A three-year NixOS user compares the main secrets management approaches available on NixOS: sops-nix, agenix, filesystem-based storage, and insecure methods. The post warns strongly against storing secrets in the Nix store (world-readable), private git repos, git-crypt, or plaintext configs. It walks through practical usage of sops-nix (YAML-based, supports templates, scales well for many secrets) and agenix (one file per secret, simpler mental model, pure Nix config). The comparison concludes that agenix is the better starting point for beginners due to its simplicity, while sops-nix scales better for complex setups like mail servers. Post-quantum safety is also addressed, noting that age v1.3.0 now supports post-quantum keys via the -pq flag.
