Skip to content

Commit e90760d

Browse files
authored
Update README.md
1 parent 9edb178 commit e90760d

File tree

1 file changed

+16
-3
lines changed

1 file changed

+16
-3
lines changed

README.md

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -364,7 +364,20 @@ e.g. inside your `flake.nix` file:
364364
When the `age.secrets` attribute set contains a secret, the `agenix` NixOS module will later automatically decrypt and mount that secret under the default path `/run/agenix/secret1`.
365365
Here the `secret1.age` file becomes part of your NixOS deployment, i.e. moves into the Nix store.
366366

367-
6. Reference the secrets' mount path in your config:
367+
You may also generate them based on the `secrets.nix` file with no extra options:
368+
```nix
369+
{ lib, ... }:
370+
371+
{
372+
age.secrets =
373+
lib.genAttrs (lib.map (lib.removeSuffix ".age") (lib.attrNames (import ./secrets.nix)))
374+
(name: {
375+
file = ./${name}.age;
376+
});
377+
}
378+
```
379+
380+
7. Reference the secrets' mount path in your config:
368381
```nix
369382
{
370383
users.users.user1 = {
@@ -375,11 +388,11 @@ e.g. inside your `flake.nix` file:
375388
```
376389
You can reference the mount path to the (later) unencrypted secret already in your other configuration.
377390
So `config.age.secrets.secret1.path` will contain the path `/run/agenix/secret1` by default.
378-
7. Use `nixos-rebuild` or [another deployment tool](https://wiki.nixos.org/wiki/Applications#Deployment") of choice as usual.
391+
8. Use `nixos-rebuild` or [another deployment tool](https://wiki.nixos.org/wiki/Applications#Deployment") of choice as usual.
379392

380393
The `secret1.age` file will be copied over to the target machine like any other Nix package.
381394
Then it will be decrypted and mounted as described before.
382-
8. Edit secret files:
395+
9. Edit secret files:
383396
```ShellSession
384397
$ agenix -e secret1.age
385398
```

0 commit comments

Comments
 (0)