managing-secrets

To manage encrypted secrets with agenix, you declaratively declare secret files in a secrets.nix file and deploy them via two tiers: Home Manager for user space and NixOS modules for system-level services. This ensures secure .age file distribution across your hosts.

Deploying .age files across multiple NixOS hosts requires explicit public keys for all target machines. You encrypt the secrets using agenix, then control re-encryption and distribution declaratively through your NixOS configuration modules.

Yes, agenix supports a two-tier deployment model that works with both Home Manager and NixOS. This allows you to manage user-level secrets in your user space and system-level secrets for system services independently but through the same declarative workflow.

Decryption or re-encryption failures during deployment usually occur when explicit public keys for all hosts are missing or misconfigured in your secrets.nix. The Skill provides troubleshooting references to resolve these key management and permission issues.

To add a new secret, you declare it in your secrets.nix file, encrypt the corresponding file with agenix using the target host's public key, and then deploy the updated configuration through Home Manager or your NixOS module.