{"action":"created","issue":{"url":"https://api.github.com/repos/NixOS/nixpkgs/issues/24288","repository_url":"https://api.github.com/repos/NixOS/nixpkgs","labels_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/24288/labels{/name}","comments_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/24288/comments","events_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/24288/events","html_url":"https://github.com/NixOS/nixpkgs/issues/24288","id":216789475,"number":24288,"title":"Provide options for storing secrets outside the Nix store","user":{"login":"basvandijk","id":576355,"avatar_url":"https://avatars3.githubusercontent.com/u/576355?v=4","gravatar_id":"","url":"https://api.github.com/users/basvandijk","html_url":"https://github.com/basvandijk","followers_url":"https://api.github.com/users/basvandijk/followers","following_url":"https://api.github.com/users/basvandijk/following{/other_user}","gists_url":"https://api.github.com/users/basvandijk/gists{/gist_id}","starred_url":"https://api.github.com/users/basvandijk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/basvandijk/subscriptions","organizations_url":"https://api.github.com/users/basvandijk/orgs","repos_url":"https://api.github.com/users/basvandijk/repos","events_url":"https://api.github.com/users/basvandijk/events{/privacy}","received_events_url":"https://api.github.com/users/basvandijk/received_events","type":"User","site_admin":false},"labels":[{"id":126506420,"url":"https://api.github.com/repos/NixOS/nixpkgs/labels/1.severity:%20security","name":"1.severity: security","color":"e11d21","default":false},{"id":60265212,"url":"https://api.github.com/repos/NixOS/nixpkgs/labels/6.topic:%20nixos","name":"6.topic: nixos","color":"fef2c0","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":42,"created_at":"2017-03-24T13:43:55Z","updated_at":"2018-03-21T12:31:40Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"## Introduction\r\n\r\nDear module authors and maintainers,\r\n\r\nWe currently have many modules that force users to store their secrets in the world-readble Nix store. This is bad for security. We should give users the option of specifying their secrets in individual files which can be stored outside the Nix store with suitable ownership and permissions. Users could then also use `nixops` to [manage their secret files](https://nixos.org/nixops/manual/#idm140737318306400). \r\n\r\nThere's still the convenient but unsafe option of storing the secret file in the Nix store using `pkgs.writeTextFile`. If https://github.com/NixOS/nix/issues/8 gets resolved these files can be encrypted / made private. Also see: https://github.com/NixOS/rfcs/pull/5.\r\n\r\n## Proposal\r\n\r\nThe list below contains all the options that force a secret being stored in the Nix store. I propose the following:\r\n\r\n1. Each option should get a warning in the documentation of the form: \"Warning: this secret is stored in the world-readable Nix store!\"\r\n\r\n2. Each option should get an alternative `passwordFile` option.\r\n\r\n3. For backwards compatibility the `passwordFile` option should get a default based on the `password` option:\r\n\r\n```nix\r\n{ config = {\r\n    passwordFile = mkDefault (toString (pkgs.writeTextFile {\r\n      name = \"password-file\";\r\n      text = cfg.password;\r\n    }));\r\n  };\r\n}\r\n```\r\n\r\n4. Some upstream programs don't support setting a password using a file. In that case an issue should be created in the upstream issue-tracker asking for that feature. (See https://github.com/namecoin/namecoin-core/issues/148 for example). A URL to the issue should be placed in the list below and in the documentation of the `password` option so that it's easier to track when it gets resolved.