In reply to @ryantm:matrix.org
Great. And which computer has your NixOS expressions for configuring things?

My setup and idea is basically like this:

I have a shared.nix config which gives both machines the same one user. Then I have two differnet nixosConfigurations, one for my mainpc and one for my mainserver. If I want to change some config on the mainserver, I would edit my nixos-config on the mainpc and then deploy the changes to the mainserver remotely via the command sudo nixos-rebuild switch --flake .#mainserver --target-host root@ip

Here is my secrets.nix file:

let
  user = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBs9nuz0TVj/4mn6q8arUL2nMxO6W9RqarlM61sQynXo user@mainpc";
  users = [ user ];
in
{
  "mainpc-root-password.age".publicKeys = [ user ];
  "mainpc-user-password.age".publicKeys = [ user ];
  "mainserver-user-password.age".publicKeys = [ user ];
  "mainserver-user-password.age".publicKeys = [ user ];
  "mainserver-postgres-password.age".publicKeys = [ user ];
}

Okay, I am back ryantm.

Now why do I need another key on the mainserver? I currently only changed the password of my mainpc configuration to the mainpc-user-password.age. After that I ran sudo nixos-rebuild switch --flake .#mainpc.

Okay, I am back ryantm.

Now why do I need another key on the mainserver? I currently only changed the password of my user inside the mainpc configuration to the mainpc-user-password.age. After that I ran sudo nixos-rebuild switch --flake .#mainpc.

In reply to @ryantm:matrix.org
Oh, okay. You don't in that situation. But you would need to change age.identityPaths for mainpc to have the path to your user's SSH private key. By default it only looks for the keys in the /etc/ssh directory.

In reply to @ryantm:matrix.org
Oh, okay. You don't in that situation. But you would need to change age.identityPaths for mainpc to have the path to your user's SSH private key. By default it only looks for the keys in the /etc/ssh directory.

In reply to @ryantm:matrix.org
For every secret you want to decrypt on a machine, you must have a private key/identity file that the secret was encrypted for present on that machine.