agenix doesn't work properly when using impermanence

[jankaifer]

I have the ssh key on in my home directory and it is mounted by impermanence on startup. Not sure what changes, but agenix started failing recently and it was caused by the fact that agenix started running before impermanence, which causeg agenix to not find the ssh key and fail to bootstrap the secrets.

I just solved it by not relying on impermanence mounts and specify directly the location of the ssk key on persistent drive like this.

Opening this issue mostly for others if someone faces a similar issue.

[nbraud]

@jankaifer Are you using age-home.nix and impermanence in some home-manager config, bind-mounting the whole .ssh directory?

I don't have direct experience with either, but the issue is agenix and impermanence both using systemd user services (in that configuration) and have no ordering constraints between them.

The possible solutions would either be breaking the dependency as you did, or constraining the order in which they can run; for instance, this ought to do the trick:

systemd.user.services.agenix.Unit.After = [
  "basic.target"  # Ensures “basic boot-up” runs prior to agenix, including impermanence's bind-mounts
];

[jankaifer]

@nbraud thanks for the tip with systemd services, I didn't realize that.

I run with / mounted as tmpfs and mount everything persistent with impermanence.

[nbraud]

I run with / mounted as tmpfs and mount everything persistent with impermanence.

I have a similar configuration but no impermanence: I used to have it imported until I realised it wasn't used, as I was doing everything with ZFS datasets anyways =^.^'=

FYI, when using agenix in the system config (as opposed to an hm one) the situation is different: it runs as an activationScript, whereas impermanence's NixOS module still uses services, so there's no easy way to order agenix after impermanence.
I just ran into a variant of that, as my laptop's SSH host key is held on a filesystem that is mounted by systemd, and isn't yet available when agenix runs.

[Infinidoge]

I ran into this issue a while back in my btrfs-backed impermanence setup. What I ended up doing was manually mounting /etc/ssh's subvolume in my NixOS filesystems block, then letting impermanence handle the rest from my /persist directory.

Relevant block in my configuration