In reply to @ryantm:matrix.org
Oh, okay. You don't in that situation. But you would need to change age.identityPaths for mainpc to have the path to your user's SSH private key. By default it only looks for the keys in the /etc/ssh directory.

In reply to @ryantm:matrix.org
For every secret you want to decrypt on a machine, you must have a private key/identity file that the secret was encrypted for present on that machine.

Okay, yes.

So the general plan would be:

• Create a system key for each machine in /etc/ssh
• Create one "user key" which allows me to remotely encrypt / decrypt from one machine on another

Do I get that right?

Okay, yes.

So the general plan would be:

• Create a system key for each machine in /etc/ssh
• Create one "user key" which allows me to remotely encrypt / decrypt from one machine on another. This would be stored in ~/.ssh

Do I get that right?

Okay, so I think this should be correct now:

let
  user = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBs9nuz0TVj/4mn6q8arUL2nMxO6W9RqarlM61sQynXo user@mainpc";
  users = [ user ];

  mainpc = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL6Tk94ilarqQZZ36ZWEi5U14nQwS/bqHkkTt7BOWxX0 root@mainpc";
  mainserver = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHugugwi3IeKQ74mNbP50YrU9gfspmhgUWF7WDTCrjo3 root@mainserver";
  systems = [ mainpc mainserver ];
in
{
  "mainpc-root-password.age".publicKeys = [ user mainpc ];
  "mainpc-user-password.age".publicKeys = [ user mainpc ];
  "mainserver-root-password.age".publicKeys = [ user mainserver ];
  "mainserver-user-password.age".publicKeys = [ user mainserver ];
  "mainserver-postgres-password.age".publicKeys = [ user mainserver ];
}

Yeah, that looks pretty reasonable. On my systems, the user-password is the same among systems, so I have an entry like:

  "passwordfile-ryantm.age".publicKeys = [ryantm] ++ systems;

So now I rekey via

nix run github:ryantm/agenix -- --rekey

In reply to @ryantm:matrix.org
It might not work for secrets you encrypted only with the mainserver key though.