\r\n\r\n5. If after some time (lets use September 2017 for now) the upstream developers have not provided the feature to specify the password by file, the NixOS module should be changed such that the config file that contains the password is written to `/run` before the service starts up. So something like the following:\r\n\r\n```nix\r\n{\r\n  systemd.services.my-service = {  \r\n    preStart = ''\r\n      cat > /run/my-service/config << EOF\r\n      ...\r\n      password = $(cat \"${cfg.passwordFile}\")\r\n      ...\r\n      EOF\r\n    '';\r\n    script = \"${pkgs.myService}/bin/my-service --config=/run/my-service/config\";\r\n  };\r\n}\r\n```\r\n\r\n6. Lets use this issue for planning and to track progress. Please mention in the comments if you have provided a `passwordFile` option for one of the options below. Then I check the box to indicate it has been resolved. See PR https://github.com/NixOS/nixpkgs/pull/24146 for reference.\r\n\r\n7. If we make sure the new options are backwards compatible we could consider cherry-picking them onto `release-17.03` making sure users get these security fixes ASAP.\r\n\r\n## Secret options\r\n\r\n- [ ] `basicAuth`\r\n[nixos/modules/services/web-servers/nginx/vhost-options.nix#L118](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/web-servers/nginx/vhost-options.nix#L118)\r\n@globin\r\n\r\n- [x] `networking.defaultMailServer.authPass`\r\n[nixos/modules/programs/ssmtp.nix#L92](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/programs/ssmtp.nix#L92)\r\nPR: https://github.com/NixOS/nixpkgs/pull/24331\r\n\r\n- [ ] `networking.wireless.networks.*.psk`\r\n[nixos/modules/services/networking/wpa_supplicant.nix#L49](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/networking/wpa_supplicant.nix#L49)\r\n@edolstra\r\n\r\n- [ ] `security.duosec.skey`\r\n[nixos/modules/security/duosec.nix#L59](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/security/duosec.nix#L59)\r\n@thoughtpolice\r\n\r\n- [x] ~~`services.aiccu.password`~~\r\n~~[nixos/modules/services/networking/aiccu.nix#L48](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/networking/aiccu.nix#L48)~~\r\n@edwtjo mentions: [SixXS is closing down its IPv6 tunnel in June](https://www.sixxs.net/news/2017/#sunsettingsixxs20170606-201703) so it doesn't seem worth the effort to create a patch for aiccu to support password files. Lets just remove the service in 0606.\r\n\r\n- [ ] `services.almir.director_password`\r\n[nixos/modules/services/backup/almir.nix#L129](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/backup/almir.nix#L129)\r\n@domenkozar \r\n\r\n- [ ] `services.bacula-dir.password`\r\n[nixos/modules/services/backup/bacula.nix#L313](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/backup/bacula.nix#L313)\r\n@domenkozar\r\n[Feature request for a PasswordFile parameter](http://bugs.bacula.org/view.php?id=2275)\r\n\r\n- [ ] `services.bacula-[fd|sd].director.*.password`\r\n[nixos/modules/services/backup/bacula.nix#L114](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/backup/bacula.nix#L114)\r\n@domenkozar\r\nSee the feature request above.\r\n\r\n- [x] `services.bepasty.servers.*.secretKey`\r\n[nixos/modules/services/misc/bepasty.nix#L72](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/misc/bepasty.nix#L72)\r\n@makefu\r\nPR: https://github.com/NixOS/nixpkgs/pull/24755\r\n\r\n- [ ] `services.btsync.httpPass`\r\n[nixos/modules/services/networking/btsync.nix#L175](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/networking/btsync.nix#L175)\r\n@thoughtpolice\r\n\r\n- [ ] `services.buildbot-worker.workerPass`\r\n[nixos/modules/services/continuous-integration/buildbot/worker.nix#L56](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/continuous-integration/buildbot/worker.nix#L56)\r\n@nand0p\r\n\r\n- [x] `services.cadvisor.storageDriverPassword`\r\n[nixos/modules/services/monitoring/cadvisor.nix#L54](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/monitoring/cadvisor.nix#L54)\r\n@offlinehacker\r\nPR: https://github.com/NixOS/nixpkgs/pull/24341\r\n\r\n- [ ] `services.cassandra.keyStorePassword`\r\n[nixos/modules/services/databases/cassandra.nix#L236](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/databases/cassandra.nix#L236)\r\n@cransom\r\nSee: https://issues.apache.org/jira/browse/CASSANDRA-13428\r\n\r\n- [ ] `services.cassandra.trustStorePassword`\r\n[nixos/modules/services/databases/cassandra.nix#L241](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/databases/cassandra.nix#L241)\r\n@cransom\r\nSee: https://issues.apache.org/jira/browse/CASSANDRA-13428\r\n\r\n- [ ] `services.cgminer.pools.