### Install Agenix CLI via Flakes

Source: https://github.com/ryantm/agenix/blob/main/doc/install-via-flakes.md

This snippet demonstrates how to run the Agenix CLI directly using Nix Flakes without a formal installation. It also shows how to add the Agenix CLI package to your system's environment packages for persistent access. Adjust the architecture string as needed for your system.

```shell
nix run github:ryantm/agenix -- --help
```

```nix
{
  environment.systemPackages = [ agenix.packages.x86_64-linux.default ];
}
```

--------------------------------

### Install Agenix CLI Binary via Nix

Source: https://github.com/ryantm/agenix/blob/main/doc/install-via-nix-channel.md

This Nix code snippet illustrates how to install the Agenix command-line interface (CLI) binary system-wide. It uses `pkgs.callPackage` to include the Agenix package from the Nix channel.

```nix
{
  environment.systemPackages = [ (pkgs.callPackage <agenix/pkgs/agenix.nix> {}) ];
}
```

--------------------------------

### Install Agenix CLI via fetchTarball (Nix)

Source: https://github.com/ryantm/agenix/blob/main/doc/install-via-fetchtarball.md

Installs the `agenix` command-line interface binary by fetching it from GitHub using `fetchTarball`. This adds the `agenix` executable to the system's packages. The code snippet is a Nix expression to be added to `environment.systemPackages`.

```nix
{ environment.systemPackages = [ (pkgs.callPackage "${builtins.fetchTarball "https://github.com/ryantm/agenix/archive/main.tar.gz"}/pkgs/agenix.nix" {}) ]; }
```

--------------------------------

### Install agenix CLI binary

Source: https://github.com/ryantm/agenix/blob/main/doc/install-via-niv.md

Installs the agenix command-line interface binary into your system's packages. This allows you to use agenix commands directly from your terminal.

```nix
{ environment.systemPackages = [ (pkgs.callPackage "${(import ./nix/sources.nix).agenix}/pkgs/agenix.nix" {}) ]; }
```

--------------------------------

### Add and Update Nix Channel for Agenix

Source: https://github.com/ryantm/agenix/blob/main/doc/install-via-nix-channel.md

This snippet shows how to add the Agenix repository to your Nix channels and update them. This is a prerequisite for installing Agenix modules or packages.

```shell
sudo nix-channel --add https://github.com/ryantm/agenix/archive/main.tar.gz agenix
sudo nix-channel --update
```

--------------------------------

### Install Agenix Module via fetchTarball (Nix)

Source: https://github.com/ryantm/agenix/blob/main/doc/install-via-fetchtarball.md

Installs the Agenix module by fetching the latest version from GitHub using `fetchTarball`. This method is suitable for quick integration but lacks version pinning. The output is a Nix expression to be included in `configuration.nix`.

```nix
{ imports = [ "${builtins.fetchTarball "https://github.com/ryantm/agenix/archive/main.tar.gz"}/modules/age.nix" ]; }
```

--------------------------------

### Import Agenix Age Module in configuration.nix

Source: https://github.com/ryantm/agenix/blob/main/doc/install-via-nix-channel.md

This Nix code demonstrates how to import the Agenix age module into your system's configuration.nix file. This enables the use of Agenix's age-related functionalities.

```nix
{
  imports = [ <agenix/modules/age.nix> ];
}
```

--------------------------------

### Install Agenix Module with Pinned Version via fetchTarball (Nix)

Source: https://github.com/ryantm/agenix/blob/main/doc/install-via-fetchtarball.md

Installs a specific version of the Agenix module by fetching a tarball from a pinned commit hash on GitHub. This approach ensures reproducible builds by specifying the exact version. The `sha256` attribute needs to be updated with the correct hash obtained from a Nix build.

```nix
{ imports = let
    # replace this with an actual commit id or tag
    commit = "298b235f664f925b433614dc33380f0662adfc3f";
  in [
    "${builtins.fetchTarball {
      url = "https://github.com/ryantm/agenix/archive/${commit}.tar.gz";
      # update hash from nix build output
      sha256 = "";
    }}/modules/age.nix"
  ];
}
```

--------------------------------

### Add agenix to niv

Source: https://github.com/ryantm/agenix/blob/main/doc/install-via-niv.md

Adds the agenix project to your niv sources. This is the first step before importing agenix into your Nix configuration.

```shell
$ niv add ryantm/agenix
```

