I use agenix when I can, but I'm internally wincing at the thought of trying to explain it to friends I'm getting into nixos. It's not exactly usable. /nix/sto

I use agenix when I can, but I'm internally wincing at the thought of trying to explain it to friends I'm getting into nixos. It's not exactly usable. /nix/store isn't world-readable. It's machine-readable, and most machines are single-user. I'll explain the caveats, but I can't tell them never to put secrets there; the predictable outcome then is they won't try nixos.