agenix

You can manage NixOS secrets by encrypting sensitive values with age and enabling runtime decryption during activation. Agenix encrypts secrets as .age files, avoiding plaintext exposure in the Nix store while making them available at runtime.

Agenix uses your existing SSH keys to perform age-based encryption and decryption. You encrypt secret files using the age tool and SSH keys, and the agenix NixOS module decrypts them automatically during system activation.

Yes, you can version control encrypted secrets safely. Only encrypted .age files are tracked in version control, never plaintext, ensuring secure deployment across NixOS hosts while maintaining a fully reproducible configuration history.

You need a NixOS environment with Flakes-enabled configuration and the agenix NixOS module. The skill applies to NixOS deployments with Flakes and Home Manager, covering secret creation, encryption, deployment, and runtime decryption.

To rekey NixOS secrets when SSH keys change, run the agenix --rekey command. This re-encrypts your existing .age files with the updated recipient keys, allowing seamless key rotation without manually decrypting and re-encrypting each secret.

To create and edit an encrypted secret file, set your EDITOR environment variable and run agenix -e secret.age. This opens the secret in your editor, encrypts it upon saving, and allows you to verify content later with agenix -d secret.age.