \ cancername-ssh-config-service.scm \ cancername-gpg-config-service.scm \ git \ gpg \ ssh
Then, I use scripts to create and unpack the encrypted tarball. Here, I use age
and my public key.
#! /usr/bin/env -S guix shell dash age tar zstd -- dash # -*- mode: sh -*- set -xeu . ./set-encrypt-files.sh tar c "$@" | zstd | age -r age1shvrllx330ylxgahlwehxc6yt099qrjsdcnz6f4lq27qaqgcrdus6yjphn >secret.tar.zst.age git add secret.tar.zst.age git commit -m 'update secrets'
#! /usr/bin/env -S guix shell dash age tar zstd -- dash # -*- mode: sh -*- set -xeu key_file="$1" . ./set-encrypt-files.sh age --decrypt -i "$key_file" <secret.tar.zst.age | zstd -d | tar x "$@"
After it is unpacked, I can load the files into my home config.
(load "cancername-gpg-config-service.scm") (load "cancername-ssh-config-service.scm") (load "cancername-git-config-service.scm")