skills.rest
iamruinous
iamruinousCOMMUNITY
Explore all skills by this author →
Website𝕏@iamruinousGitHub

rekey-secrets

Rekey secrets across hosts defined in secrets.nix after .age file changes.

8|1|Updated Oct 21, 2015
Search Tags:#security#encryption#secrets#age#agenix#rekey
One-click install
npx skills add https://github.com/iamruinous/nix-config --skill rekey-secrets
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: rekey-secrets
Source: https://github.com/iamruinous/nix-config/tree/main/.opencode/skills/rekey-secrets
Command: npx skills add https://github.com/iamruinous/nix-config --skill rekey-secrets

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Re-encrypt all secrets after modifying .age files or when host keys change. The manual process is error-prone and risks secret visibility if keys drift across hosts.

Core Features & Use Cases

  • Rekey all secrets across hosts defined in secrets.nix to ensure consistent encryption state after key rotations or .age file updates.
  • Enable onboarding of new hosts with correctly encrypted secrets and rekeying workflow.
  • Integrate with agenix and agenix-helper to unlock, rekey, and lock secrets securely.

Quick Start

Run a full rekey of all secrets after updating any .age files to ensure encryption integrity.

Frequently Asked Questions about rekey-secrets

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I re-encrypt secrets after changing host keys in agenix?▼

To rekey secrets after changing host keys in agenix, run a full rekey across all hosts defined in secrets.nix to ensure encryption consistency and secure the repository against key drift.

When do I need to rekey .age files in a Nix secrets repository?▼

You need to rekey .age files when host keys change or after modifying them during onboarding. Rekeying applies across all hosts defined in secrets.nix to maintain consistent encryption state and prevent secret visibility.

What is the best way to onboard a new host with existing age secrets?▼

The best way to onboard a new host with age secrets is to trigger a full rekey workflow. This updates the encryption state across all hosts defined in secrets.nix, ensuring the new host receives correctly encrypted private material.

Does rekeying secrets require agenix-helper to unlock and secure the repository?▼

Yes, rekeying secrets requires both agenix and agenix-helper. These tools unlock, rekey, and lock secrets securely, ensuring the repository remains protected after modifying .age files or rotating keys.

Why does manually re-encrypting age secrets risk secret visibility?▼

Manually re-encrypting age secrets risks visibility because the process is error-prone and keys can drift across hosts. Automating the rekey ensures consistent encryption state across all defined hosts without exposing private material.

Related Skills

Explore More Software Engineering Skills→
greenheadHQgreenheadHQ
4

managing-secrets

Manage encrypted .age secrets across Home Manager and NixOS with agenix.

Community
Advanced
DaRacciDaRacci
18

secrets

Manage encrypted secrets with sops-nix and age for NixOS configurations.

Community
Advanced
iamruinousiamruinous
8

view-secret

Decrypt and view .age secret files using a specified path.

Community
Intermediate
kressnerdkressnerd
2

SOPS Secrets Management

Decrypt and manage sops-nix secrets for NixOS and macOS deployments.

Community
Advanced