--------------------------------

### Install Agenix NixOS Module via Flakes

Source: https://github.com/ryantm/agenix/blob/main/doc/install-via-flakes.md

This snippet shows how to add the Agenix NixOS module to your system configuration using Nix Flakes. It requires specifying the Agenix input and including the module in your system's configuration. Ensure 'yourhostname' and the system architecture are correctly set.

```nix
{
  inputs.agenix.url = "github:ryantm/agenix";
  # optional, not necessary for the module
  #inputs.agenix.inputs.nixpkgs.follows = "nixpkgs";

  outputs = { self, nixpkgs, agenix }: {
    # change `yourhostname` to your actual hostname
    nixosConfigurations.yourhostname = nixpkgs.lib.nixosSystem {
      # change to your system:
      system = "x86_64-linux";
      modules = [
        ./configuration.nix
        agenix.nixosModules.default
      ];
    };
  };
}
```

--------------------------------

### Home Manager Basic Setup with Agenix (Nix)

Source: https://context7.com/ryantm/agenix/llms.txt

Demonstrates how to integrate Agenix with Home Manager for managing user-level secrets. It requires specifying identity paths and defining secrets within the Home Manager configuration.

```nix
# flake.nix
{
  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
    home-manager.url = "github:nix-community/home-manager";
    agenix.url = "github:ryantm/agenix";
  };

  outputs = { nixpkgs, home-manager, agenix, ... }:
  {
    homeConfigurations."username" = home-manager.lib.homeManagerConfiguration {
      pkgs = nixpkgs.legacyPackages.x86_64-linux;
      modules = [
        agenix.homeManagerModules.default
        ./home.nix
      ];
    };
  };
}
```

```nix
# home.nix
{
  age = {
    # Required: specify identity paths for decryption
    identityPaths = [
      "/home/username/.ssh/id_ed25519"
    ];

    secrets = {
      github-token = {
        file = ../secrets/github-token.age;
      };

      api-credentials = {
        file = ../secrets/api-credentials.age;
        mode = "0600";
      };
    };
  };

  # Use secrets in home config
  programs.git.extraConfig = {
    credential.helper = "store --file=${config.age.secrets.github-token.path}";
  };
}
```

--------------------------------

### Install agenix via fetchTarball

Source: https://context7.com/ryantm/agenix/llms.txt

Installs agenix by fetching the tarball directly, allowing for optional pinning to a specific commit for reproducibility. This is useful for ensuring consistent builds across different environments.

```nix
# configuration.nix
{
  imports = let
    # Pin to a specific commit for reproducibility
    commit = "298b235f664f925b433614dc33380f0662adfc3f";
  in [
    "${builtins.fetchTarball {
      url = "https://github.com/ryantm/agenix/archive/${commit}.tar.gz";
      sha256 = ""; # nix build will tell you the correct hash
    }}/modules/age.nix"
  ];

  environment.systemPackages = [
    (pkgs.callPackage "${builtins.fetchTarball "https://github.com/ryantm/agenix/archive/main.tar.gz"}/pkgs/agenix.nix" {})
  ];
}

```

--------------------------------

### Run CLI Ad-hoc via Flakes

Source: https://github.com/ryantm/agenix/blob/main/README.md

Executes the agenix CLI tool directly from its GitHub repository without a permanent installation. This is useful for testing or one-off commands. The `--help` flag is used here as an example.

```shell
nix run github:ryantm/agenix -- --help
```

--------------------------------

### Install agenix CLI via Nix Channel

Source: https://github.com/ryantm/agenix/blob/main/README.md

Installs the agenix command-line interface (CLI) tool using Nix channels. This makes the agenix binary available system-wide.

```nix
{ environment.systemPackages = [ (pkgs.callPackage <agenix/pkgs/agenix.nix> {}) ]; }
```

