In reply to @ryantm:matrix.org
REASON...UNKNOWN: can you share your relevant NixOS config?

In reply to @ryantm:matrix.org
Also double check you've staged the secrets into your flake repo.

Hi! First wanna say thanks for happy years using agenix ^^

I just upgraded a NixOS host to 22.11 and in so doing updated the agenix flake input from rev. 7e5e58 (committed May 16). The result is unexpected: secrets are properly decrypted to the secrets mount point (i.e., to /run/agenix.d/<agenix generation>/<name>), but they are not properly symlinked to the secrets directory (/run/agenix) or to a custom path when specified. Instead, only a single symlink to the generation directory containing all the decrypted secrets (/run/agenix.d/<agenix generation>) is created in the secrets directory.

For example, with the following configuration (unchanged for several NixOS releases):

age.secrets."passwordFile".file = ./. + "/../../secrets/passwordFile.age";

users.users.me = {
  isNormalUser = true;
  passwordFile = config.age.secrets.passwordFile.path;
};

a rebuild generates the following output:

[agenix] creating new generation in /run/agenix.d/1
[agenix] decrypting secrets...
decrypting '/nix/store/<hash redacted>-passwordFile.age' to '/run/agenix.d/1/passwordFile'...
[agenix] symlinking new secrets to /run/agenix (generation 1)...
warning: password file ‘/run/agenix/passwordFile’ does not exist
[agenix] chowning...

and a listing of the resulting secrets directory is as follows:

$ ll /run/agenix
lrwxrwxrwx root root  1 -> /run/agenix.d/1

Since I haven't updated this host in a while, maybe there's a setting I missed? Thanks!

ryantm: thanks for your reply!

• I have one activation script in the configuration that ensures some directories exist, but nothing related to secrets.

• /run/agenix.d/1 contains the decrypted secrets. E.g.:

  drwxr-x--x root keys .
  drwxr-x--x root keys ..
  -r-------- root root passwordFile
  

• I'm using the default value of config.age.secretsDir.