Okay, so I think this should be correct now:

let
  user = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBs9nuz0TVj/4mn6q8arUL2nMxO6W9RqarlM61sQynXo user@mainpc";
  users = [ user ];

  mainpc = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL6Tk94ilarqQZZ36ZWEi5U14nQwS/bqHkkTt7BOWxX0 root@mainpc";
  mainserver = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHugugwi3IeKQ74mNbP50YrU9gfspmhgUWF7WDTCrjo3 root@mainserver";
  systems = [ mainpc mainserver ];
in
{
  "mainpc-root-password.age".publicKeys = [ user mainpc ];
  "mainpc-user-password.age".publicKeys = [ user mainpc ];
  "mainserver-root-password.age".publicKeys = [ user mainserver ];
  "mainserver-user-password.age".publicKeys = [ user mainserver ];
  "mainserver-postgres-password.age".publicKeys = [ user mainserver ];
}

Yeah, that looks pretty reasonable. On my systems, the user-password is the same among systems, so I have an entry like:

  "passwordfile-ryantm.age".publicKeys = [ryantm] ++ systems;

So now I rekey via

nix run github:ryantm/agenix -- --rekey

In reply to @ryantm:matrix.org
It might not work for secrets you encrypted only with the mainserver key though.

Also, the top three lines here are required, right?

  age.secrets.mainpc-user-password = {
    file = ../../secrets/mainpc-user-password.age;
  };

  users.users.user.passwordFile = config.age.secrets.mainpc-user-password.path; 

Okay, so I also adjusted the password for the mainserver and then remotely deployed via

sudo nixos-rebuild switch --flake .#mainserver --target-host root@<host-ip>

There were no errors, so everything worked successfully.

Can I not just remove the user = entry in my secrets.nix file in this case? Since the private key is automatically taken from /etc/ssh, I do not really see why I need it in this case.

In reply to @ryantm:matrix.org
If you always plan to deploy your secrets from the same machine, you could use that machines private ssh host key to manage all the secrets, and then you'd need to run agenix commands as root, to get access to that secret.