SecretsSetup

Full-lifecycle sops-nix secrets management for NixOS machines. Generates standalone age key pairs, creates encrypted YAML secrets files, and deploys them to the NixOS host configuration directory. Key types: - machine: per-machine key (generated via age-keygen) - dev: shared key across development machines (optional) - owner: personal key for the machine owner (optional) Can run locally (on the NixOS target) or remotely via SSH. See nixos/docs/security/secrets-management.md for the architecture overview. Prerequisites on target: sops, age (assumed pre-installed via NixOS config or nix-shell).

public static class SecretsSetup

1. Methods

1.1. CanDecrypt(ISystemHost, string, string, SSHEnvironment?)

Verifies that sops can decrypt the host’s secrets file using the machine’s age key.

public static bool CanDecrypt(ISystemHost host, string hostDir, string hostname, SSHEnvironment? sshEnvironment = null)

Table 1. Parameters
Name	Type	Description
host	ISystemHost
hostDir	string
hostname	string
sshEnvironment	SSHEnvironment?

Returns: bool

1.2. GetMachineAgePublicKey(ISystemHost, string, string, SSHEnvironment?)

Reads the machine’s age public key from the host directory. Returns null if the key file does not exist.

public static string GetMachineAgePublicKey(ISystemHost host, string hostDir, string hostname, SSHEnvironment? sshEnvironment = null)

Table 2. Parameters
Name	Type	Description
host	ISystemHost
hostDir	string
hostname	string
sshEnvironment	SSHEnvironment?

Returns: string

1.3. SetSecret(ISystemHost, string, string, string, string, SSHEnvironment?)

Adds or updates a single secret in an existing encrypted secrets file.

public static void SetSecret(ISystemHost host, string hostDir, string hostname, string key, string value, SSHEnvironment? sshEnvironment = null)

Table 3. Parameters
Name	Type	Description
host	ISystemHost
hostDir	string
hostname	string
key	string
value	string
sshEnvironment	SSHEnvironment?

1.4. SetupSecrets(ISystemHost, Computer, string, Dictionary<string, string>, string, string, SSHEnvironment?)

Full secrets setup lifecycle for a NixOS machine. Generates an age key pair if one doesn’t exist, writes .sops.yaml, creates an encrypted secrets.yaml, and places everything in the host config directory.

public static void SetupSecrets(ISystemHost host, Computer computer, string nixosConfigPath = null, Dictionary<string, string> secrets = null, string devAgePublicKey = null, string ownerAgePublicKey = null, SSHEnvironment? sshEnvironment = null)

Table 4. Parameters
Name	Type	Description
host	ISystemHost	System host for logging and user interaction.
computer	Computer	Target computer identity (hostname used for secrets file naming).
nixosConfigPath	string	Path to the NixOS flake on disk. Defaults to /etc/nixos.
secrets	Dictionary<string, string>	Key-value pairs to encrypt. Null/empty creates an empty secrets template.
devAgePublicKey	string	Optional developer age public key (age1…) shared across dev machines.
ownerAgePublicKey	string	Optional owner age public key (age1…) for the machine owner.
sshEnvironment	SSHEnvironment?	Optional SSH environment for remote execution. Null = local execution.