Phase 3: Encrypted secrets
- Add secrets module with agenix integration
- Create secrets/secrets.nix template for key definitions
- Installer generates SSH key if missing
- Installer creates personalized secrets.nix with user's key
- Full documentation in docs/SECRETS.md
Features:
- Secrets encrypted with age using SSH keys
- Decrypted automatically at system activation
- Safe to commit .age files to git
- Support for WiFi passwords, API keys, service credentials
Usage:
agenix -e secrets/my-secret.age
age.secrets.my-secret.file = ./secrets/my-secret.age;
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Brandon Lucas
5a52b3c159