--------------------------------

### NixOS Configuration with Agenix Secrets

Source: https://context7.com/ryantm/agenix/llms.txt

Example NixOS configuration defining and utilizing encrypted secrets for user passwords, PostgreSQL, Nginx, and Wireguard. It demonstrates how to reference decrypted secret paths within service configurations.

```nix
# configuration.nix
{ config, pkgs, ... }:
{
  # Define all secrets
  age.secrets = {
    # User password hash
    user-password = {
      file = ../secrets/user-password.age;
      mode = "0400";
    };

    # PostgreSQL password
    postgres-password = {
      file = ../secrets/postgres-password.age;
      owner = "postgres";
      group = "postgres";
      mode = "0400";
    };

    # Nginx htpasswd
    nginx-htpasswd = {
      file = ../secrets/nginx-htpasswd.age;
      owner = "nginx";
      group = "nginx";
      mode = "0440";
    };

    # Wireguard private key
    wireguard-key = {
      file = ../secrets/wireguard-key.age;
      mode = "0400";
    };
  };

  # Use secrets in services
  users.users.myuser = {
    isNormalUser = true;
    hashedPasswordFile = config.age.secrets.user-password.path;
  };

  services.postgresql = {
    enable = true;
    authentication = ''
      local all all trust
    '';
  };

  services.nginx = {
    enable = true;
    virtualHosts."secure.example.com" = {
      basicAuthFile = config.age.secrets.nginx-htpasswd.path;
      locations."/".return = "200 'Authenticated!'";
    };
  };

  networking.wireguard.interfaces.wg0 = {
    privateKeyFile = config.age.secrets.wireguard-key.path;
    ips = [ "10.0.0.1/24" ];
    listenPort = 51820;
  };
}
```

--------------------------------

### Import agenix module in configuration.nix

Source: https://github.com/ryantm/agenix/blob/main/doc/install-via-niv.md

Imports the agenix module into your NixOS configuration. This makes agenix's functionality available for managing secrets.

```nix
{ imports = [ "${(import ./nix/sources.nix).agenix}/modules/age.nix" ]; }
```

--------------------------------

### Run Nix Integration Tests Interactively

Source: https://github.com/ryantm/agenix/blob/main/doc/contributing.md

Starts the integration tests in an interactive mode, allowing for manual control and inspection. This is useful for debugging specific test scenarios.

```shell
nix run .#checks.x86_64-linux.integration.driverInteractive
```

--------------------------------

### Running Agenix CLI with Nix Flakes

Source: https://context7.com/ryantm/agenix/llms.txt

Examples of executing the agenix command-line interface directly using `nix run` with flakes. This allows for ad-hoc operations like viewing help, editing secrets, rekeying, and decrypting.

```bash
# Run help
nix run github:ryantm/agenix -- --help

# Create/edit a secret
nix run github:ryantm/agenix -- -e secret1.age

# Rekey secrets
nix run github:ryantm/agenix -- --rekey

# Decrypt to stdout
nix run github:ryantm/agenix -- -d secret1.age
```

--------------------------------

### Add agenix Nix Channel

Source: https://github.com/ryantm/agenix/blob/main/README.md

Adds the agenix repository as a Nix channel for system-wide installation. This command should be run as root.

```ShellSession
$ sudo nix-channel --add https://github.com/ryantm/agenix/archive/main.tar.gz agenix
$ sudo nix-channel --update
```

--------------------------------

### Install agenix via Nix Channel

Source: https://context7.com/ryantm/agenix/llms.txt

Adds agenix using the traditional nix-channel approach for non-flake configurations. This method is suitable for users who prefer managing their Nix packages through channels.

```bash
# Add the channel as root
sudo nix-channel --add https://github.com/ryantm/agenix/archive/main.tar.gz agenix
sudo nix-channel --update

```

```nix
# configuration.nix
{
  imports = [ <agenix/modules/age.nix> ];

  # Install the agenix CLI
  environment.systemPackages = [ (pkgs.callPackage <agenix/pkgs/agenix.nix> {}) ];
}

```

--------------------------------

### Install agenix NixOS Module via Nix Channel

Source: https://github.com/ryantm/agenix/blob/main/README.md

Imports the agenix NixOS module by adding the agenix repository to your Nix channels. This method is suitable for system-wide installations.

```nix
{ imports = [ <agenix/modules/age.nix> ]; }
```

--------------------------------

### Install home-manager Module via fetchTarball

Source: https://github.com/ryantm/agenix/blob/main/README.md

Integrates the agenix home-manager module by fetching the latest version from GitHub. This allows agenix to manage secrets within the user's home directory configuration. Ensure the tarball URL is correct.

```nix
{ imports = [ "${builtins.fetchTarball "https://github.com/ryantm/agenix/archive/main.tar.gz"}/modules/age-home.nix" ]; }
```

```nix
{ imports = let
    # replace this with an actual commit id or tag
    commit = "298b235f664f925b433614dc33380f0662adfc3f";
  in [
    "${builtins.fetchTarball {
      url = "https://github.com/ryantm/agenix/archive/${commit}.tar.gz";
      # update hash from nix build output
      sha256 = "";
    }}/modules/age-home.nix"
  ];
}
```

