• 11 Posts
  • 784 Comments
Joined 2 years ago
cake
Cake day: July 7th, 2023

help-circle
  • This generally referred to as Key Rotation. It applies to everything from SSH keys, to API keys in running apps.

    There are automated ways to do this with ease, but it’s very simple to do with a single script, and some sort of secure key/value store (bitwarden, Vault, etcd…whatever).

    The process is basically something like:

    1. Create a script that runs on cron to check for a key at your k/v store at an expected location, like /ssh_keys/host1-private-12.1.25 and /ssh_keys/host1-public-12.1.25
    2. Deploy this script to all machines you wish to regularly rotate keys on and ensure running properly
    3. Generate new keys and put them in your k/v store at some versioned location/path like /ssh_keys/host1-private-12.21.25 and /ssh_keys/host1-pub-12.21.25
    4. Update your local script that regularly grabs these updated keys to point to the new version uploaded, bonus if your store can symlinkto some other locations like /ssh_keys/host1-private-current
    5. Wait X period of time to ensure all hosts get whatever key they need

    Your script can clear the old keys if needed but simply validating them in the access change serves the same effect. Up to you.












  • It might be better to first learn about existing package managers: build some packages for rpm, apt, pac…etc.

    The fundamentals would be easier to understand from there to figure out what you actually want to write and why.

    At their core, packages are simply just bundles of flat files, and stages of scripts that get executed. That’s it. Like a zip file with scripts.

    Package Managers on the other hand are just clients that deal with the metadata and contents of packages and decide what to do with them. They go way deeper.



  • just_another_person@lemmy.worldtoLinux@lemmy.worldNew to Linux
    link
    fedilink
    English
    arrow-up
    7
    arrow-down
    2
    ·
    20 days ago

    You won’t need a terminal unless you refuse to use the GUI tools that do the same thing.

    If you want to use the terminal, go for it and use the default. If you eventually find it lacking THEN start investigating different options.

    Just use everything as you normally would otherwise, and you shouldn’t notice a huge shift.


  • Well, no. Not to shoot down your comment or anything, but you’ve only learned a lot about Nix still in your example.

    For instance, if someone presented you with an Arch system of some sort and asked why a certain systems unit wasn’t working, or why the speakers on their laptop don’t work but the headphones jack does, or why their Nvidia kmod modules aren’t loading.

    Your experience with Nix is t going to help with some of the more basic functions of a traditional Linux system because of the abstractions in top of abstractions that you’re used to interacting with on Nix.

    I’m not even digging on Nix, like I said, it was designed for a very specific purpose. I’ve run hundreds, if not thousands, of various build system permutations on Nix over the years, and even I wouldn’t even think about using it for really basic stuff like running a Desktop 🤣



  • Traditional and Immutable distros as working OSes are not knowledge compatible at all. The software that runs on it is the same, but everything else about how they run, are executed, managed, installed…etc, all different.

    Nix is Immutable, and on top of that, has an entire configuration language you need to manage.

    If you’re not familiar with a standard Linux OS, you’re going to have a bad time, I can tell you that.

    As far as your concepts of “random commands” not being used as part of the running of a system, that is not quite correct. You will still to track adhoc changes to different services or configurations that would then need to also be applied and executed in a NiX config in the proper place to ensure proper order of execution.

    Let’s just say it’s an advanced system that serves a purpose meant for repeatable testing and CI/CD type operations. It’s not really meant to be a user-friendly system to make managing your desktop easier, so. don’t misunderstand this one important fact.