How to use agenix-rekey to set env var for nushell through home-manager?

[caniko]

I tried this:

{ config, inputs, lib, ... }:
{
  age.secrets = {
    pypi-cpypi.rekeyFile = "${inputs.self}/age/secrets/modules/pypi/pypi-cpypi.age";
  };

  programs.nushell.environmentVariables =
    let
      cpypiPassword = config.age.secrets.pypi-cpypi.path;
    in
    {
      POETRY_HTTP_BASIC_CPYPI_PASSWORD = cpypiPassword;
      UV_INDEX_CPYPI_PASSWORD = cpypiPassword;
    };
}

But it is only saving the path as env var. What am I doing wrong? It should support absolute paths according to what I found below.

From home manager description:

programs.nushell.environmentVariables

Description
Environment variables to be set.

Inline values can be set with lib.hm.nushell.mkNushellInline.
Type
attribute set of (null or (Nushell inline value) or boolean or signed integer or floating point number or string or absolute path or (attribute set of Nushell values) or (list of Nushell values))
Default

{ }

Example

{
FOO = "BAR";
LIST_VALUE = [ "foo" "bar" ];
PROMPT_COMMAND = lib.hm.nushell.mkNushellInline ''{|| "> "}'';
ENV_CONVERSIONS.PATH = {
from_string = lib.hm.nushell.mkNushellInline "{|s| $s | split row (char esep) }";
to_string = lib.hm.nushell.mkNushellInline "{|v| $v | str join (char esep) }";
};
}

[oddlama]

I'm not sure unfortunately, I don't have much nushell experience. Just from the option names though I would assume environmentVariables will set string values, so there is no logic that reads from the file.

Since this is not related to agenix-rekey or even agenix, I'd recommend raising this question to the nushell folks

[caniko]

It is probably a silly question, but why don't we have a way to pass string values?

[oddlama]

Do you mean In agenix / agenix-rekey? Because string values are required at evaluation time and thus they will be templated into some file (e.g. the nushell config). This means they will be put into the nix store in plain text.

Fundamentally, secrets must be decrypted on the target host to ensure they are safe during evaluation and build time. That means you will have to read them from a file at runtime at some point.

[caniko]

But it says absolute path in the typing:

Type
attribute set of (null or (Nushell inline value) or boolean or signed integer or floating point number or string or absolute path or (attribute set of Nushell values) or (list of Nushell values))

[oddlama]

Well, you can set a path as a variable. But it will stay a path.

[caniko]

Ohhh, so nushell doesn't have access to this path after rebuild because the sandbox is only available to the rebuild process? Meaning if I read the file into nushell config during the rebuild using some lib function it would work? Or would that spill the value into the lock file?

I feel I wouldn't get any help on the nushell side for this issue :/

Edit: I feel the feature that is missing is some sort of keyring integration with agenix that would allow us to store these secrets on the machine so that they could be retrieved outside of nix by using keyring integrations on apps. Is this something you have thought about?

[PatrickDaG]

I think the problem is that nushell doesn't read the file into the env. So if you set environmentVariables.a = /root.txt you will have $a == "/root.txt in your environment not $a == <content of /root.txt. That is why oddlama suggested talking to the nushell folk or the nixpkgs upstream module maintainers, they would have to expose a way for nushell to actually read the file.

Nushell would have access to the file only during runtime because that is when the secret has been decrypted by agenix.

Keyring integration would be nice, but I don't think we'll implement it ourselves for now as we are hopefull that NixOS/nixpkgs#370444 is the future which would allow us to do that quite a lot easier.