Home isn't mounted when AgeNix runs

Help
1

I know this is an AgeNix question, but it feels like it’s more of a general setup issue with my system. I have to assume that everyone else has /home mounted when AgeNix runs. haha

I run a pretty standard BTRFS system, on top of LUKS encryption: here are the details:

https://git.sr.ht/~pkulak/nix/tree/main/item/configuration.nix#L15

And here’s what happens every boot:

Nov 17 08:33:48 fry stage-2-init: running activation script...
Nov 17 08:33:48 fry stage-2-init: [agenix] creating new generation in /run/agenix.d/1
Nov 17 08:33:48 fry stage-2-init: [agenix] decrypting secrets...
Nov 17 08:33:48 fry stage-2-init: [agenix] WARNING: config.age.identityPaths entry /home/phil/.ssh/id_ed25519 not present!
Nov 17 08:33:48 fry stage-2-init: decrypting '/nix/store/jgjsy6dqil4ciz8hn60daj187rj462f7-1pass.age' to '/run/agenix.d/1/1pass'...
Nov 17 08:33:48 fry stage-2-init: [agenix] WARNING: no readable identities found!
Nov 17 08:33:48 fry stage-2-init: Error: Missing identities.
Nov 17 08:33:48 fry stage-2-init: Did you forget to specify -i/--identity?

I guess I’m just assuming that /home isn’t mounted at this point, but it’s the only thing I can imagine. If I do a rebuild switch after I log in, all the secrets get setup just fine.

Thanks for any help!

1 Like
2

Covered elsewhere in Matrix, but the gist of the issue was using the user key as the encryption target for host-based secrets.

For agenix, the common pattern is to encrypt things to both types of key:

  • each host that’s going to install them, via the ssh host key
  • each user that’s going to edit them in the repository, via ssh user key

That way you can edit secrets, rekey them to additional/new hosts, etc.

1 Like