*.password`\r\n[nixos/modules/services/misc/cgminer.nix#L60](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/misc/cgminer.nix#L60)\r\n@offlinehacker\r\n\r\n- [ ] `services.cjdns.authorizedPasswords`\r\n[nixos/modules/services/networking/cjdns.nix#L103](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/networking/cjdns.nix#L103)\r\n@ehmry\r\n\r\n- [ ] `services.cfdyndns.apikey`\r\n[nixos/modules/services/misc/cfdyndns.nix#L20](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/misc/cfdyndns.nix#L20)\r\n@colemickens \r\n\r\n- [ ] `services.coturn.cli-password`\r\n[nixos/modules/services/networking/coturn.nix#L249](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/networking/coturn.nix#L249)\r\n@Ralith\r\n\r\n- [ ] `services.coturn.static-auth-secret`\r\n[nixos/modules/services/networking/coturn.nix#L174](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/networking/coturn.nix#L174)\r\n@Ralith\r\n\r\n- [ ] `services.cpuminer-cryptonight.pass`\r\n[nixos/modules/services/misc/cpuminer-cryptonight.nix#L38](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/misc/cpuminer-cryptonight.nix#L38)\r\n@ehmry\r\n\r\n- [ ] `services.crowd.openidPassword`\r\n[nixos/modules/services/web-apps/atlassian/crowd.nix#L53](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/web-apps/atlassian/crowd.nix#L53)\r\n@fpletz @globin\r\n\r\n- [ ] `services.dd-agent.api_key`\r\n[nixos/modules/services/monitoring/dd-agent.nix#L112](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/monitoring/dd-agent.nix#L112)\r\n@shlevy \r\n\r\n- [ ] `services.ddclient.password`\r\n[nixos/modules/services/networking/ddclient.nix#L47](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/networking/ddclient.nix#L47)\r\n@rbvermaa\r\n\r\n- [ ] `services.factorio.game-password`\r\n[nixos/modules/services/games/factorio.nix#L144](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/games/factorio.nix#L144)\r\n@elitak\r\n\r\n- [ ] `services.factorio.password`\r\n[nixos/modules/services/games/factorio.nix#L130](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/games/factorio.nix#L130)\r\n@elitak\r\n\r\n- [ ] `services.frab.secretKeyBas`\r\n[nixos/modules/services/web-apps/frab.nix#L118](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/web-apps/frab.nix#L118)\r\n@fpletz\r\n\r\n- [ ] `services.gammu-smsd.backend.sql.password`\r\n[nixos/modules/services/misc/gammu-smsd.nix#L192](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/misc/gammu-smsd.nix#L192)\r\n@zohl\r\n\r\n- [ ] `services.gitlab.databasePassword`\r\n[nixos/modules/services/misc/gitlab.nix#L203](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/misc/gitlab.nix#L203)\r\n@fpletz  @offlinehacker\r\nPR: #31358\r\n\r\n- [ ] `services.gitlab.secrets.secret`\r\n[nixos/modules/services/misc/gitlab.nix#L326](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/misc/gitlab.nix#L326)\r\n@fpletz @offlinehacker\r\nPR: #31358\r\n\r\n- [ ] `services.gitlab.smtp.password`\r\n[nixos/modules/services/misc/gitlab.nix#L295](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/misc/gitlab.nix#L295)\r\n@fpletz @offlinehacker\r\n\r\n- [x] `services.gogs.database.password`\r\n[nixos/modules/services/misc/gogs.nix#L102](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/misc/gogs.nix#L102)\r\n@schneefux\r\nPR: https://github.com/NixOS/nixpkgs/pull/25116\r\n\r\n- [ ] `services.grafana.database.password`\r\n[nixos/modules/services/monitoring/grafana.nix#L137](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/monitoring/grafana.nix#L137)\r\n@offlinehacker\r\n\r\n- [ ] `services.grafana.security.adminPassword`\r\n[nixos/modules/services/monitoring/grafana.nix#L157](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/monitoring/grafana.nix#L157)\r\n@offlinehacker\r\n\r\n- [ ] `services.grafana.security.secretKey`\r\n[nixos/modules/services/monitoring/grafana.nix#L163](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/monitoring/grafana.nix#L163)\r\n@offlinehacker\r\n\r\n- [ ] `services.graylog.passwordSecret`\r\n[nixos/modules/services/logging/graylog.nix#L68](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/logging/graylog.nix#L68)\r\n@fadenb\r\n\r\n- [ ] `services.graylog.rootPasswordSha2`\r\n[nixos/modules/services/logging/graylog.nix#L82](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/logging/graylog.nix#L82)\r\n@fadenb\r\n\r\n- [ ] `services.hologram-server.ldapBindPassword`\r\n[nixos/modules/services/security/hologram-server.nix#L68](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/security/hologram-server.nix#L68)\r\n@nand0p\r\n\r\n- [ ] `services.hostapd.wpaPassphrase`\r\n[nixos/modules/services/networking/hostapd.nix#L124](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/networking/hostapd.nix#L124)\r\n\r\n\r\n- [ ] `services.httpd.extraSubservices...\"limesurvey\"...adminPassword`\r\n[nixos/modules/services/web-servers/apache-httpd/limesurvey.nix#L143](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/web-servers/apache-httpd/limesurvey.nix#L143)\r\n@offlinehacker\r\n\r\n- [ ] `services.httpd.extraSubservices...\"limesurvey\"...dbPassword`\r\n[nixos/modules/services/web-servers/apache-httpd/limesurvey.nix#L131](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/web-servers/apache-httpd/limesurvey.nix#L131)\r\n@offlinehacker\r\n\r\n- [ ] `services.httpd.extraSubservices...\"mediawiki\"...dbPassword`\r\n[nixos/modules/services/web-servers/apache-httpd/mediawiki.nix#L207](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/web-servers/apache-httpd/mediawiki.nix#L207)\r\n@shlevy @ip1981\r\n\r\n- [ ] `services.httpd.extraSubservices...\"owncloud\"...adminPassword`\r\n[nixos/modules/services/web-servers/apache-httpd/owncloud.nix#L403](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/web-servers/apache-httpd/owncloud.nix#L403)\r\n@matejc\r\n\r\n- [ ] `services.httpd.extraSubservices...\"owncloud\"...dbPassword`\r\n[nixos/modules/services/web-servers/apache-httpd/owncloud.nix#L429](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/web-servers/apache-httpd/owncloud.nix#L429)\r\n@matejc\r\n\r\n- [ ] `services.httpd.extraSubservices...\"owncloud\"...SMTPPass`\r\n[nixos/modules/services/web-servers/apache-httpd/owncloud.nix#L527](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/web-servers/apache-httpd/owncloud.nix#L527)\r\n@matejc\r\n\r\n- [x] `services.httpd.extraSubservices...\"wordpress\"...dbPassword`\r\n[nixos/modules/services/web-servers/apache-httpd/wordpress.nix#L138](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/web-servers/apache-httpd/wordpress.nix#L138)\r\n@qknight\r\nPR: https://github.com/NixOS/nixpkgs/pull/24146\r\n\r\n- [ ] `services.i2pd.proto.http.pass`\r\n[nixos/modules/services/networking/i2pd.nix#L351](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/networking/i2pd.nix#L351)\r\n@edwtjo\r\n\r\n- [ ] `services.icecast.admin.password`\r\n[nixos/modules/services/audio/icecast.nix#L62](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/audio/icecast.nix#L62)\r\n@k0ral\r\n\r\n- [ ] `services.kibana.elasticsearch.password`\r\n[nixos/modules/services/search/kibana.nix#L92](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/search/kibana.nix#L92)\r\nPR: