In reply to @bjrnmrtns:matrix.org
You might be correct my ssh private key is in ~/.ssh, so that might not be available yet.

In reply to @lordkekz:matrix.org
Weird. Can you show me your `mount` output? Maybe there's some shenanigans going on anyway.

devtmpfs on /dev type devtmpfs (rw,nosuid,size=1576200k,nr_inodes=3938055,mode=755)
devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,gid=3,mode=620,ptmxmode=666)
tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev)
proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)
tmpfs on /run type tmpfs (rw,nosuid,nodev,size=7880984k,mode=755)
ramfs on /run/keys type ramfs (rw,nosuid,nodev,relatime,mode=750)
tmpfs on /run/wrappers type tmpfs (rw,nodev,relatime,mode=755)
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,relatime)
/dev/nvme0n1p2 on / type btrfs (rw,relatime,compress=zstd:3,ssd,discard=async,space_cache=v2,subvolid=259,subvol=/rootfs)
/dev/nvme0n1p2 on /nix type btrfs (rw,noatime,compress=zstd:3,ssd,discard=async,space_cache=v2,subvolid=258,subvol=/nix)
/dev/nvme0n1p2 on /nix/store type btrfs (ro,noatime,compress=zstd:3,ssd,discard=async,space_cache=v2,subvolid=258,subvol=/nix)
none on /run/agenix.d type ramfs (rw,nosuid,nodev,relatime,mode=751)
securityfs on /sys/kernel/security type securityfs (rw,nosuid,nodev,noexec,relatime)
cgroup2 on /sys/fs/cgroup type cgroup2 (rw,nosuid,nodev,noexec,relatime,nsdelegate,memory_recursiveprot)
pstore on /sys/fs/pstore type pstore (rw,nosuid,nodev,noexec,relatime)
efivarfs on /sys/firmware/efi/efivars type efivarfs (rw,nosuid,nodev,noexec,relatime)
bpf on /sys/fs/bpf type bpf (rw,nosuid,nodev,noexec,relatime,mode=700)
systemd-1 on /proc/sys/fs/binfmt_misc type autofs (rw,relatime,fd=65,pgrp=1,timeout=0,minproto=5,maxproto=5,direct,pipe_ino=2765)
hugetlbfs on /dev/hugepages type hugetlbfs (rw,nosuid,nodev,relatime,pagesize=2M)
mqueue on /dev/mqueue type mqueue (rw,nosuid,nodev,noexec,relatime)
debugfs on /sys/kernel/debug type debugfs (rw,nosuid,nodev,noexec,relatime)
fusectl on /sys/fs/fuse/connections type fusectl (rw,nosuid,nodev,noexec,relatime)
configfs on /sys/kernel/config type configfs (rw,nosuid,nodev,noexec,relatime)
/dev/nvme0n1p2 on /disk-vdb-root type btrfs (rw,relatime,compress=zstd:3,ssd,discard=async,space_cache=v2,subvolid=5,subvol=/)
/dev/nvme0n1p2 on /home type btrfs (rw,relatime,compress=zstd:3,ssd,discard=async,space_cache=v2,subvolid=256,subvol=/home)
/dev/nvme0n1p1 on /boot type vfat (rw,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro)
binfmt_misc on /proc/sys/fs/binfmt_misc type binfmt_misc (rw,nosuid,nodev,noexec,relatime)
tmpfs on /run/user/1000 type tmpfs (rw,nosuid,nodev,relatime,size=3152392k,nr_inodes=788098,mode=700,uid=1000,gid=100)
portal on /run/user/1000/doc type fuse.portal (rw,nosuid,nodev,relatime,user_id=1000,group_id=100)

In reply to @lordkekz:matrix.org

In reply to @bjrnmrtns:matrix.org
You might be correct my ssh private key is in ~/.ssh, so that might not be available yet.

On what filesystem is your ssh key?

So this might give a better clue:

