Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Setting symlink = false; for a secret with default path breaks all secrets #291

Open
tmarkov opened this issue Oct 1, 2024 · 0 comments

Comments

@tmarkov
Copy link

tmarkov commented Oct 1, 2024

So, I set up a secret like:

age.secrets.secret = {
    file = ./secrets/secret.age;
    symlink = false;
};

Now, this is a misconfiguration in the sense that it makes no sense to set this, as secrets in the default path - /run/agenix/secret are not symlinks anyway. But this wasn't clear to me from the docs of the symlink option, so I ended up setting it.

However, this actually prevents agenix from setting up the other secrets:

Oct 02 01:31:10 server stage-2-init: [agenix] creating new generation in /run/agenix.d/1
Oct 02 01:31:10 server stage-2-init: [agenix] decrypting secrets...
Oct 02 01:31:10 server stage-2-init: decrypting '/nix/store/hash-secret.age' to '/run/agenix/secret'...
Oct 02 01:31:10 server stage-2-init: decrypting '/nix/store/hash-other-secret.age' to '/run/agenix.d/0/other-secret'...
Oct 02 01:31:10 server stage-2-init: [agenix] symlinking new secrets to /run/agenix (generation 1)...
Oct 02 01:31:10 server stage-2-init: ln: /run/agenix: cannot overwrite directory
Oct 02 01:31:10 server stage-2-init: Activation script snippet 'agenixInstall' failed (1)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant