A while ago, I had this exact problem and I threw a template together using a combination of age + passage + agenix (nix) solution to automate my secret managem

A while ago, I had this exact problem and I threw a template together using a combination of age + passage + agenix (nix) solution to automate my secret management solution. https://github.com/Swoorup/passage-nix-secrets-template https://github.com/Swoorup/passage-nix-secrets-template EDIT: This is meant to used in a nix-based deployment setting, and also you don't want to commit the identities file unless you use yubikeys (Something which I forgot to mention in the readme).