How to store secrets when using guix deploy?

How to store secrets when using guix deploy?

[Lee Fallat]

Hey!

As the title says, I was wondering how people are storing secrets when
using guix deploy?

Thanks!

-- Lee

Re: How to store secrets when using guix deploy?

[Joshua Branson]

Lee Fallat <inbox@leefallat.ca> writes:

> Hey!
>
> As the title says, I was wondering how people are storing secrets when
> using guix deploy?

I would love to know how to do that too!  Also Lee, this kind of
question is best asked in help-guix@gnu.org.

Thanks!

Joshua

--
Joshua Branson (joshuaBPMan in #guix)
Sent from Emacs and Gnus
  https://gnucode.me
  https://video.hardlimit.com/accounts/joshua_branson/video-channels
  https://propernaming.org
  "You can have whatever you want, as long as you help
enough other people get what they want." - Zig Ziglar

Re: How to store secrets when using guix deploy?

[Leo Prikler]

Hello,

Guix itself does not handle any secrets yet -- at best you could
consider the password field of the user-account structure to be one,
and that is not particularly kept a secret either (it shows up as
plaintext).  Depending on your use-case, there might also be services
like the letsencrypt-service-type to generate X.509 certificates. 
Other than that, you may be able to send some already encrypted file to
your machine, but you'll have to manually set up decryption through
other means unless you want plaintext in your store again.

That's the status quo as far as I understand.  How it *should* handle
secrets remains an open question if I recall correctly.

Regards,
Leo

Re: How to store secrets when using guix deploy?

[Ludovic Courtès]

Hi!

Leo Prikler <leo.prikler@student.tugraz.at> skribis:

> That's the status quo as far as I understand.  How it *should* handle
> secrets remains an open question if I recall correctly.

Yeah that’s mostly true, though ‘secret-service-type’ in (gnu services
virtualization) shows a simple solution for VMs hosted by Guix System
(childhurds in this case).

Ludo’.