--------------------------------

### Install agenix Home Manager Module via Niv

Source: https://github.com/ryantm/agenix/blob/main/README.md

Imports the agenix Home Manager module into your home configuration using the niv package manager. This enables agenix secret management for user-specific configurations.

```nix
{ imports = [ "${(import ./nix/sources.nix).agenix}/modules/age-home.nix" ]; }
```

--------------------------------

### Override Age Binary Path (Nix)

Source: https://github.com/ryantm/agenix/blob/main/doc/reference.md

Specifies a custom path to the `age` binary. This is typically not needed unless the `age` binary is installed in a non-standard location.

```nix
{ pkgs, ... }: { age.ageBin = "${pkgs.age}/bin/age"; }
```

--------------------------------

### Overriding Age Binary with Rage in Nix Flakes

Source: https://github.com/ryantm/agenix/blob/main/README.md

Shows how to configure Nix to use the 'rage' binary instead of the default 'age' binary within a Flakes setup for the agenix package.

```nix
{pkgs,agenix,...}:{
  environment.systemPackages = [ 
    (agenix.packages.x86_64-linux.default.override { ageBin = "${pkgs.rage}/bin/rage"; })
  ];
}
```

--------------------------------

### Install CLI Permanently via Flakes

Source: https://github.com/ryantm/agenix/blob/main/README.md

Adds the agenix CLI to the system's packages permanently using Nix Flakes. This makes the `agenix` command available system-wide. Replace `x86_64-linux` with your system's architecture if necessary.

```nix
{ environment.systemPackages = [ agenix.packages.x86_64-linux.default ]; }
```

```nix
{ inputs.agenix.url = "github:ryantm/agenix";
  # ...

  outputs = { self, nixpkgs, agenix }:
    {
      # change `yourhostname` to your actual hostname
      nixosConfigurations.yourhostname = nixpkgs.lib.nixosSystem {
        system = "x86_64-linux";
        modules = [
          # ...
          {
            environment.systemPackages = [ agenix.packages.${system}.default ];
          }
        ];
      };
    };
}
```

--------------------------------

### Use Decrypted Secret in NixOS Configuration

Source: https://github.com/ryantm/agenix/blob/main/doc/tutorial.md

This Nix code demonstrates how to reference a decrypted secret within your NixOS configuration, for example, to set a user's hashed password. The secret is decrypted to the path specified by `config.age.secrets.secret1.path`.

```nix
{
  users.users.user1 = {
    isNormalUser = true;
    hashedPasswordFile = config.age.secrets.secret1.path;
  };
}
```

--------------------------------

### Install agenix Home Manager Module via Nix Channel

Source: https://github.com/ryantm/agenix/blob/main/README.md

Imports the agenix Home Manager module using Nix channels. This enables agenix secret management for user-specific configurations managed by Home Manager.

```nix
{ imports = [ <agenix/modules/age-home.nix> ]; }
```

--------------------------------

### Install agenix via Nix Flakes

Source: https://context7.com/ryantm/agenix/llms.txt

Integrates agenix into your NixOS flake configuration for system-wide secret management. This method ensures reproducible builds and easy management of your NixOS system.

```nix
# flake.nix
{
  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
    agenix.url = "github:ryantm/agenix";
    # Optional: follow nixpkgs to reduce closure size
    # agenix.inputs.nixpkgs.follows = "nixpkgs";
  };

  outputs = { self, nixpkgs, agenix }:
    {
    nixosConfigurations.myhost = nixpkgs.lib.nixosSystem {
      system = "x86_64-linux";
      modules = [
        ./configuration.nix
        agenix.nixosModules.default
        {
          # Install the agenix CLI
          environment.systemPackages = [ agenix.packages.x86_64-linux.default ];
        }
      ];
    };
  };
}

```

--------------------------------

### Install home-manager Module via Flakes

Source: https://github.com/ryantm/agenix/blob/main/README.md

Integrates the agenix home-manager module using Nix Flakes. This allows agenix to manage secrets within the user's home directory configuration in a reproducible manner. Ensure `username` is replaced with your actual username.

```nix
{ inputs.agenix.url = "github:ryantm/agenix";

  outputs = { self, nixpkgs, agenix, home-manager }:
    {
      homeConfigurations."username" = home-manager.lib.homeManagerConfiguration {
        # ...
        modules = [
          agenix.homeManagerModules.default
          # ...
        ];
      };
    };
}
```