https://github.com/NixOS/nixpkgs/pull/30662\r\n\r\n- [x] `services.longview.mysqlPassword`\r\n[nixos/modules/services/monitoring/longview.nix#L78](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/monitoring/longview.nix#L78)\r\n@rvl\r\nPR: https://github.com/NixOS/nixpkgs/pull/24366\r\n\r\n- [ ] `services.matrix-synapse.macaroon_secret_key`\r\n[nixos/modules/services/misc/matrix-synapse.nix#L545](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/misc/matrix-synapse.nix#L545)\r\n@roblabla\r\n\r\n- [ ] `services.matrix-synapse.registration_shared_secret`\r\n[nixos/modules/services/misc/matrix-synapse.nix#L453](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/misc/matrix-synapse.nix#L453)\r\n@roblabla\r\n\r\n- [ ] `services.matrix-synapse.turn_shared_secret`\r\n[nixos/modules/services/misc/matrix-synapse.nix#L434](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/misc/matrix-synapse.nix#L434)\r\n@roblabla\r\n\r\n- [ ] `services.matrix-synapse.recaptcha_private_key`\r\n[nixos/modules/services/misc/matrix-synapse.nix#L404](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/misc/matrix-synapse.nix#L404)\r\n@roblabla\r\n\r\n- [ ] `services.mattermost.localDatabasePassword`\r\n[nixos/modules/services/web-apps/mattermost.nix#L108](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/web-apps/mattermost.nix#L108)\r\n@fpletz\r\n\r\n- [ ] `services.murmur.password`\r\n[nixos/modules/services/networking/murmur.nix#L105](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/networking/murmur.nix#L105)\r\n@thoughtpolice\r\n\r\n- [ ] `services.mysql.replication.masterPassword`\r\n[nixos/modules/services/databases/mysql.nix#L149](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/databases/mysql.nix#L149)\r\n@edolstra\r\n\r\n- [ ] `services.namecoind.rpc.password`\r\n[nixos/modules/services/networking/namecoind.nix#L90](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/networking/namecoind.nix#L90)\r\n@rnhmjoj\r\nSee: https://github.com/namecoin/namecoin-core/issues/148\r\n\r\n- [ ] `services.nntp-proxy.upstreamPassword`\r\n[nixos/modules/services/networking/nntp-proxy.nix#L99](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/networking/nntp-proxy.nix#L99)\r\n@fadenb\r\n\r\n- [ ] `services.oauth2_proxy.cookie.secret`\r\n[nixos/modules/services/security/oauth2_proxy.nix#L371](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/security/oauth2_proxy.nix#L371)\r\n@jml\r\n\r\n- [ ] `services.panamax.secretKey`\r\n[nixos/modules/services/cluster/panamax.nix#L63](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/cluster/panamax.nix#L63)\r\n@matejc\r\n\r\n- [ ] `services.prometheus.*.consul_sd_config.password`\r\n[nixos/modules/services/monitoring/prometheus/default.nix#L243](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/monitoring/prometheus/default.nix#L243)\r\n@fpletz @doshitan\r\n\r\n- [ ] `services.prometheus.*.scrape_config.basic_auth.password`\r\n[nixos/modules/services/monitoring/prometheus/default.nix#L128](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/monitoring/prometheus/default.nix#L128)\r\n@fpletz @doshitan\r\n\r\n- [ ] `services.prometheus.unifiExporter.unifiPassword`\r\n[nixos/modules/services/monitoring/prometheus/unifi-exporter.nix#L45](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/monitoring/prometheus/unifi-exporter.nix#L45)\r\n@fpletz @doshitan\r\n\r\n- [ ] `services.redis.requirePass`\r\n[nixos/modules/services/databases/redis.nix#L160](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/databases/redis.nix#L160)\r\n@offlinehacker\r\n\r\n- [ ] `services.redmine.databasePassword`\r\n[nixos/modules/services/misc/redmine.nix#L103](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/misc/redmine.nix#L103)\r\n@domenkozar\r\n\r\n- [ ] `services.redsocks.redsocks.password`\r\n[nixos/modules/services/networking/redsocks.nix#L109](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/networking/redsocks.nix#L109)\r\n@Ekleog\r\n\r\n- [ ] `services.rippleDataApi.couchdb.pass`\r\n[nixos/modules/services/misc/ripple-data-api.nix#L109](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/misc/ripple-data-api.nix#L109)\r\n@offlinehacker\r\n\r\n- [ ] `services.rippled.ports.