Support changing permissions on secret directories

[virchau13]

I have a whole bunch of secrets stored in the /run/secrets/scripts directory. I want to put the directory /run/secrets/scripts into a non-root user's $PATH, but since that user doesn't have permission to read the directory, it doesn't work.

This can be worked around by manually symlinking to the secrets, but it would be great to have this as a normal feature.

[Mic92]

Not sure what the configuration would look for this since permissions are nested...

[dasJ]

Two ideas pop into my head, one in yaml, one in nix:

slapd:
  __dirMode: 0755
  __dirOwner: slapd
  password: abc

{
  sops.secrets."slapd/password" = {};
  sops.dirPermissions.slapd = {
    mode = "0755";
    owner = "slapd";
  };
}

[Mic92]

Mhm, this seems like quite a bit of extra complexity for each feature that not many people use.