GitOps all the way: managing secrets with sops-nix and age
In my previous article about Nix, I explained why I switched to Nix and Flakes to push the GitOps philosophy all the way: my entire system and tools are defined in versioned code. However, as soon as you start putting everything into Git (especially in a public repository or one shared across multiple machines), you quickly hit a wall: what do we do with secrets? The secrets paradox in Nix On NixOS, there are two major pitfalls when handling a password, a private key, or an API token: ...