*.password`\r\n[nixos/modules/services/misc/rippled.nix#L114](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/misc/rippled.nix#L114)\r\n@ehmry\r\n\r\n- [ ] `services.selfoss.database.password`\r\n[nixos/modules/services/web-apps/selfoss.nix#L89](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/web-apps/selfoss.nix#L89)\r\n@regnat\r\n\r\n- [ ] `services.terraria..password`\r\n[nixos/modules/services/games/terraria.nix#L50](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/games/terraria.nix#L50)\r\n@pshendry @garbas\r\n\r\n- [ ] `services.tor.torsocks.socks5Password`\r\n[nixos/modules/services/security/torsocks.nix#L89](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/security/torsocks.nix#L89)\r\n@thoughtpolice\r\n\r\n- [ ] `services.tt-rss.database.password`\r\n[nixos/modules/services/web-apps/tt-rss.nix#L163](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/web-apps/tt-rss.nix#L163)\r\n@zohl\r\n\r\n- [ ] `services.tt-rss.email.password`\r\n[nixos/modules/services/web-apps/tt-rss.nix#L291](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/web-apps/tt-rss.nix#L291)\r\n@zohl\r\n\r\n- [ ] `services.wakeonlan.interfaces.*.password`\r\n[nixos/modules/services/networking/wakeonlan.nix#L32](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/networking/wakeonlan.nix#L32)\r\n\r\n- [ ] `services.yandex-disk.password`\r\n[nixos/modules/services/network-filesystems/yandex-disk.nix#L38](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/network-filesystems/yandex-disk.nix#L38)\r\n@grwlf @7c6f434c\r\n\r\n- [ ] `services.zabbixServer.dbPassword`\r\n[nixos/modules/services/monitoring/zabbix-server.nix#L66](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/monitoring/zabbix-server.nix#L66)\r\n@robberer\r\n\r\nThis list was compiled by running the following in `<nixpkgs>` and manually inspecting and processing the result:\r\n\r\n```bash\r\nfind . -type f -exec grep --color -nH -i -E -e '(secret|pass|key)' {} +`\r\n```"},"comment":{"url":"https://api.github.com/repos/NixOS/nixpkgs/issues/comments/374921027","html_url":"https://github.com/NixOS/nixpkgs/issues/24288#issuecomment-374921027","issue_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/24288","id":374921027,"user":{"login":"volth","id":508305,"avatar_url":"https://avatars3.githubusercontent.com/u/508305?v=4","gravatar_id":"","url":"https://api.github.com/users/volth","html_url":"https://github.com/volth","followers_url":"https://api.github.com/users/volth/followers","following_url":"https://api.github.com/users/volth/following{/other_user}","gists_url":"https://api.github.com/users/volth/gists{/gist_id}","starred_url":"https://api.github.com/users/volth/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/volth/subscriptions","organizations_url":"https://api.github.com/users/volth/orgs","repos_url":"https://api.github.com/users/volth/repos","events_url":"https://api.github.com/users/volth/events{/privacy}","received_events_url":"https://api.github.com/users/volth/received_events","type":"User","site_admin":false},"created_at":"2018-03-21T12:31:40Z","updated_at":"2018-03-21T12:31:40Z","author_association":"CONTRIBUTOR","body":"> How is storing secrets in the nix store different from hardcoding them into the binary? Or a library used by the binary? No difference to me.\r\n\r\nExactly. If the binary stored in the nix store :)\r\n\r\nThere is the second part - the private key which:\r\n1. is not in nix store, but is /etc/sshd/ (or on a hardware token) \r\n2. is not part of any deployment, not the current one nor any deployment in the past.\r\n2. will be needed to decrypt the secret stored in the nix store (embedded in the binary or as a separate file, this does not matter)"}}
{"actor":{"display_login":"volth"}}