agenix

Encrypt and decrypt NixOS secrets with age and SSH keys.

21|Updated Jan 5, 2024

Search Tags:#encryption #secrets #SSH #age #NixOS #decryption #agenix

Ready to run

npx skills add https://github.com/olafkfreund/nixos_config --skill agenix

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: agenix
Source: https://github.com/olafkfreund/nixos_config/tree/main/.gemini/skills/agenix
Command: npx skills add https://github.com/olafkfreund/nixos_config --skill agenix

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Agenix provides secure management of secrets in NixOS configurations by encrypting sensitive values with age and enabling runtime decryption during activation, avoiding plaintext secrets in the Nix store.

Core Features & Use Cases

Secret encryption and decryption: Uses age with SSH keys to protect secrets stored in your NixOS configuration and deployed systems.
NixOS and Home Manager integration: Secrets decrypt automatically during nixos-rebuild switch and system activation, ensuring runtime availability without exposing plaintext.
Version-control friendly workflow: Encrypted secrets are tracked in version control; only encrypted data is stored, never plaintext.
Use Case: Store API keys and database passwords as encrypted .age files and reference them in age.secrets.* within your configuration for secure deployment.

Quick Start

Set EDITOR and create a secret: agenix -e secret.age
Rekey when keys change: agenix --rekey
Decrypt to verify content: agenix -d secret.age

Frequently Asked Questions about agenix

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I manage secrets in NixOS without storing plaintext in the Nix store?▼

You can manage NixOS secrets by encrypting sensitive values with age and enabling runtime decryption during activation. Agenix encrypts secrets as .age files, avoiding plaintext exposure in the Nix store while making them available at runtime.

How do I use SSH keys for age encryption in my NixOS configuration?▼

Agenix uses your existing SSH keys to perform age-based encryption and decryption. You encrypt secret files using the age tool and SSH keys, and the agenix NixOS module decrypts them automatically during system activation.

Can I version control encrypted secrets for NixOS deployments?▼

Yes, you can version control encrypted secrets safely. Only encrypted .age files are tracked in version control, never plaintext, ensuring secure deployment across NixOS hosts while maintaining a fully reproducible configuration history.

Do I need Flakes and Home Manager to use age-based secret management in NixOS?▼

You need a NixOS environment with Flakes-enabled configuration and the agenix NixOS module. The skill applies to NixOS deployments with Flakes and Home Manager, covering secret creation, encryption, deployment, and runtime decryption.

What is the best way to rotate or rekey NixOS secrets when SSH keys change?▼

To rekey NixOS secrets when SSH keys change, run the agenix --rekey command. This re-encrypts your existing .age files with the updated recipient keys, allowing seamless key rotation without manually decrypting and re-encrypting each secret.

How do I create and edit an encrypted secret file for NixOS?▼

To create and edit an encrypted secret file, set your EDITOR environment variable and run agenix -e secret.age. This opens the secret in your editor, encrypts it upon saving, and allows you to verify content later with agenix -d secret.age.