sops-nix
sops-nix copied to clipboard
sops-nix gives up on life if any file fails to decrypt
Ideally, the script for installing secrets would install as many of the secrets as possible. A single failure-to-decrypt does not indicate that the whole system is in a invalid state. But, as it currently behaves, if you ever have an invalid expression, like:
sops.secrets = {
not_supposed_to_be_here = {
sopsFile = self + "/secrets/no_decryption_key_for_this.yaml":
format = "yaml":
mode = "600";
};
};
The result is that it breaks the entire decryption process, meaning that even keys that ARE available fail to materialize their corresponding secrets. For many servers, this takes down almost all services, resulting in unnecessary downtime. This does not seem intentional.