HN user

domenkozar

667 karma
Posts58
Comments79
View on HN
secretspec.dev 2d ago

Secrets Don't Belong in Config

domenkozar
17pts4
secretspec.dev 6d ago

SecretSpec 0.15: Provider Credentials, Azure Key Vault / Gopass, and PHP SDK

domenkozar
2pts0
secretspec.dev 19d ago

SecretSpec 0.13: SDKs for Python, Node.js, Go, Ruby, and Haskell

domenkozar
3pts0
devenv.sh 26d ago

Making devenv start fast, and the whole nixpkgs with it

domenkozar
2pts0
secretspec.dev 1mo ago

SecretSpec 0.12: audit logs and coding agents

domenkozar
3pts0
devenv.sh 2mo ago

Devenv 2.1: Nix with native support for zsh, fish, and nushell via libghostty

domenkozar
6pts1
devenv.sh 7mo ago

Devenv 1.11: Module changelogs and SecretSpec 0.4.0

domenkozar
1pts0
devenv.sh 9mo ago

Devenv 1.10: monorepo Nix support with devenv.yaml imports

domenkozar
3pts0
paretosecurity.com 10mo ago

Ephemeral Win11 testing VM for a few bucks per month

domenkozar
3pts0
devenv.sh 10mo ago

Devenv 1.9: Scaling Nix projects using modules and profiles

domenkozar
11pts1
devenv.sh 11mo ago

Closing the Nix gap: From environments to packaged applications for rust

domenkozar
82pts46
lobste.rs 11mo ago

From Frustration to Power: What We Learned at Nixcademy

domenkozar
2pts0
devenv.sh 1y ago

Devenv 1.8: Progress TUI, SecretSpec, Listing Tasks, and Smaller Containers

domenkozar
5pts0
devenv.sh 1y ago

SecretSpec: Declarative Secrets Management

domenkozar
136pts36
devenv.sh 1y ago

Devenv 1.7: CUDA Support, Enhanced Tasks, and MCP Support

domenkozar
1pts0
devenv.sh 1y ago

Devenv 1.6: Extensible Ad-Hoc Nix Environments

domenkozar
2pts3
devenv.sh 1y ago

Devenv 1.5: Overlays Support and Performance Improvements

domenkozar
2pts0
devenv.sh 1y ago

Devenv 1.3: Instant developer environments with Nix caching

domenkozar
3pts0
devenv.sh 1y ago

Devenv 1.2: Tasks for convergent configuration with Nix

domenkozar
1pts0
devenv.sh 1y ago

Devenv 1.1: Nested Nix outputs using the module system

domenkozar
4pts0
www.youtube.com 2y ago

Developer environments using devenv.sh [video]

domenkozar
2pts0
devenv.sh 2y ago

Fast, Declarative, Reproduble and Composable Developer Environments Using Nix

domenkozar
111pts73
devenv.sh 2y ago

Devenv (Nix developer environments) 1.0: Rewrite in Rust

domenkozar
4pts0
github.com 2y ago

GPTComment: Enforce Conventions Using GPT

domenkozar
2pts0
blog.cachix.org 2y ago

Downtime due to sign up spam

domenkozar
3pts1
blog.cachix.org 2y ago

Cachix v1.7

domenkozar
1pts0
discourse.nixos.org 2y ago

Flakestry.dev – New Registry for Flakes

domenkozar
3pts0
twitter.com 3y ago

Nix.dev Moved to the NixOS Foundation

domenkozar
3pts0
www.cachix.org 3y ago

Managed self-hosted GitHub runners for Nix

domenkozar
2pts0
sandstorm.de 3y ago

My first steps with Nix on Mac OS X as Homebrew replacement

domenkozar
2pts0
Zed is our office 8 months ago

You guys need to figure out how to create Slack shared channels in Zed and we're all switching until they won't be needed anymore.

Look at the problem statement, it's exactly the same. When I designed secretspec, I researched the space and no other tool approached secrets in such a way.

Syntax of toml is almost identical, the CLI as well.

It even has the same vocabulary.

I didn't dig deeper though, but I'd be surprised not to find more :)

I'll reply, even though I don't like the tone the first sentance sets :)

I'm not sure exactly what parts of the comment are about secrets rather than how infrastructure should be done, but I see that secrets and configuration have very different lifetimes so they should be provisioned separately. The config can for example be in the git if it's free of secrets.

Secrets are provisioned at runtime, while config is build time.

`secretspec.toml` is in the version control and it tells you all about what's going to happen at runtime.

I'm not advocating that different locations of secrets IS something we want, but rather it IS the sad state of reality.

By having a secrets specification we can start working towards a future that will consolidate these providers and allow teams to centralize it if needed, by having simple means of migrating from a mess into a central system.

The example is more of a way to show how to keep backwards compatibility and migration to secretspec.

We hope that one day github actions would integrate secretspec more tightly, leaving aside using environment variables as a transport.

That's going to be a long journey, one worth striving for.

That's a mouthful for 14 lines of native development that can generate a dev container using https://devenv.sh

$ cat devenv.nix

{ pkgs, ... }: {

  languages.c.enable = true;

  packages = [ pkgs.ceedling pkgs.cmake ];

  enterShell = ''
    cmake --version
  '';

  pre-commit.hooks = { 
    clang-format.enable = true;
    clang-tidy.enable = true;
  };
}

$ devenv shell

(Note that pkgs.ceedling has been recently added and will only hit the cache in 6-12h).

If you decide to try https://devenv.sh, it has OCaml support built-in:

  $ cat devenv.nix
  { config, ...}: 
  let
    ocamlPackages = config.languages.ocaml.packages;
  in { 
    languages.ocaml.enable = true;

    packages = [ ocamlPackages.janeStreet.async ];
  }

  $ devenv shell
  ...
Recently also shipped 0.6 with container generation support: https://devenv.sh/containers/

Let me know if you give it a try :)