In reply to @luzifer2222:matrix.org
uep thank you for git crypt recommendation, I will have a look into it. Sometimes some "secrets" are more about being secret in public but not on the "private" computer. E.g. Don't exposing an IP Range or a Username of a business account.
But if it comes to real secrets (Passwords, AuthKeys, API Keys...) YES! I want and will using agenix for now.

In reply to @ryantm:matrix.org
Do you do anything related aside.from importing it? Can you show your code?

flake outputs:

  outputs = { self, nixpkgs, home-manager, impermanence, deploy-rs, agenix, ... }:
  let
    mkNixos = modules: nixpkgs.lib.nixosSystem {
      inherit modules;
      system = "x86_64-linux";
      specialArgs = { inherit impermanence home-manager agenix; };
    };

    mkHome = modules: pkgs: home-manager.lib.homeManagerConfiguration {
      inherit modules pkgs;
      extraSpecialArgs = { inherit impermanence agenix; };
    };

  in {
    nixosConfigurations = {
      desktop = mkNixos [ ./hosts/desktop ];
      server = mkNixos [ ./hosts/server ];
      surface = mkNixos [ ./hosts/surface ];
    };

    homeConfigurations."will" = mkHome [ ./home ] nixpkgs.legacyPackages."x86_64-linux";

    # TODO: ex https://github.com/disassembler/network/blob/18e4d34b3d09826f1239772dc3c2e8c6376d5df6/nixos/deploy.nix
    deploy.nodes = {
      server = {
        hostname = "10.27.27.3";
        profiles.system = {
          user = "root";
          sshUser = "root";
          path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.server;
        };
      };
    };
  };

Home manager base config

{ pkgs, impermanence, agenix, ... }:

{
  imports = [
    impermanence.nixosModules.home-manager.impermanence
    agenix.homeManagerModules.default
    ./modules/discord.nix
    ./modules/emacs.nix
    ./modules/foot.nix
    ./modules/games.nix
    ./modules/git.nix
    ./modules/gtk.nix
    ./modules/kde-connect.nix
    ./modules/notetaking.nix
    ./modules/photography.nix
    ./modules/qt.nix
    ./modules/ssh-client.nix
    ./modules/sway.nix
    ./modules/video.nix
    ./modules/vim.nix
    ./modules/waybar.nix
    ./modules/web-browsers.nix
    ./modules/zsh.nix
  ];

  programs.home-manager.enable = true;

  # TODO: already declared in nix.nix file, don't double declare
  nixpkgs.config.allowUnfree = true;

  home = {
    username = "will";
    homeDirectory = "/home/will";
    stateVersion = "22.05";
  };
}

I also import home manager into my nixos config with:

{ pkgs, config, home-manager, impermanence, agenix, ... }:

{
  imports = [
    home-manager.nixosModules.home-manager
  ];

  programs.zsh.enable = true;

  age.secrets = {
    hashedWillPassword.file = ../secrets/hashedWillPassword.age;
    hashedRootPassword.file = ../secrets/hashedRootPassword.age;
  };

  users = {
    mutableUsers = false;
    defaultUserShell = pkgs.zsh;

    users = {
      root.hashedPasswordFile = config.age.secrets.hashedRootPassword.path;

      will = {
        isNormalUser = true;
        hashedPasswordFile = config.age.secrets.hashedWillPassword.path;
        extraGroups = [ "wheel" "libvirtd" "input" "kvm" "docker" "video" ];
      };
    };
  };

  home-manager = {
    useUserPackages = true;
    extraSpecialArgs = { inherit impermanence; };
    users.will = import ../home;
  };
}

• age.secrets.<name>.* where you talk about the encrypted source file as an input
• config.age.secrets.<name>.* where you talk about where and how it should be decrypted as an output

so I have, for one example:

let
  host = config.networking.hostName;
  prvk = "nix_store_${host}.prv";
in
{
  age.secrets.${prvk}.file = ../secrets/${prvk}.age;

  nix.settings.secret-key-files = config.age.secrets.${prvk}.path;

  # …
}

Sorry, I shouldn't post when I'm tired. The wording above is confusing and makes things worse. It's not where you set things, it's where they get pulled into the system.

What I mean is, you need to refer to the result in config.*.path as part of your configuration, otherwise laziness means it's not actually emitted.

Sorry, I shouldn't post when I'm tired. The wording above is confusing and makes things worse. It's not where you set things, it's where they get pulled into the system.

What I mean is, you need to refer to the result in config.*.path as part of your configuration, otherwise laziness means it's not actually emitted, maybe

activating the configuration...
[agenix] creating new generation in /run/agenix.d/2
[agenix] decrypting secrets...
decrypting '/nix/store/v8xizlamwqsnxq2r2730f7pw2m7xd3j4-desktopSyncthingCert.age' to '/run/agenix.d/2/desktopSyncthingCert'...
decrypting '/nix/store/xgv9sn1qkqh203b519a7vkmhw28yfg01-desktopSyncthingKey.age' to '/run/agenix.d/2/desktopSyncthingKey'...
decrypting '/nix/store/0gz2plhs9bn7425hpis01km8phamsglf-hashedRootPassword.age' to '/run/agenix.d/2/hashedRootPassword'...
decrypting '/nix/store/qlhmfn40hwj2x3di4ri6agwr88hjypxa-hashedWillPassword.age' to '/run/agenix.d/2/hashedWillPassword'...

[agenix] symlinking new secrets to /run/agenix (generation 2)...
[agenix] removing old secrets (generation 1)...
[agenix] chowning...
setting up /etc...
reloading user units for will...
setting up tmpfiles