rane [they/them]: thanks so much for your explanations, I think I'm starting to understand. I'm kind of a visual learner, so I diagrammed out my current setup here. Maybe that will shed light on where my misunderstanding lies.

A private key only needs to be present when you are decrypting the existing values

But what public key does this private key correspond to? One of the public keys defined and assigned to the secret in secrets.nix? Or one of the original keys in identityPaths that encrypted the secret?

A yubikey is just one thing you use

So I would have a public key entry in secrets.nix for the YubiKey just as I would for a host?

So if you store the public key of a machine which needs access to a secret in the secrets.nix file and give it "access" to a secret, agenix,

I think I have this part, because when I get a new host (non-server), I generate a new keypair on that machine and add the pubkey to secrets.nix. I then add that key as a target in secrets.nix. (for the secrets defined in user_secrets.nix)? But obviously I'm missing something when trying to rekey my secrets for the new machine, because the operation does not generate new files.

Hello, heres a simple question that I've had a hard time finding an answer to:

is there a way to have a subfolder within secrets/?

I prefer subfoldering--category/secret_name.age--over appending--category.secret_name.age

In reply to @saik3617:matrix.org

Hello, heres a simple question that I've had a hard time finding an answer to:

is there a way to have a subfolder within secrets/?

I prefer subfoldering--category/secret_name.age--over appending--category.secret_name.age

Additionally, is there a way to modularize an environment file?

Something like

virtualisation.oci-containers.containers.postgres = {
  environmentFiles = [
    # Dynamically building an env file, which contains POSTGRES_PASSWORD=<contents of postgres-password.age>
    config.age.buildEnvFile "POSTGRES_PASSWORD" config.age.secrets.postgres-password.path
  ];
};
# then, i can construct a different envFile:
virtualisation.oci-containers.containers.grafana = {
  environmentFile = [
    # Note that the same value is being used, but is named something else, DATABASE_PASS
    # This prevents me needing two `.age` files for the same value.
    config.age.buildEnvFile "DATABASE_PASS" config.age.secrets.postgres-password.path
  ];
};