Use during evaluation?

[wmertens]

Would there be a way to encrypt a file that gets decrypted during nix evaluation? The idea would be to store semi-secrets that change the nix configuration like the contents of /etc/hosts - I'd like to keep that out of git but it's fine in the nix store.

[Mic92]

No. That's not possible. It would basically involve import-from-derivation and adding secret keys to the nix store at which point you can just have plain text secrets. You maybe want to have a look into https://github.com/vlaci/git-agecrypt or similar if you have this usecase (or wait until nix gets native encryption ....).

[Mic92]

See https://github.com/Mic92/sops-nix#using-secrets-at-evaluation-time

[wmertens]

So how would git-agecrypt provide the secret to nix at build time? Is that NixOS/nix#5260 ?

[Mic92]

Mhm. Right. This won't work with flakes. One could have a flake for secrets in a private repo in plain text. I don't know any other solution.