From f0259cfb96b572cd311d1774b60b007c104d0f1f Mon Sep 17 00:00:00 2001 From: Yisroel Baum Date: Sat, 9 May 2026 22:17:15 +0300 Subject: [PATCH] point sops at age key file sops-nix's default identity discovery imports the host's SSH ed25519 key as an age identity, but secrets/tide.yaml is encrypted to the age key generated with age-keygen and stored at /var/lib/sops-nix/key.txt. Without sops.age.keyFile pointing at that path, activation fails with 'Error getting data key: 0 successful groups required, got 0'. Also blank the SSH/GPG fallback paths so the module never silently picks up an unintended identity. --- tide.nix | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/tide.nix b/tide.nix index fac2eba..da5fd4e 100644 --- a/tide.nix +++ b/tide.nix @@ -20,6 +20,14 @@ # the file is absent, which is the right place for that failure. sops.validateSopsFiles = false; + # Use the host's age key generated with age-keygen, not the + # SSH-host-key-derived identity sops-nix falls back to by default. + # The encrypted file's recipient is the public key paired with + # this private key. + sops.age.keyFile = "/var/lib/sops-nix/key.txt"; + sops.age.sshKeyPaths = [ ]; + sops.gnupg.sshKeyPaths = [ ]; + sops.secrets."tide-env" = { sopsFile = ./secrets/tide.yaml; # phpfpm reads this via EnvironmentFile, which runs as root