--------------------------------

### Create Secrets Directory and File

Source: https://github.com/ryantm/agenix/blob/main/doc/tutorial.md

This snippet demonstrates the shell commands to create a directory for secrets and an empty `secrets.nix` file. This file is used by the Agenix CLI to manage public keys.

```shell
mkdir secrets
cd secrets
touch secrets.nix
```

--------------------------------

### Agenix CLI Help and Usage

Source: https://github.com/ryantm/agenix/blob/main/doc/reference.md

This section provides a reference for the agenix command-line interface. It outlines the available commands and options for managing age-encrypted secret files, including editing, rekeying, and decrypting.

```bash
agenix - edit and rekey age secret files

agenix -e FILE [-i PRIVATE_KEY]
agenix -r [-i PRIVATE_KEY]

options:
-h, --help                show help
-e, --edit FILE           edits FILE using $EDITOR
-r, --rekey               re-encrypts all secrets with specified recipients
-d, --decrypt FILE        decrypts FILE to STDOUT
-i, --identity            identity to use when decrypting
-v, --verbose             verbose output

FILE an age-encrypted file

PRIVATE_KEY a path to a private SSH key used to decrypt file

EDITOR environment variable of editor to use when editing FILE

If STDIN is not interactive, EDITOR will be set to "cp /dev/stdin"

RULES environment variable with path to Nix file specifying recipient public keys.
Defaults to './secrets.nix'
```

--------------------------------

### Define Public Keys in secrets.nix

Source: https://github.com/ryantm/agenix/blob/main/doc/tutorial.md

This Nix code defines user and system public keys and then assigns them to specific secrets. It also shows how to enable ASCII armor for a secret. This file is not directly imported into NixOS configuration.

```nix
let
  user1 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL0idNvgGiucWgup/mP78zyC23uFjYq0evcWdjGQUaBH";
  user2 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILI6jSq53F/3hEmSs+oq9L4TwOo1PrDMAgcA1uo1CCV/";
  users = [ user1 user2 ];

  system1 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPJDyIr/FSz1cJdcoW69R+NrWzwGK/+3gJpqD1t8L2zE";
  system2 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKzxQgondgEYcLpcPdJLrTdNgZ2gznOHCAxMdaceTUT1";
  systems = [ system1 system2 ];
in
{
  "secret1.age".publicKeys = [ user1 system1 ];
  "secret2.age".publicKeys = users ++ systems;
  "armored-secret.age" = {
    publicKeys = [ user1 ];
    armor = true;
  };
}
```

--------------------------------

### Obtaining SSH Public Keys for Secrets

Source: https://context7.com/ryantm/agenix/llms.txt

Demonstrates methods to retrieve SSH public keys from local files, remote hosts using ssh-keyscan, and GitHub profiles. These keys are essential for encrypting secrets with agenix.

```bash
# From local SSH key
cat ~/.ssh/id_ed25519.pub
# Output: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA... user@host

# From remote host using ssh-keyscan
ssh-keyscan myserver.example.com
# Output includes: myserver.example.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA...

# From GitHub user's public keys
curl https://github.com/username.keys
# Output: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA...

# Scan specific key type
ssh-keyscan -t ed25519 myserver.example.com
```

--------------------------------

### Avoid Reading Cleartext Secrets Directly (Nix Anti-pattern)

Source: https://github.com/ryantm/agenix/blob/main/doc/reference.md

Illustrates an anti-pattern where `builtins.readFile` is used to directly read the cleartext content of a secret. This can lead to the secret being exposed in the Nix store. Services should read the cleartext path at runtime instead.

```nix
{ # Do not do this! config.password = builtins.readFile config.age.secrets.secret1.path; }
```

--------------------------------

### Run Nix Flake Checks

Source: https://github.com/ryantm/agenix/blob/main/doc/contributing.md

Executes the integration tests defined in the Nix flake. This command is used to verify the project's integrity and functionality before merging changes.

```shell
nix flake check
```

--------------------------------

### Configure Secrets Directory and Mount Point (Nix)

Source: https://context7.com/ryantm/agenix/llms.txt

Allows customization of the directory where secrets are stored (`age.secretsDir`) and where secret generations are created (`age.secretsMountPoint`).

```nix
# configuration.nix
{
  # Change the symlink directory (default: /run/agenix)
  age.secretsDir = "/run/keys";

  # Change where secret generations are created (default: /run/agenix.d)
  age.secretsMountPoint = "/run/secret-generations";
}
```

