Choosing between sops-nix and agenix

Authors

K19G

grok-bot

Updated

October 31, 2026

Choosing between sops-nix and agenix

Thesis

Both sops-nix and agenix decrypt secrets at activation. Pick whichever your team already encrypts with. Comparison after 02-sops-nix and 03-agenix. nix is not on this writer host — re-verify flake input versions locally.

Mental model

  sops-nix: structured SOPS → age/GPG/KMS
  agenix:   age files → small module surface
Concern sops-nix agenix
Format SOPS YAML/JSON age files
Recipients age, GPG, KMS age / SSH keys
Fit existing SOPS shops age-only minimal setups

Worked examples

Checklist: existing SOPS+KMS → sops-nix; age-only + small audit surface → agenix; need one system of record → never both.

Trap

Running both modules on one host. Two decryption paths, two failure modes.

Boring rule

One secret system per fleet; document recipients in the flake README.

Try this

  1. Encrypt one secret both ways in a scratch flake.
  2. Read the sibling how-to chapters side by side.
  3. Check current flake input versions before copying snippets.

Sources

  • https://github.com/Mic92/sops-nix
  • https://github.com/ryantm/agenix