diff options
| author | Robert Günzler <r@gnzler.io> | 2022-07-01 16:50:25 +0200 |
|---|---|---|
| committer | Robert Günzler <r@gnzler.io> | 2022-08-02 22:13:49 +0200 |
| commit | dd31339e49c28b9c719b60425c5f7ae31a0e45f4 (patch) | |
| tree | ad84e975ec2a1259e11cefa006c502a47e3f6f7e /os/README.md | |
| parent | ca1bfeaab7613c210f31775d0636cfcd7caa694c (diff) | |
os: finish implementing including encryption using sops
Diffstat (limited to 'os/README.md')
| -rw-r--r-- | os/README.md | 17 |
1 files changed, 12 insertions, 5 deletions
diff --git a/os/README.md b/os/README.md index 8ca3356..80db948 100644 --- a/os/README.md +++ b/os/README.md @@ -1,8 +1,15 @@ -# os configuration +# OS configuration -TODO script that does: +use `os-conf` to save and `os-conf -r /` to restore configuration +the script reads a manifest file inside `$OS_DIR`, which defaults to `$HOME/os` -* parse manifest -* backup listed files from rootfs -* patch/add files in rootfs +## manifest syntax +lines prefixed with `#` or `$` are ignored, the magic comment `#secret`, when +appended to a line, marks the entry as containing data that shouldn't be checked +into a public repository. Instead we use [sops](https://github.com/mozilla/sops) to encrypt and store it under +`$OS_DIR/tmp/os-secret-*`. These encrypted archives are transparently handled +by the restore code. + +Encryption requires the `SOPS_PGP_FP` environment variable (or whatever is required +by any of the other supported encryption schemes). |