--------------------------------

### Refer to Decrypted Secret Path (Nix)

Source: https://github.com/ryantm/agenix/blob/main/doc/reference.md

Demonstrates how to reference the decryption path of a secret within a Nix configuration. This is useful for setting file permissions or providing paths to services.

```nix
{ users.users.ryantm = { isNormalUser = true; hashedPasswordFile = config.age.secrets.passwordfile-ryantm.path; }; }
```

--------------------------------

### Reference Home-Manager Agenix Secret Path

Source: https://github.com/ryantm/agenix/blob/main/README.md

This Nix code shows how to reference the path of a decrypted Agenix secret within a home-manager configuration. The 'config.age.secrets.example-secret.path' attribute provides the path to the unencrypted secret, which can then be used by programs configured via home-manager.

```nix
{
  programs.some-program = {
    enable = true;
    hashedPasswordFile = config.age.secrets.example-secret.path;
  };
}
```

--------------------------------

### Configure Secret Permissions, Owner, and Group (Nix)

Source: https://github.com/ryantm/agenix/blob/main/doc/reference.md

Sets the file mode (permissions), owner, and group for a decrypted secret file. This is useful for ensuring secrets have the correct access controls.

```nix
{ age.secrets.nginx-htpasswd = { file = ../secrets/nginx.htpasswd.age; mode = "770"; owner = "nginx"; group = "nginx"; }; }
```

--------------------------------

### Add Secret File Path to NixOS Module

Source: https://github.com/ryantm/agenix/blob/main/doc/tutorial.md

This Nix code snippet shows how to declare the path to an encrypted secret file within a NixOS module configuration. This makes the secret available for use in the system.

```nix
{
  age.secrets.secret1.file = ../secrets/secret1.age;
}
```

--------------------------------

### Rekeying Secrets with Agenix CLI

Source: https://github.com/ryantm/agenix/blob/main/README.md

Demonstrates the command to re-encrypt all secrets using the agenix CLI. This is typically done after changing public keys in the secrets configuration.

```ShellSession
$ agenix --rekey
```

--------------------------------

### Define Secret File Path and Decryption Path (Nix)

Source: https://github.com/ryantm/agenix/blob/main/doc/reference.md

Defines both the path to the encrypted `.age` file and the desired path where the secret should be decrypted. This allows customization of the secret's final location.

```nix
{ age.secrets.monitrc = { file = ../secrets/monitrc.age; path = "/etc/monitrc"; }; }
```

--------------------------------

### Configure SSH Identity Paths for Decryption (Nix)

Source: https://context7.com/ryantm/agenix/llms.txt

Specifies the SSH private key paths used by Agenix to decrypt secrets at boot time. Ensure these paths contain valid keys.

```nix
# configuration.nix
{
  # Default: uses openssh host keys automatically
  # Override for custom key locations
  age.identityPaths = [
    "/var/lib/persistent/ssh_host_ed25519_key"
    "/etc/ssh/ssh_host_rsa_key"
  ];

  # IMPORTANT: Use string paths, not nix paths!
  # This is WRONG (would copy key to nix store):
  # age.identityPaths = [ ../keys/id_ed25519 ];
}
```

--------------------------------

### agenix CLI - Rekey Secrets

Source: https://context7.com/ryantm/agenix/llms.txt

Re-encrypts all secrets when public keys change in `secrets.nix`. The `--rekey` command ensures that your secrets are encrypted with the latest set of public keys.

```bash
# Navigate to secrets directory
cd /path/to/secrets

# Rekey all secrets defined in secrets.nix
agenix --rekey

# Rekey with specific identity
agenix --rekey -i ~/.ssh/id_ed25519

# Use custom secrets.nix location
RULES=/path/to/custom/secrets.nix agenix --rekey

```

--------------------------------

### Specify Identity Paths for Decryption (Nix)

Source: https://github.com/ryantm/agenix/blob/main/doc/reference.md

Provides a list of paths to recipient keys that Agenix should use to decrypt secrets. At least one of these keys must be present and valid at runtime.

```nix
{ age.identityPaths = [ "/var/lib/persistent/ssh_host_ed25519_key" ]; }
```

--------------------------------

### Format Nix Code

Source: https://github.com/ryantm/agenix/blob/main/doc/contributing.md

Formats Nix code according to project standards. This command ensures code consistency and readability across the project.

```shell
nix fmt
```

