Use local storage

nixos/common/global/age.nix

@@ -16,21 +16,13 @@ in
     agenix-rekey
   ];
 
-  age = {
+  age.rekey = {
-    # Master identity used for decryption
-    rekey.masterIdentities = [ ../users/sajenim/agenix-rekey.pub ];
     # Pubkey for rekeying
-    rekey.hostPubkey = ../../${hostname}/ssh_host_ed25519_key.pub;
+    hostPubkey = ../../${hostname}/ssh_host_ed25519_key.pub;
+    # Master identity used for decryption
+    masterIdentities = [ ../users/sajenim/agenix-rekey.pub ];
     # Where we store the rekeyed secrets
-    rekey.cacheDir = "/var/tmp/agenix-rekey/\"$UID\"";
+    storageMode = "local";
-    # All rekeyed secrets for each host will be collected in a derivation which copies them to the nix store when it is built
+    localStorageDir = ./. + "/secrets/rekeyed/${config.networking.hostName}";
-    rekey.storageMode = "derivation";
   };
-  # Required to persist `/var/tmp/agenix-rekey`
-  environment.persistence."/persist".directories = [
-    { directory = "/var/tmp/agenix-rekey"; mode = "1777"; }
-  ];
-  # As user not a trusted-users in our nix.conf
-  # we must add age.rekey.cacheDir as a global extra sandbox path
-  nix.settings.extra-sandbox-paths = [ "/var/tmp/agenix-rekey" ];
 }

nixos/common/global/secrets/rekeyed/fuchsia/146f3229661998a1ca74449720287a7d-smb-secrets.age

@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> ssh-ed25519 jVljVA ILfVChFf5s9U6CODItB/TqS1tUaAEeoLAGiNKPbDclU
+MCyVqjOPexZm+is5JWG5zfbS26nJj/Z4mk6SJDufBPM
+-> R<DEa-grease +b`?*<b*
+/5YP7TzDWxztiGzrMKkUYSBzX9wcz6HSR2mFNX0JmfaTVcnJFrl3KcqfJeNf/z1w
+JIBgF+2wzeD5I7PCcNjmHGn0f+W9kAImbw8
+--- LZwgwtMUkIk4l/juYhY0i7kNFurvMAgcjhrYX4PsSEE
+7c5ÌñÀ
îÝ{¶>Œ¤Æ¥ãÕ<C3A3>“II¥9ôsÆç~³a–{³ê'¥æ<5›|±o;_§*T³'|yí¿sÇvt(ÊXŠ_J.ø`£ŠÈr`“"ÜÙ|ª*‘Æ[ê

nixos/common/global/secrets/rekeyed/viridian/026c5a7ee6936afe4252144b692d20dd-enrollment-key.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 KTkZog wTpircyIN9PphOvX8FtFMU6Qir790QIhdWGGhp+NSS4
+NxK4uP2YyJXdhuixQVslEAEecvTu2HUM0JNYxN4uT9M
+-> Y"s_\v5`-grease [YNL^5 eKm) 9eS1} r
+BWWX7A4Jar3ojDWzyxayQ0Vi95RG2tE
+--- o0F6BEiHny57JBW9psAG7JgxoIO0jzbIJ9AG9cROdd4
+-s;'¸›/‘¯Gõ’ r»È‚Ià·w‡2ï–žèÐP‚ù*EˆÎÝÊ÷W»”~j#4
ZwóVü

nixos/common/global/secrets/rekeyed/viridian/28bc204cd826947442f56c6ddc28829f-traefik.age

@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> ssh-ed25519 KTkZog UtP8CzqqbmeIL6dRQ6UQFP4/ZZWQBPUxbzhqdMnPwSw
+EMkbY1yoyamLXQ3e8cFK+NW7NSgoWS3/zB0O2odXanI
+-> za72-grease
+kRZubf60Uy2ne30UxkeIsgOuKPfx44pvVyMHGxlaHXhC8InnJu8JFAiYuFsc8ky7
+e7c5
+--- 15mIrLf9zjT7wEgTsFaUcH5ADhBAf4drxiueUSd/gus
+Ëž—¸4ÕêçãÛbE#.]aÀ ½£à<ggó[)É¿òù
C‚]h=eêÃŪ·ÅˆEpT¯ã€Iß×{Âêûò¨´ÊB.ƒ0€¡¸rÚÃÀoÒ’W	å“d'T¹\é™%´ƒ<1E>öeÃ_÷\•“Éœ5À+ú¹ýÝ,˜m0¹®JÛM¨WÓîCsWô=¸Dn);Z–&´X‹!çG­!Â+§aW{e,ìM,±…ÊŠöol+6½Sþ
öÜ4¡<34>”	&€î$Ké“üº\4sJùéØÕªÎë

nixos/common/global/secrets/rekeyed/viridian/2bf24f1e069b0a5eb4596f26d9f0e380-traefik-bouncer-key.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 KTkZog eD/tQAdKjWDDg1sI5fYeLrVTsYA11Pqb+BvHKkbBIxk
+VHZXnKoyb4QhC6+ir/B+yfAdJ76d6koegb9LGS60Ik4
+-> m(_p-grease 9:63B,o
+GI8IPaOpdPBzOiUcj02Be+Ep54hnawoZ6ypt47k
+--- 8CrSHUUOTWZ11AKVsXHCfSfpcllFwv2Q6xJMHpPQYe0
+ê7ă~¡™ñM#„eꚶÿ0Š@T
+³Æ¾ñtáÎ$Ê<>öP›<50>ŽŒHzÜ6’ë
+ÂÙ<ȼ->:…üª]ÍøÊ™