From ef00eb31e0f013c0ffb19a85d0e821cf74c9d3de Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?ryan4yin=20=7C=20=E4=BA=8C=E8=8A=B1?= <ryan4yin@linux.com>
Date: Mon, 21 Sep 2026 21:18:06 +0800
Subject: [PATCH] docs: warn that user-readable decrypted secrets must not be
 read (#303)

Only three secrets are readable as the login user (nix-access-tokens,
ssh-key-romantic and the nushell one); everything else is root-only and
the filesystem already keeps agents out.
---
 home/base/tui/shell/default.nix        | 2 +-
 home/base/tui/ssh.nix                  | 1 +
 modules/darwin/nix-core.nix            | 1 +
 modules/nixos/base/remote-building.nix | 2 +-
 modules/nixos/desktop/nix.nix          | 1 +
 5 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/home/base/tui/shell/default.nix b/home/base/tui/shell/default.nix
index 1290c2de..5bb8c8b1 100644
--- a/home/base/tui/shell/default.nix
+++ b/home/base/tui/shell/default.nix
@@ -10,7 +10,7 @@
     # currently, nushell does not support conditional sourcing of files
     # https://github.com/nushell/nushell/issues/8214
     extraConfig = ''
-      # decrypted secret: AI agents must not read the sourced file, only reference the path
+      # decrypted secret: AI agents must not read it
       source /etc/agenix/nushell-secrets.nu
 
       # Directories in this constant are searched by the
diff --git a/home/base/tui/ssh.nix b/home/base/tui/ssh.nix
index 10ae885a..3e243fcf 100644
--- a/home/base/tui/ssh.nix
+++ b/home/base/tui/ssh.nix
@@ -35,6 +35,7 @@
 
       "192.168.*" = {
         ForwardAgent = true;
+        # decrypted secret: AI agents must not read it
         IdentityFile = "/etc/agenix/ssh-key-romantic";
         IdentitiesOnly = true;
       };
diff --git a/modules/darwin/nix-core.nix b/modules/darwin/nix-core.nix
index bfffc43f..502e0d0c 100644
--- a/modules/darwin/nix-core.nix
+++ b/modules/darwin/nix-core.nix
@@ -27,6 +27,7 @@
   system.stateVersion = 5;
 
   nix.extraOptions = ''
+    # decrypted secret: AI agents must not read it
     !include ${config.age.secrets.nix-access-tokens.path}
   '';
 }
diff --git a/modules/nixos/base/remote-building.nix b/modules/nixos/base/remote-building.nix
index 10720627..e3fa0e1e 100644
--- a/modules/nixos/base/remote-building.nix
+++ b/modules/nixos/base/remote-building.nix
@@ -17,7 +17,7 @@
   nix.buildMachines =
     let
       sshUser = myvars.username;
-      # ssh key's path on local machine
+      # ssh key's path on local machine; a decrypted secret AI agents must not read
       sshKey = "/etc/agenix/ssh-key-romantic";
       systems = [
         # native arch
diff --git a/modules/nixos/desktop/nix.nix b/modules/nixos/desktop/nix.nix
index 5a2310c6..36316818 100644
--- a/modules/nixos/desktop/nix.nix
+++ b/modules/nixos/desktop/nix.nix
@@ -1,6 +1,7 @@
 { config, ... }:
 {
   nix.extraOptions = ''
+    # decrypted secret: AI agents must not read it
     !include ${config.age.secrets.nix-access-tokens.path}
   '';
 }