| name | rekey-secrets |
| description | Re-encrypt all secrets after modifying .age files or changing host keys |
| compatibility | Requires agenix, agenix-helper |
| metadata | {"author":"ruinous.ai","version":"1.0","domain":"secrets"} |
Rekey Secrets
Re-encrypt all secrets after modifying .age files or when host keys change.
When to use:
- After creating or updating any
.age file
- After adding a new host to
secrets.nix
- After rotating host SSH keys
Prerequisites
just unlock
Steps
-
Rekey all secrets:
just rekey
-
Stage and verify rekeyed files:
git add secrets/
ls secrets/nixos/*/
-
Lock agenix when done:
agenix-helper lock
Where Rekeyed Secrets Go
After agenix rekey -a, encrypted secrets are stored in:
secrets/nixos/<hostname>/<hash>-<secret_name>.age
Troubleshooting
Rekey fails with host errors
- Check that all hosts in
secrets.nix have valid keys
- Verify host public keys are correct in the repository
Permission denied
just unlock
Example
just unlock
just rekey
git add secrets/
Post-Rekey Checklist