sops-nix无法向Syncthing导入原始密钥字符串的问题求助

问题场景 #

在NixOS配置中使用sops-nix管理Syncthing的设备ID、GUI账户等密钥，尝试直接将sops.secrets对象赋值给Syncthing配置字段时，出现类型错误。

原配置代码 #

sops = {
  defaultSopsFile = ../../secrets/secrets.yaml;
  defaultSopsFormat = "yaml";
  age = {
    sshKeyPaths = [ "/home/horseman/.ssh/id_ed25519" ];
    keyFile = "/home/horseman/.config/sops/age/keys.txt";
    generateKey = true;
  };

  secrets = {
    "syncthing/luna".owner = "horseman";
    "syncthing/terra".owner = "horseman";
    "syncthing/solis".owner = "horseman";
    "syncthing/gui_user".owner = "horseman";
    "syncthing/gui_password".owner = "horseman";
  };
};

services.syncthing = {
  enable = true;
  user = "horseman";
  dataDir = "/home/horseman";
  configDir = "/home/horseman/nix-config/config/syncthing";
  overrideDevices = true;
  overrideFolders = true;
  settings = {
    devices = {
      "luna" = { id = config.sops.secrets."syncthing/luna"; };
      "terra" = { id = config.sops.secrets."syncthing/terra"; };
    };
    folders = {
      "Documents" = {
        path = "/home/horseman/Documents";
        devices = [ "terra" "luna" ];
      };
      "Programming" = {
        path = "/home/horseman/Programming";
        devices = [ "terra" "luna" ];
      };
    };
    gui = {
      user = config.sops.secrets."syncthing/gui_user";
      password = config.sops.secrets."syncthing/gui_password";
    };
  };
};

错误信息 #

执行sudo nixos-rebuild switch时触发类型错误：

error: A definition for option `services.syncthing.settings.devices.terra.id' is not of type `string'. Definition values:
       - In `/nix/store/z1w6lbli6y1yj0vhwvm0gq13ganifflz-source/machines/common/configuration.nix':
           {
             format = "yaml";
             group = "users";
             key = "syncthing/terra";
             mode = "0400";

解决方法 #

1. 设备ID处理（优先推荐） #

设备ID是Syncthing的公开识别码，无需保密，直接将ID字符串写入配置即可：

services.syncthing.settings.devices = {
  "luna" = { id = "你的Luna设备ID字符串"; };
  "terra" = { id = "你的Terra设备ID字符串"; };
};

2. 设备ID必须保密的场景 #

若一定要通过sops管理设备ID，需在Syncthing启动前动态修改配置文件（避免构建阶段泄露秘密）：

services.syncthing = {
  # 保留原有基础配置
  enable = true;
  user = "horseman";
  dataDir = "/home/horseman";
  configDir = "/home/horseman/nix-config/config/syncthing";
  overrideDevices = true;
  overrideFolders = true;

  # 预启动脚本：读取秘密文件内容并替换配置占位符
  serviceConfig.PreStart = ''
    # 替换Luna设备ID
    sed -i 's/"id": "LUNA_PLACEHOLDER"/"id": "'$(cat ${config.sops.secrets."syncthing/luna".path})'"/' ${config.services.syncthing.configDir}/config.xml
    # 替换Terra设备ID
    sed -i 's/"id": "TERRA_PLACEHOLDER"/"id": "'$(cat ${config.sops.secrets."syncthing/terra".path})'"/' ${config.services.syncthing.configDir}/config.xml
  '';

  # 初始化配置时设置占位符
  settings = {
    devices = {
      "luna" = { id = "LUNA_PLACEHOLDER"; };
      "terra" = { id = "TERRA_PLACEHOLDER"; };
    };
    folders = {
      "Documents" = {
        path = "/home/horseman/Documents";
        devices = [ "terra" "luna" ];
      };
      "Programming" = {
        path = "/home/horseman/Programming";
        devices = [ "terra" "luna" ];
      };
    };
  };
};

3. GUI账户与密码处理 #

使用Syncthing原生的命令行参数读取秘密文件，避免将密码写入Nix store：

services.syncthing = {
  # 保留原有基础配置
  enable = true;
  user = "horseman";
  dataDir = "/home/horseman";
  configDir = "/home/horseman/nix-config/config/syncthing";
  overrideDevices = true;
  overrideFolders = true;

  # 添加命令行参数读取秘密文件
  extraOptions = [
    "--gui-user-file=${config.sops.secrets."syncthing/gui_user".path}"
    "--gui-password-file=${config.sops.secrets."syncthing/gui_password".path}"
  ];

  # 移除settings.gui中的user和password配置，保留其他GUI设置（如端口、访问控制）
  settings.gui = {
    # 示例：设置GUI监听地址
    address = "127.0.0.1:8384";
  };
};

核心原因 #

config.sops.secrets."xxx"返回的是包含路径、权限等元数据的秘密对象，而非明文内容。Nix构建阶段禁止直接获取秘密明文（防止泄露到Nix store），因此不能直接将其赋值给需要字符串类型的配置项，必须通过运行时读取秘密文件的方式使用。

内容的提问来源于stack exchange，提问作者Mr Horseman