Also, the top three lines here are required, right?

  age.secrets.mainpc-user-password = {
    file = ../../secrets/mainpc-user-password.age;
  };

  users.users.user.passwordFile = config.age.secrets.mainpc-user-password.path; 

Okay, so I also adjusted the password for the mainserver and then remotely deployed via

sudo nixos-rebuild switch --flake .#mainserver --target-host root@<host-ip>

There were no errors, so everything worked successfully.

Can I not just remove the user = entry in my secrets.nix file in this case? Since the private key is automatically taken from /etc/ssh, I do not really see why I need it in this case.

In reply to @ryantm:matrix.org
If you always plan to deploy your secrets from the same machine, you could use that machines private ssh host key to manage all the secrets, and then you'd need to run agenix commands as root, to get access to that secret.

Error: Permission denied (os error 13)

[ Did rage not do what you expected? Could an error be more useful? ]
[ Tell us: https://str4d.xyz/rage/report            

When I run with sudo:

/nix/store/smy2vqg1mg2nfwmcx2yqyr7af82cfdac-agenix-0.13.0/bin/agenix: line 162: EDITOR: unbound variable

$HOME ('/home/user') is not owned by you, falling back to the one defined in the 'passwd' file ('/root')

Do i need chown 777?

• without capital E it works. -e

So it seems like I can edit all the files like this ryantm:

sudo -e nix run github:ryantm/agenix -- -e mainserver-user-password.age -i /etc/ssh/ssh_host_ed25519_key

because:

let
  mainpc = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL6Tk94ilarqQZZ36ZWEi5U14nQwS/bqHkkTt7BOWxX0 root@mainpc";
  mainserver = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHugugwi3IeKQ74mNbP50YrU9gfspmhgUWF7WDTCrjo3 root@mainserver";
  systems = [ mainpc mainserver ];
in
{
  "mainpc-root-password.age".publicKeys = [ mainpc ];
  "mainpc-user-password.age".publicKeys = [ mainpc ];
  "mainserver-root-password.age".publicKeys = [ mainserver ];
  "mainserver-user-password.age".publicKeys = [ mainserver ];
  "mainserver-postgres-password.age".publicKeys = [ mainserver ];
}

because I did not give permission