From 3e16c5a55d5953cf64a7ad03fbdf733a33bb0419 Mon Sep 17 00:00:00 2001 From: sajenim Date: Sun, 21 Jan 2024 22:18:12 +0800 Subject: [PATCH] fix cache dir sandbox path --- nixos/common/global/age.nix | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/nixos/common/global/age.nix b/nixos/common/global/age.nix index 9020ce9..1c34019 100644 --- a/nixos/common/global/age.nix +++ b/nixos/common/global/age.nix @@ -12,13 +12,14 @@ in rekey.masterIdentities = [ ../users/sajenim/agenix-rekey.pub ]; # Pubkey for rekeying rekey.hostPubkey = ../../${hostname}/ssh_host_ed25519_key.pub; - # As user not a trusted-users in our nix.conf - # we must add age.rekey.cacheDir as a global extra sandbox path + # Where we store the rekeyed secrets rekey.cacheDir = "/var/tmp/agenix-rekey/\"$UID\""; }; - # Required to persist `/var/tmp/agenix-rekey` environment.persistence."/persist".directories = [ { directory = "/var/tmp/agenix-rekey"; mode = "1777"; } ]; + # As user not a trusted-users in our nix.conf + # we must add age.rekey.cacheDir as a global extra sandbox path + nix.settings.extra-sandbox-paths = [ "/var/tmp/agenix-rekey" ]; }