Rekey Secrets
Re-encrypt all secrets after modifying .age files or when host keys change.
When to use:
- After creating or updating any
.age file
- After adding a new host to
secrets.nix
- After rotating host SSH keys
Prerequisites
# Unlock agenix before rekeying
just unlock
Steps
Rekey all secrets:
just rekey
Stage and verify rekeyed files:
git add secrets/
ls secrets/nixos/*/
Lock agenix when done:
agenix-helper lock
Where Rekeyed Secrets Go
After agenix rekey -a, encrypted secrets are stored in:
secrets/nixos/<hostname>/<hash>-<secret_name>.age
Troubleshooting
Rekey fails with host errors
- Check that all hosts in
secrets.nix have valid keys
- Verify host public keys are correct in the repository
Permission denied
# Ensure agenix is unlocked
just unlock
Example
# Unlock, rekey, and stage
just unlock
just rekey
git add secrets/
Post-Rekey Checklist