[bjorn@jennifer:~/projects/config]$ journalctl -b | grep agenix
Dec 04 13:27:17 jennifer stage-2-init: [agenix] creating new generation in /run/agenix.d/1
Dec 04 13:27:17 jennifer stage-2-init: [agenix] decrypting secrets...
Dec 04 13:27:17 jennifer stage-2-init: [agenix] WARNING: config.age.identityPaths entry /home/bjorn/.ssh/id_25519_jennifer_agenix not present!
Dec 04 13:27:17 jennifer stage-2-init: decrypting '/nix/store/n5f84dj2ywrb4rnflyj5q3mpdm4scksl-bjorn-password.age' to '/run/agenix.d/1/bjorn-password'...
Dec 04 13:27:17 jennifer stage-2-init: [agenix] WARNING: no readable identities found!
Dec 04 13:27:17 jennifer stage-2-init: chmod: cannot access '/run/agenix.d/1/bjorn-password.tmp': No such file or directory
Dec 04 13:27:17 jennifer stage-2-init: mv: cannot stat '/run/agenix.d/1/bjorn-password.tmp': No such file or directory
Dec 04 13:27:17 jennifer stage-2-init: decrypting '/nix/store/bbmvbg3cvw1bfkhfn2a97636bkyf4f88-wg-iphone-private.age' to '/run/agenix.d/1/wg-iphone-private'...
Dec 04 13:27:17 jennifer stage-2-init: [agenix] WARNING: no readable identities found!
Dec 04 13:27:17 jennifer stage-2-init: chmod: cannot access '/run/agenix.d/1/wg-iphone-private.tmp': No such file or directory
Dec 04 13:27:17 jennifer stage-2-init: mv: cannot stat '/run/agenix.d/1/wg-iphone-private.tmp': No such file or directory
Dec 04 13:27:17 jennifer stage-2-init: decrypting '/nix/store/qfirm84mal87ib77pw7v1a1kg436x0qj-wg-jennifer-private.age' to '/run/agenix.d/1/wg-jennifer-private'...
Dec 04 13:27:17 jennifer stage-2-init: [agenix] WARNING: no readable identities found!
Dec 04 13:27:17 jennifer stage-2-init: chmod: cannot access '/run/agenix.d/1/wg-jennifer-private.tmp': No such file or directory
Dec 04 13:27:17 jennifer stage-2-init: mv: cannot stat '/run/agenix.d/1/wg-jennifer-private.tmp': No such file or directory
Dec 04 13:27:17 jennifer stage-2-init: decrypting '/nix/store/y1ybkk5w0ys4zslr1z7k9ql3366qjrfq-wg-server-private.age' to '/run/agenix.d/1/wg-server-private'...
Dec 04 13:27:17 jennifer stage-2-init: [agenix] WARNING: no readable identities found!
Dec 04 13:27:17 jennifer stage-2-init: chmod: cannot access '/run/agenix.d/1/wg-server-private.tmp': No such file or directory
Dec 04 13:27:17 jennifer stage-2-init: mv: cannot stat '/run/agenix.d/1/wg-server-private.tmp': No such file or directory
Dec 04 13:27:17 jennifer stage-2-init: [agenix] symlinking new secrets to /run/agenix (generation 1)...
Dec 04 13:27:17 jennifer stage-2-init: Activation script snippet 'agenixInstall' failed (1)
Dec 04 13:27:17 jennifer stage-2-init: warning: password file ‘/run/agenix/bjorn-password’ does not exist
Dec 04 13:27:17 jennifer stage-2-init: [agenix] chowning...
Dec 04 13:27:17 jennifer stage-2-init: chown: cannot access '/run/agenix.d/1/bjorn-password': No such file or directory
Dec 04 13:27:17 jennifer stage-2-init: chown: cannot access '/run/agenix.d/1/wg-iphone-private': No such file or directory
Dec 04 13:27:17 jennifer stage-2-init: chown: cannot access '/run/agenix.d/1/wg-jennifer-private': No such file or directory
Dec 04 13:27:17 jennifer stage-2-init: chown: cannot access '/run/agenix.d/1/wg-server-private': No such file or directory
Dec 04 13:27:17 jennifer stage-2-init: Activation script snippet 'agenixChown' failed (1)
Dec 04 13:27:27 jennifer wg-quick-wg0-start[2188]: cat: /run/agenix/wg-jennifer-private: No such file or directory

In reply to @bjrnmrtns:matrix.org
so it is because of the private key

In reply to @bjrnmrtns:matrix.org
Line 4 ;-)

In reply to @lordkekz:matrix.org
Your /home is on a separate btrfs subvolume. I think it should be fine but maybe it gets mounted too late. Make sure to set filesystems."/home".neededForBoot = true; in your config, maybe that can help ensure it gets mounted early.

In reply to @lordkekz:matrix.org

In reply to @lordkekz:matrix.org
Your /home is on a separate btrfs subvolume. I think it should be fine but maybe it gets mounted too late. Make sure to set filesystems."/home".neededForBoot = true; in your config, maybe that can help ensure it gets mounted early.

Beware typos tho, since I'm on my phone and just doing it from memory

In reply to @lordkekz:matrix.org

In reply to @lordkekz:matrix.org
Your /home is on a separate btrfs subvolume. I think it should be fine but maybe it gets mounted too late. Make sure to set filesystems."/home".neededForBoot = true; in your config, maybe that can help ensure it gets mounted early.

Beware typos tho, since I'm on my phone and just doing it from memory

Alright, looks like I was able to work around this by making agenix use a hash of the encrypted file as the file name:

age.secrets."my-secret" = {
  file = ./my-secret.age;
  name = builtins.hashFile "sha256" ./my-secret.age;
};