it probably has to do with this

  pubkey = hostname: pubkeyPath ./hosts/${hostname}/key.pub;
  pubkeyPath = pkp: if builtins.pathExists pkp then builtins.readFile pkp else "";

  servers = [
    (pubkey "my-server")
  ];

  pubkeyPath = pkp: if builtins.pathExists pkp then builtins.replaceStrings ["\n"] [""] (builtins.readFile pkp) else "";

this works

ryantm: is there any docs on how to correctly use agenix with the home-manager module? trying to do something like this:

  age.secrets.nixconf.file = ./secrets/nix.conf.age;
  xdg.configFile."nix/nix.conf".source = config.age.secrets.nixconf.path;

And getting this failure:

      error: A definition for option `home-manager.users.supermarin.xdg.configFile."nix/nix.conf".source' is not of type `path'. Definition values:
       - In `/nix/store/czifw4nlbci6fjly2sw0i5qjlph8c3sn-source/home.nix': "$XDG_RUNTIME_DIR/agenix/nixconf"

Seen above that someone had a similar issue, but haven't seen any resolution

I'm on a flake based system, and importing hm & agenix like this:

modules = [
  inputs.nixos-hardware.nixosModules.lenovo-thinkpad-x1-nano-gen1
  inputs.home-manager.nixosModules.home-manager
  ./nixos/configuration.nix
  ./nixos/hardware-x1.nix
  {
    home-manager.useGlobalPkgs = true;
    home-manager.useUserPackages = true;
    home-manager.users.supermarin = {
      home.stateVersion = "22.05";
      imports = [
        inputs.agenix.homeManagerModules.default
        ./home.nix
        ./home-services.nix
      ];
    };
  }
];

If I want to install nixos on a new system I have to install without age first and then switch. Is there a way to install the new system with age in 1 go?

• my nixos config (flake) with multiple hosts
• I use my custom live iso
• In my config I disable agenix for the new system
• And run a few commands (see below)
• If I enable agenix from the start it asks for a passphrase?? I don't know which. I think /etc/ssh/ssh_host_ed25519_key': was set by the live iso, '/mnt/etc/ssh/ssh_host_ed25519_key': was set by the commands?

  > mynewdevice : NIXOS-INSTALL
installing the boot loader...
[agenix] creating new generation in /run/agenix.d/1
[agenix] decrypting secrets...
[agenix] WARNING: config.age.identityPaths entry /etc/ssh/ssh_host_rsa_key not present!
decrypting '/nix/store/xxxxxxx-mypass.age' to '/run/agenix.d/1/passwords/mypass'...
Type passphrase for OpenSSH key '/etc/ssh/ssh_host_ed25519_key': 

commands:

FUTURE_USER="myuser"; FUTURE_HOSTNAME="mynewdevice"; DISKOTYPE="zfs"; DISKS='[ "/dev/nvme0n1" ]'; ZFS_ASHIFT='12'; ZFS_REFRESERVATION='5'
REMOTE_IP="my-nixos-live.local"; LOCAL_CONFIG_PATH="/nixcfg"; REMOTE_CONFIG_PATH="/tmp"
ssh-keygen -R $REMOTE_IP  -f /cache${HOME}/.ssh/known_hosts # Remove from known_hosts
echo "  > $FUTURE_HOSTNAME : EXTRACT hardware-configuration.nix" ; ssh -t root@$REMOTE_IP '( nixos-generate-config --no-filesystems --root /mnt --show-hardware-config  )' > ${LOCAL_CONFIG_PATH}/hosts/${FUTURE_HOSTNAME}/hardware-configuration.nix

echo "  > $FUTURE_HOSTNAME : RSYNC CONFIG" ; rsync --mkpath -ah --delete "${LOCAL_CONFIG_PATH}/diskos/disko_${DISKOTYPE}.nix" "root@${REMOTE_IP}:$REMOTE_CONFIG_PATH"
echo "  > $FUTURE_HOSTNAME : DISKO: PARTITION, FORMAT, MOUNT" ; ssh -t root@${REMOTE_IP} "( disko --mode disko ${REMOTE_CONFIG_PATH}/disko_${DISKOTYPE}.nix --arg disks '${DISKS}' --arg zfs_ashift '${ZFS_ASHIFT}' --arg zfs_refreservationInGB '${ZFS_REFRESERVATION}')"

