Failed assertions:
       - age.identityPaths must be set.

Hi,

I'm having trouble linking a secret into ~/.config with the appropriate user/group/permissions. The secret is declared like so:

age.secrets.spam = {
  file = ./spam.age;
  owner = "rjt";
  group = "users";
  mode = "0600";
};

This works as expected and /run/agenix/spam has the correct permissions etc., but I can't seem get it into ~/.config/spam/spam.conf. I've tried:

1. Adding path = "/home/rjt/.config/spam/spam.conf"; to the above, but then the symlink is owned by root and has the wrong permissions (rwx for everyone)

2. Doing 1. and adding symlink = false; creates ~/.config/spam/spam.conf with the correct permissions etc. but then the parent directory (~/.config/spam) is owned by root and so other (not secret) configuration files can't be written into it

3. Using home-manager.users.rjt.xdg.configFile."spam/spam.conf" = ... doesn't work because it's impure (I'm using flakes)

Any suggestions?

In reply to @fwam:femdom.solutions
oh, yeah. I have host key, but not the openssh service itself. thought it's not needed.

systemd.tmpfiles worked, thanks for you help with this and your work all around the nix universe!

I might have a go at seeing what the home-manager module does at some point.

[agenix] creating new generation in /run/agenix.d/4
[agenix] decrypting secrets...
decrypting '/nix/store/lnji5fvavqs50l9abwf693r00d38nb3x-github.age' to '/run/agenix.d/4/github'...
age: error: no identity matched any of the recipients
age: report unexpected or unhelpful errors at https://filippo.io/age/report
chmod: cannot access '/run/agenix.d/4/github.tmp': No such file or directory
mv: cannot stat '/run/agenix.d/4/github.tmp': No such file or directory
[agenix] symlinking new secrets to /run/agenix (generation 4)...
[agenix] removing old secrets (generation 3)...
Activation script snippet 'agenixInstall' failed (1)
[agenix] chowning...
chown: cannot access '/run/agenix.d/4/github': No such file or directory
Activation script snippet 'agenixChown' failed (1)
setting up /etc...
reloading user units for bwkam...
setting up tmpfiles
restarting the following units: nix-daemon.service
warning: error(s) occurred while switching to the new configuration

In reply to@ryantm:matrix.org
That means it couldn't decrypt the file. You need to encrypt it with the same key you use to decrypt (and other ones if you want).