Archived
beatzaplentyandClaude Sonnet 4.6
8c19ee9d72
SOPS_AGE_KEY_FILE was set in hosts/nixos/home.nix sessionVariables with a literal ~ that Home Manager injects as-is into the environment. In bash, tilde expansion does not happen inside double-quoted variable references, so DEFAULT_SOPS_AGE_KEY_FILE resolved to ~/... literally and the -s file-existence check in ensure_admin_decrypt_key silently failed. The script then generated a brand-new age key (to ~/... relative to the repo root) while the real admin key at ~/.config/sops/age/keys.txt went untouched -- making it appear the key was lost when it was actually still intact. Fix the home.nix root cause by using config.home.homeDirectory so the path is fully resolved. Add tilde expansion in ensure_admin_decrypt_key as a belt-and-suspenders guard for any caller whose environment has the same issue. Also replace the auto-generate-a-new-key fallback with a hard failure: auto- generating a new admin key is never useful (it cannot decrypt existing secrets) and created serious confusion about whether the original key was lost. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>