forked from clan/clan-core
docs/secrets: improve chapter assigning access
Since we already walk the user through creating a secret in an earlier step, it makes more sense explain first how to add machines/users to an existing secret instead of creating a new one
This commit is contained in:
parent
418e9937cb
commit
f1f040397d
@ -106,17 +106,20 @@ In your nixos configuration you can get a path to secrets like this `config.sops
|
|||||||
|
|
||||||
### Assigning Access
|
### Assigning Access
|
||||||
|
|
||||||
By default, secrets are encrypted for your key. To specify which users and machines can access a secret:
|
When using `clan secrets set <secret>` without arguments, secrets are encrypted for the key of the user named like your current $USER.
|
||||||
|
|
||||||
```bash
|
To add machines/users to an existing secret use:
|
||||||
clan secrets set --machine <machine1> --machine <machine2> --user <user1> --user <user2> <secret_name>
|
|
||||||
```
|
|
||||||
You can also just add machines/users to existing secrets:
|
|
||||||
|
|
||||||
```bash
|
```bash
|
||||||
clan secrets machines add-secret <machine_name> <secret_name>
|
clan secrets machines add-secret <machine_name> <secret_name>
|
||||||
```
|
```
|
||||||
|
|
||||||
|
Alternatively specify users and machines while creating a secret:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
clan secrets set --machine <machine1> --machine <machine2> --user <user1> --user <user2> <secret_name>
|
||||||
|
```
|
||||||
|
|
||||||
## Advanced
|
## Advanced
|
||||||
|
|
||||||
In this section we go into more advanced secret management topics.
|
In this section we go into more advanced secret management topics.
|
||||||
@ -188,11 +191,9 @@ Since our clan secret module will auto-import secrets that are encrypted for a p
|
|||||||
you can now remove `sops.secrets.<secrets> = { };` unless you need to specify more options for the secret like owner/group of the secret file.
|
you can now remove `sops.secrets.<secrets> = { };` unless you need to specify more options for the secret like owner/group of the secret file.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
## Indepth Explanation
|
## Indepth Explanation
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
The secrets system conceptually knows two different entities:
|
The secrets system conceptually knows two different entities:
|
||||||
|
|
||||||
- **Machine**: consumes secrets
|
- **Machine**: consumes secrets
|
||||||
|
Loading…
Reference in New Issue
Block a user