Menu
Guide for adding a new agenix-encrypted secret to the nix-config setup. Use when adding SSH keys, API tokens, encrypted config files, or any secret that should be age-encrypted. Covers the two-repo workflow between nix-config and nix-config-personal.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Nix debugging strategies and common fixes. Use when encountering Nix evaluation errors, build failures, flake lock issues, infinite recursion, hash mismatches, or when the user asks to debug a Nix problem. Also useful for nix repl tricks and home-manager troubleshooting.
Guide for adding a new home-manager module to nix-config. Use when creating a new module directory under home/, adding a new program or tool to the config, or when the user says "add a module" or "create a new module".
Update nix-config: pull remote changes, update flake inputs, check, and deploy. Use when the user says "update", "update dependencies", "update nix", "update inputs", when repo-sync flags stale inputs, or when flake.lock is more than 2 weeks old.
Deploy and verify nix-config changes. Use after making changes to any nix-config module, when the user says "deploy", "switch", "apply changes", or "test the config". Handles make check, make switch, and visual verification for UI changes.
Based on SOC occupation classification
| name | nix-secret |
| description | Guide for adding a new agenix-encrypted secret to the nix-config setup. Use when adding SSH keys, API tokens, encrypted config files, or any secret that should be age-encrypted. Covers the two-repo workflow between nix-config and nix-config-personal. |
| allowed-tools | Read, Glob, Grep, Edit, Write, Bash(age *), Bash(agenix *), Bash(make check), Bash(make switch *), Bash(nix flake check) |
This is a two-repo workflow: nix-config-personal holds the encrypted secrets, nix-config wires them into the system.
Add an entry to secrets/secrets.nix:
"<name>.age".publicKeys = [ thomas ];
The thomas variable holds the age public key: age15j2yd89h8ahm93g2um8206atnfcl90hk7q062nt63xqrz57lspmsvmyzle
Option A — agenix CLI (recommended, reads recipients from secrets/secrets.nix):
agenix -e secrets/<name>.age
Option B — age CLI (non-interactive, useful for piping):
age -r "age15j2yd89h8ahm93g2um8206atnfcl90hk7q062nt63xqrz57lspmsvmyzle" \
-o secrets/<name>.age <plaintext-file>
Create or update a module under home/:
{ config, ... }:
let
homeDir = config.home.homeDirectory;
in
{
age.secrets.<name> = {
file = ../secrets/<name>.age;
path = "${homeDir}/<target-path>";
mode = "0600"; # 0600 for keys, 0644 for config
};
}
Use config.age.secrets.<name>.path in other modules to reference the decrypted file location.
If you have a plaintext working copy in files/, ensure it's gitignored in nix-config-personal's .gitignore.
# In nix-config-personal
nix flake check
# In nix-config
make switch PERSONAL_INPUT=path:$HOME/repos/nix-config-personal
id_ed25519_<purpose> (e.g., id_ed25519_github, id_ed25519_server)0600 for private keys, 0644 for config/public content.age files are safe to commit — they're encrypted~/.config/agenix/age-key.txt) decrypts everything