Symlink secrets like sops-nix does?

[cole-h]

I think I would prefer if agenix would ln -sf /run/secrets/${name} ${path} files to their desired locations rather than mv -f them. When path is outside of /run/secrets, this means the files will not be cleaned up automatically (e.g. on reboot).

Is there a reason agenix decided not to go this route?

[ryantm]

That sounds good. I'm aware of one tool, elasticsearch, that refuses to follow symlinks for supposed security benefits, but that doesn't come close to outweighing the benefits of secret cleanup.

[cole-h]

That sounds good. I'm aware of one tool, elasticsearch, that refuses to follow symlinks for supposed security benefits, but that doesn't come close to outweighing the benefits of secret cleanup.

(For completeness sake, also documenting this here:)
In that case, you can use the brand new age.secrets.<name>.symlink = false; option!