🔐 agenix-go

This is a standalone implementation of the agenix cli and can therefore be used on Linux and MacOS systems that do not have a Nix environment.

I am using NixOS on my servers, but my development machines are still running regular Linux and MacOS. So far, this meant that I could only change my agenix secrets on one of the actual NixOS machines, since I couldn't edit or rekey my agenix files elsewhere. This project aims to solve this.

The project uses the official filippo.io/age Go library for encryption.

However, one tradeoff was necessary to make this project fully standalone: The configuration has now been moved to a TOML file as fully parsing nix configuration, would have either required a full dependency on Nix or error-prone custom parsing logic.

Download a prebuilt binary from the GitHub Releases page. Linux and macOS binaries are available as tarballs. Linux releases also provide .deb and .rpm packages.

Alternatively, install with a supported Go toolchain:

go install github.com/lucianweber/agenix-go/cmd/agenix@latest

To build from source run this:

go build -o agenix ./cmd/agenix

The resulting binary has no runtime dependency on Go or Nix. An external editor is only required for interactive editing.

Create agenix.toml in the directory where commands will run. See agenix.example.toml.

▶ Recipients are the named public SSH keys that will be used to encrypt a secret. The corresponding private key is supplied to agenix -i when the secret needs to be decrypted.

▶ Groups can contain recipient names or other groups.

▶ Secret paths are relative to the directory containing agenix.toml.

An original rule such as:

{
  "database-password.age" = {
    publicKeys = [ alice server ];
    armor = true;
  };
}

becomes:

[recipients]
alice = "ssh-ed25519 AAAA..."
server = "ssh-ed25519 AAAA..."

[secrets."database-password"]
file = "database-password.age"
recipients = ["alice", "server"]
armor = true

The CLI does not evaluate or automatically convert arbitrary Nix expressions.

Create or edit a secret:

agenix -e secrets/database-password.age

Create or replace a secret from standard input:

printf '%s' 'correct horse battery staple' | \
  agenix -e secrets/database-password.age

Decrypt to standard output:

agenix -d secrets/database-password.age

Rekey all secrets with explicitly specified configuration and decryption key:

agenix -r -c ./secrets/agenix.toml -i /etc/ssh/ssh_host_ed25519_key

Show more usage options:

agenix --help

By default, the CLI reads ./agenix.toml. Choose a different configuration with -c/--config FILE.

If no identity is specified, agenix-go will try to use ~/.ssh/id_rsa and ~/.ssh/id_ed25519.

For interactive edits, agenix-go uses $EDITOR, then $VISUAL, then nano from $PATH.

go test ./...
go test -race ./...
go vet ./...

agenix-go is distributed under the BSD 3-Clause License.