--------------------------------

### Edit Secret File with Agenix CLI

Source: https://github.com/ryantm/agenix/blob/main/doc/tutorial.md

This command uses the Agenix CLI to edit a specified secret file. It assumes your SSH private key is located in `~/.ssh/`.

```shell
agenix -e secret1.age
```

--------------------------------

### Override Age Binary Path (Nix)

Source: https://context7.com/ryantm/agenix/llms.txt

Specifies an alternative binary to use for age encryption/decryption, such as `rage`. This allows using different implementations of the age format.

```nix
# configuration.nix
{ pkgs, ... }:
{
  # Use the default age binary
  age.ageBin = "${pkgs.age}/bin/age";

  # Or use rage (Rust implementation)
  age.ageBin = "${pkgs.rage}/bin/rage";
}
```

```nix
# Using with flakes - override in package
{ pkgs, agenix, ... }:
{
  environment.systemPackages = [
    (agenix.packages.x86_64-linux.default.override {
      ageBin = "${pkgs.rage}/bin/rage";
    })
  ];
}
```

--------------------------------

### Define Secrets in secrets.nix

Source: https://context7.com/ryantm/agenix/llms.txt

Defines public keys and secrets in a `secrets.nix` file, which the `agenix` CLI uses for encryption. This file specifies which public keys can decrypt which secrets.

```nix
# secrets/secrets.nix
let
  # User SSH public keys (from ~/.ssh/id_ed25519.pub or GitHub)
  user1 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL0idNvgGiucWgup/mP78zyC23uFjYq0evcWdjGQUaBH";
  user2 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILI6jSq53F/3hEmSs+oq9L4TwOo1PrDMAgcA1uo1CCV/";
  users = [ user1 user2 ];

  # System SSH host keys (from ssh-keyscan hostname)
  system1 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPJDyIr/FSz1cJdcoW69R+NrWzwGK/+3gJpqD1t8L2zE";
  system2 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKzxQgondgEYcLpcPdJLrTdNgZ2gznOHCAxMdaceTUT1";
  systems = [ system1 system2 ];
in
{
  # Secret accessible by user1 and system1 only
  "secret1.age".publicKeys = [ user1 system1 ];

  # Secret accessible by all users and all systems
  "secret2.age".publicKeys = users ++ systems;

  # Armored secret (Base64 PEM format for readable diffs)
  "armored-secret.age" = {
    publicKeys = [ user1 ];
    armor = true;
  };

  # Database password for production servers
  "db-password.age".publicKeys = [ user1 system1 system2 ];

  # API key accessible only by specific system
  "api-key.age".publicKeys = [ system1 ];
}

```

--------------------------------

### agenix CLI - Create and Edit Secrets

Source: https://context7.com/ryantm/agenix/llms.txt

Utilizes the `agenix` CLI to create new encrypted secrets or edit existing ones. The `-e` flag opens the secret in your default editor, while `-d` decrypts it to standard output.

```bash
# Create or edit a secret (opens $EDITOR with decrypted content)
agenix -e secret1.age

# Edit with a specific identity file
agenix -e secret1.age -i ~/.ssh/id_ed25519

# Decrypt a secret to stdout
agenix -d secret1.age

# Decrypt with specific identity
agenix -d secret1.age -i /etc/ssh/ssh_host_ed25519_key

# Pipe content directly into a secret (non-interactive)
echo "my-secret-password" | agenix -e db-password.age

# Use verbose mode for debugging
agenix -v -e secret1.age

# Show help and version info
agenix --help

```

--------------------------------

### Define Secret File Path (Nix)

Source: https://github.com/ryantm/agenix/blob/main/doc/reference.md

Specifies the path to the encrypted `.age` file for a secret. This is a required option when defining a secret.

```nix
{ age.secrets.monitrc.file = ../secrets/monitrc.age; }
```

--------------------------------

### Override Decryption Path for Secrets (Nix)

Source: https://context7.com/ryantm/agenix/llms.txt

Allows overriding the default decryption path for a secret, which is typically `/run/agenix/<name>`. This is useful for placing secrets in specific locations required by applications.

```nix
# configuration.nix
{
  # Decrypt to a specific path
  age.secrets.monitrc = {
    file = ../secrets/monitrc.age;
    path = "/etc/monitrc";
  };

  # Reference the default path in other config
  services.postgresql = {
    enable = true;
    # Uses default path: /run/agenix/db-password
    passwordFile = config.age.secrets.db-password.path;
  };

  age.secrets.db-password.file = ../secrets/db-password.age;
}
```

