Menu
Guide for adding a new agenix-encrypted secret to the nix-config setup. Use when adding SSH keys, API tokens, encrypted config files, or any secret that should be age-encrypted. Covers the two-repo workflow between nix-config and nix-config-personal.
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Baseado na classificação ocupacional SOC
| name | nix-secret |
| description | Guide for adding a new agenix-encrypted secret to the nix-config setup. Use when adding SSH keys, API tokens, encrypted config files, or any secret that should be age-encrypted. Covers the two-repo workflow between nix-config and nix-config-personal. |
| allowed-tools | Read, Glob, Grep, Edit, Write, Bash(age *), Bash(agenix *), Bash(make check), Bash(make switch *), Bash(nix flake check) |
This is a two-repo workflow: nix-config-personal holds the encrypted secrets, nix-config wires them into the system.
Add an entry to secrets/secrets.nix:
"<name>.age".publicKeys = [ thomas ];
The thomas variable holds the age public key: age15j2yd89h8ahm93g2um8206atnfcl90hk7q062nt63xqrz57lspmsvmyzle
Option A — agenix CLI (recommended, reads recipients from secrets/secrets.nix):
agenix -e secrets/<name>.age
Option B — age CLI (non-interactive, useful for piping):
age -r "age15j2yd89h8ahm93g2um8206atnfcl90hk7q062nt63xqrz57lspmsvmyzle" \
-o secrets/<name>.age <plaintext-file>
Create or update a module under home/:
{ config, ... }:
let
homeDir = config.home.homeDirectory;
in
{
age.secrets.<name> = {
file = ../secrets/<name>.age;
path = "${homeDir}/<target-path>";
mode = "0600"; # 0600 for keys, 0644 for config
};
}
Use config.age.secrets.<name>.path in other modules to reference the decrypted file location.
If you have a plaintext working copy in files/, ensure it's gitignored in nix-config-personal's .gitignore.
# In nix-config-personal
nix flake check
# In nix-config
make switch PERSONAL_INPUT=path:$HOME/repos/nix-config-personal
id_ed25519_<purpose> (e.g., id_ed25519_github, id_ed25519_server)0600 for private keys, 0644 for config/public content.age files are safe to commit — they're encrypted~/.config/agenix/age-key.txt) decrypts everythingNix debugging strategies and common fixes. Use when encountering Nix evaluation errors, build failures, flake lock issues, infinite recursion, hash mismatches, or when the user asks to debug a Nix problem. Also useful for nix repl tricks and home-manager troubleshooting.
Guide for adding a new home-manager module to nix-config. Use when creating a new module directory under home/, adding a new program or tool to the config, or when the user says "add a module" or "create a new module".
Update nix-config: pull remote changes, update flake inputs, check, and deploy. Use when the user says "update", "update dependencies", "update nix", "update inputs", when repo-sync flags stale inputs, or when flake.lock is more than 2 weeks old.
Deploy and verify nix-config changes. Use after making changes to any nix-config module, when the user says "deploy", "switch", "apply changes", or "test the config". Handles make check, make switch, and visual verification for UI changes.