pinpox
b9ca37a597
PR Size Review Check / pr-size-review-gate (pull_request) Successful in 14s
sizelint on each commit / sizelint (pull_request) Successful in 21s
buildbot/nix-eval evaluation succeeded in 1m 3s (3 warnings)
buildbot/nix-build 150 attributes built
PR Size Review Check / pr-size-review-gate (pull_request_review) Successful in 15s
gitea-mq/buildbot/nix-eval evaluation succeeded in 1m 11s (3 warnings)
gitea-mq/buildbot/nix-build gitea:clan/clan-core#checks.aarch64-linux.clan-pytest-with-core From a previous merge queue attempt
gitea-mq/buildbot/nix-build 150 attributes built
gitea-mq Merge queue passed
The age secret store lives in <flake>/secrets and is committed to the flake repository. For public flake repos this permanently publishes the encrypted secrets with their history. Setting `vars.settings.age.externalStore = true` keeps the entire store (machine keys, secrets, recipients sidecars) outside the flake. The flag only commits the intent; each admin points CLAN_AGE_STORE_DIR at their local copy of the store, so admins of shared infra can keep it in different places. If that directory is a git repository, clan commits store changes there with the same messages; nothing store-related touches the flake repo. External secrets are not part of the system closure: age.nix decrypts them from a runtime path under secretLocation (pinned against populate_dir's upload layout by the age-source-path eval test) and populate_dir uploads the encrypted files next to the machine key. The internal store keeps its strict eval-time semantics. Misconfigurations fail loudly: the flag without the env var, the env var without the flag, a store dir inside the flake repo, or a non-empty in-repo store.