sops-nix icon indicating copy to clipboard operation
sops-nix copied to clipboard

sops-nix gives up on life if any file fails to decrypt

Open crabdancing opened this issue 7 months ago • 0 comments

Ideally, the script for installing secrets would install as many of the secrets as possible. A single failure-to-decrypt does not indicate that the whole system is in a invalid state. But, as it currently behaves, if you ever have an invalid expression, like:

sops.secrets = {
   not_supposed_to_be_here = {
      sopsFile = self + "/secrets/no_decryption_key_for_this.yaml":
      format = "yaml":
      mode = "600";
   };
};

The result is that it breaks the entire decryption process, meaning that even keys that ARE available fail to materialize their corresponding secrets. For many servers, this takes down almost all services, resulting in unnecessary downtime. This does not seem intentional.

crabdancing avatar May 29 '25 19:05 crabdancing