echo "  > $FUTURE_HOSTNAME : SSH: MKDIR" ; ssh -t root@${REMOTE_IP} "( mkdir -p /mnt/etc/ssh )"
echo "  > $FUTURE_HOSTNAME : SSH: KEYGEN" ; ssh -t root@${REMOTE_IP} "( ssh-keygen -t ed25519 -f /mnt/etc/ssh/ssh_host_ed25519_key -N '\"\"' )"
echo "  > $FUTURE_HOSTNAME : EXTRACT ssh key.pub" ; rsync -ah root@${REMOTE_IP}:/mnt/etc/ssh/ssh_host_ed25519_key.pub /nixcfg/hosts/$FUTURE_HOSTNAME/key.pub
echo "  > $FUTURE_HOSTNAME : REKEY AGENIX" ; cd /nixcfg ; agenix --rekey ; git add /nixcfg/{secrets/,hosts/$FUTURE_HOSTNAME/}* ; git commit -m "add host $FUTURE_HOSTNAME"

echo "  > $FUTURE_HOSTNAME : NIX EVAL" ; sys="$(nix eval --raw ".#nixosConfigurations.${FUTURE_HOSTNAME}.config.system.build.toplevel")"
echo "  > $FUTURE_HOSTNAME : NIX BUILD" ; nix build ".#nixosConfigurations.${FUTURE_HOSTNAME}.config.system.build.toplevel" --out-link "$(mktemp -d)/result"
#TODO: nix copy gives the same error as nixos-anywhere, because they also use nix copy: "bash: line 1: started: command not found"
echo "  > $FUTURE_HOSTNAME : NIX COPY" ; nix run nixpkgs#nixVersions.nix_2_14 -- copy --to "ssh://root@${REMOTE_IP}?remote-store=local?root=/mnt" "$sys"
echo "  > $FUTURE_HOSTNAME : NIXOS-INSTALL" ; ssh -t root@${REMOTE_IP} "( nixos-install --no-root-passwd --no-channel-copy --system "$sys" )"

ssh root@${REMOTE_IP} umount -lR /mnt
ssh root@${REMOTE_IP} zpool export -a

echo "  > $FUTURE_HOSTNAME : REBOOT" ; ssh -t root@$REMOTE_IP '( reboot )'

In reply to @willpower3309:matrix.org
I also do this at the system level where I keep my system public keys in my public NixOS config repo, I just need a good way to store all those private keys on an external drive

echo "  > $FUTURE_HOSTNAME : COPY ssh keys from iso to mnt" ; ssh -t root@${REMOTE_IP} "( cp /etc/ssh/ssh_host_ed25519_key* /mnt/etc/ssh/ )"

ryantm: is there any docs on how to correctly use agenix with the home-manager module? trying to do something like this:

  age.secrets.nixconf.file = ./secrets/nix.conf.age;
  xdg.configFile."nix/nix.conf".source = config.age.secrets.nixconf.path;

And getting this failure:

      error: A definition for option `home-manager.users.supermarin.xdg.configFile."nix/nix.conf".source' is not of type `path'. Definition values:
       - In `/nix/store/czifw4nlbci6fjly2sw0i5qjlph8c3sn-source/home.nix': "$XDG_RUNTIME_DIR/agenix/nixconf"

Seen above that someone had a similar issue, but haven't seen any resolution

ping on this one

I am not sure this is currently active, but at one time I used this:

{ config, pkgs, ... }:
{
  age.secrets.nix-access-tokens-github.file = ../../../secrets/nix.access-tokens-github.age;
  nix.extraOptions = ''
    !include ${config.age.secrets.nix-access-tokens-github.path}
  '';
  nix.package = pkgs.nix;
}