{"id":13781731,"url":"https://github.com/jordanisaacs/homeage","last_synced_at":"2025-12-30T00:23:19.126Z","repository":{"id":45953897,"uuid":"425530224","full_name":"jordanisaacs/homeage","owner":"jordanisaacs","description":"runtime decrypted age secrets for nix home manager","archived":false,"fork":false,"pushed_at":"2023-11-11T01:51:53.000Z","size":33,"stargazers_count":134,"open_issues_count":12,"forks_count":20,"subscribers_count":8,"default_branch":"main","last_synced_at":"2024-11-17T16:43:13.530Z","etag":null,"topics":["age","encryption","home-manager","nix","nixos","secrets"],"latest_commit_sha":null,"homepage":"","language":"Nix","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jordanisaacs.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2021-11-07T14:46:28.000Z","updated_at":"2024-10-30T05:02:54.000Z","dependencies_parsed_at":"2024-01-15T20:47:21.287Z","dependency_job_id":"3d75f8d6-4cea-47eb-8e25-8e3bc32b2fb5","html_url":"https://github.com/jordanisaacs/homeage","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jordanisaacs%2Fhomeage","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jordanisaacs%2Fhomeage/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jordanisaacs%2Fhomeage/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jordanisaacs%2Fhomeage/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jordanisaacs","download_url":"https://codeload.github.com/jordanisaacs/homeage/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":253588594,"owners_count":21932286,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["age","encryption","home-manager","nix","nixos","secrets"],"created_at":"2024-08-03T18:01:28.750Z","updated_at":"2025-12-30T00:23:19.087Z","avatar_url":"https://github.com/jordanisaacs.png","language":"Nix","funding_links":[],"categories":["Nix","Integrations"],"sub_categories":[],"readme":"# homeage - runtime decrypted [age](https://github.com/str4d/rage) secrets for nix home manager\n\n`homeage` is a module for [home-manager](https://github.com/nix-community/home-manager) that enables runtime decryption of declarative age files.\n\n## Features\n\n- [x] File agnostic declarative secrets that can be used inside your home-manager flakes\n- [X] Symlink (or copy if symlinks aren't supported) decrypted secrets\n- [X] Safely cleans up secrets on generation change or systemd service stop\n- [x] Encryption is normal age encryption, use your ssh or age keys\n- [X] Decryption/cleanup secrets either through systemd services or home-manager activation (for systems without systemd support)\n\n## Management Scheme\n\nPre-Build:\n\n* Encrypt files with age and make them accessible to home-manager config (through git repository, builtin function, etc.).\n* Install your age/ssh key outside of the scope home-manager.\n\nPost-build:\n\n* Encrypted files are copied into the nix store (globally available).\n* Scripts for decrypting are in the nix store (globally available).\n    * Because of this **must** to make sure your decryption key has correct file permissions set.\n\n### Systemd Installation\n\nService Start:\n* Decrypts secret and copies/symlinks to locations\n\nService Stop:\n* Cleans up decrypted secret and associated copies/symlinks\n\nHome-manager activation:\n* With home-manager systemd reload enabled services will automatically reload/stop during activation for seamless cleanup and re-installation.\n\n### Activation Installation\n\nHome-manager activation:\n* Cleans up all secrets that changed between current and previous generation\n* Decrypts secret and copies/symlinks to locations\n\n## Getting started\n\n### Non-flake\n\nIf you are using homeage without nix flakes feel free to contribute an example config.\n\n### Nix Flakes\n\nImport `homeage.homeManagerModules.homeage` into the configuration and set valid `homeage.identityPaths` and your all set.\n\n```nix\n{\n  inputs = {\n    nixpkgs.url = \"nixpkgs/nixos-unstable\";\n    home-manager = {\n      url = \"github:nix-community/home-manager\";\n      inputs.nixpkgs.follows = \"nixpkgs\";\n    };\n    homeage = {\n      url = \"github:jordanisaacs/homeage\";\n      # Optional\n      inputs.nixpkgs.follows = \"nixpkgs\";\n    };\n  };\n\n  outputs = { nixpkgs, homeage, ... }@inputs:\n    let\n      pkgs = import nixpkgs {\n        inherit system;\n      };\n      \n      system = \"x86_64-linux\";\n      username = \"jd\";\n      stateVersion = \"21.05\";\n    in {\n      homeManagerConfigurations = {\n        jd = home-manager.lib.homeManagerConfiguration {\n          inherit system stateVersion username pkgs;\n          home.homeDirectory = \"/home/${username}\";\n\n          configuration = {\n            home.stateVersion = stateVersion;\n            home.username = username;\n            home.homeDirectory = \"/home/${username}\";\n\n            homeage = {\n                # Absolute path to identity (created not through home-manager)\n                identityPaths = [ \"~/.ssh/id_ed25519\" ];\n\n                # \"activation\" if system doesn't support systemd\n                installationType = \"systemd\";\n\n                file.\"pijulsecretkey\" = {\n                  # Path to encrypted file tracked by the git repository\n                  source = ./secretkey.json.age;\n                  symlinks = [ \"${config.xdg.configHome}/pijul/secretkey.json\" ];\n                  copies = [ \"${config.xdg.configHome}/no-symlink-support/secretkey.json\" ];\n                };\n            };\n\n            imports = [ homeage.homeManagerModules.homeage ];\n          };\n        };\n      };\n    };\n}\n```\n\n## Options\n\nSee [source](./module/default.nix) for all the options and their descriptions.\n\n## Acknowledgments\n\nThe inspiration for this came from RaitoBezarius' [pull request](https://github.com/ryantm/agenix/pull/58/files) to agenix. I have been trying to figure out how to do secrets with home manager for a while and that PR laid out the foundational ideas for how to do it!\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjordanisaacs%2Fhomeage","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjordanisaacs%2Fhomeage","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjordanisaacs%2Fhomeage/lists"}