Darwin Integration

[tuxiqae]

Just like #65, it could be cool to have a Darwin integration (nix-darwin?) Ideally via modules, like how sops-nix/agenix work.

[domenkozar]

I hope someone can pick this up!

[ojhermann]

Had a look at this on macOS and hit a prerequisite: the keyring provider needs to be able to target a specific keychain. Until it can, secretspec run can't wrap a launchd daemon at all, which rules out the most natural module shape. It's a small opt-in change, macOS-only, and I'd be happy to put up a PR for it.

This is a precondition rather than an answer to the issue as filed — the module shape still needs deciding. Two caveats: a daemon running as a user via UserName would fail differently, and I haven't tested the pre-login boot case.

Why the prerequisite: a root LaunchDaemon has no User-domain default keychain, so the provider fails there with errSecNoDefaultKeychain (-25307) — and the User domain is the one keyring pins us to. The System keychain reads fine from that same daemon context, and it's readable by ordinary users while only root can write it. User agents are unaffected: they have a login session and work today.