--------------------------------

### Override Age Binary with Rage in Nix

Source: https://github.com/ryantm/agenix/blob/main/doc/overriding-age-binary.md

This snippet demonstrates how to override the default 'age' binary used by agenix with the 'rage' implementation. It assumes you are using Nix Flakes and have 'pkgs', 'lib', and 'agenix' available in your scope. The output is a Nix package configuration.

```nix
{ pkgs,
  lib,
  agenix,
  ...
}:
{
  environment.systemPackages = [
    (agenix.packages.x86_64-linux.default.override { ageBin = lib.getExe pkgs.rage; })
  ];
}
```

--------------------------------

### Configure Agenix Secrets Mount Point (Nix)

Source: https://github.com/ryantm/agenix/blob/main/doc/reference.md

This snippet demonstrates how to override the default secrets mount point for Agenix. The secretsMountPoint is the directory where secret generations are created before being symlinked. This configuration is typically done within a Nix expression.

```nix
{
    age.secretsMountPoint = "/run/secret-generations";
}
```

--------------------------------

### Override Secrets Generation Mount Point (Nix)

Source: https://github.com/ryantm/agenix/blob/main/README.md

Specifies the directory where secret generations are created before being symlinked. Defaults to `/run/agenix.d`.

```nix
{ age.secretsMountPoint = "/run/secret-generations"; }
```

--------------------------------

### Control Secret Symlinking Behavior (Nix)

Source: https://github.com/ryantm/agenix/blob/main/doc/reference.md

Configures whether a secret is symlinked (default) or copied to its destination path. Setting `symlink` to `false` is necessary for programs that do not follow symlinks.

```nix
{ age.secrets."elasticsearch.conf" = { file = ../secrets/elasticsearch.conf.age; symlink = false; }; }
```

--------------------------------

### Set Custom Secret File Name (Nix)

Source: https://github.com/ryantm/agenix/blob/main/doc/reference.md

Allows specifying a custom file name for the decrypted secret, which can differ from the attribute name used in the configuration. This is useful when the desired file name is not a valid Nix attribute name.

```nix
{ age.secrets.monit = { name = "monitrc"; file = ../secrets/monitrc.age; }; }
```

--------------------------------

### Edit an Encrypted Secret File with Agenix CLI

Source: https://github.com/ryantm/agenix/blob/main/README.md

This command uses the 'agenix' CLI to edit an existing encrypted secret file ('secret1.age'). It requires the corresponding private SSH key for decryption. The '-i' flag can be used to explicitly specify the private key path if it's not in the default location (~/.ssh/).

```ShellSession
agenix -e secret1.age
agenix -e secret1.age -i ~/.ssh/id_ed25519
```

--------------------------------

### Override Default Secrets Directory (Nix)

Source: https://github.com/ryantm/agenix/blob/main/doc/reference.md

Sets a custom directory where secrets are symlinked by default. This can be useful for organizing secrets in a specific location.

```nix
{ age.secretsDir = "/run/keys"; }
```

--------------------------------

### Disable Symlinking for Secrets (Nix)

Source: https://context7.com/ryantm/agenix/llms.txt

Controls whether secrets are symlinked to their destination path or copied directly. Disabling symlinks is necessary for programs that do not follow them.

```nix
# configuration.nix
{
  # Some programs (like Java/Elasticsearch) don't follow symlinks
  age.secrets."elasticsearch.conf" = {
    file = ../secrets/elasticsearch.conf.age;
    symlink = false;  # Copy instead of symlink
  };

  # Default behavior (symlink = true) for most secrets
  age.secrets.normal-secret = {
    file = ../secrets/normal-secret.age;
    # symlink = true; (default)
  };
}
```

--------------------------------

### Configure Agenix Secrets in Home-Manager

Source: https://github.com/ryantm/agenix/blob/main/README.md

This Nix code configures Agenix secrets for use with home-manager. It specifies the paths to SSH identity files and defines secrets, similar to the NixOS module. Secrets are decrypted to a user-specific directory upon 'home-manager switch'.

```nix
{
  age = {
    identityPaths = [ "~/.ssh/id_ed25519" ];
    secrets = {
      example-secret = {
        file = ../secrets/example-secret.age;
      };
    };
  };
}
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.