DavHau/clan-core
1
0
Fork 0
forked from clan/clan-core
Code Pull Requests Activity

docs/secrets: improve chapter assigning access

Browse Source 
Since we already walk the user through creating a secret in an earlier step, it makes more sense explain first how to add machines/users to an existing secret instead of creating  a new one
This commit is contained in:
DavHau 2024-05-28 13:08:03 +02:00
parent 418e9937cb
commit f1f040397d
1 changed files with 8 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
docs/site/getting-started/secrets.md
View File

@ -106,17 +106,20 @@ In your nixos configuration you can get a path to secrets like this `config.sops
### Assigning Access
By default, secrets are encrypted for your key. To specify which users and machines can access a secret:
When using `clan secrets set <secret>` without arguments, secrets are encrypted for the key of the user named like your current $USER.
```bash
clan secrets set --machine <machine1> --machine <machine2> --user <user1> --user <user2> <secret_name>
```
You can also just add machines/users to existing secrets:
To add machines/users to an existing secret use:
```bash
clan secrets machines add-secret <machine_name> <secret_name>
```
Alternatively specify users and machines while creating a secret:
```bash
clan secrets set --machine <machine1> --machine <machine2> --user <user1> --user <user2> <secret_name>
```
## Advanced
In this section we go into more advanced secret management topics.
@ -188,11 +191,9 @@ Since our clan secret module will auto-import secrets that are encrypted for a p
you can now remove `sops.secrets.<secrets> = { };` unless you need to specify more options for the secret like owner/group of the secret file.
## Indepth Explanation
The secrets system conceptually knows two different entities:
- **Machine**: consumes secrets