@jankaifer Are you using age-home.nix and impermanence in some home-manager config, bind-mounting the whole .ssh directory?

I don't have direct experience with either, but the issue is agenix and impermanence both using systemd user services (in that configuration) and have no ordering constraints between them.

The possible solutions would either be breaking the dependency as you did, or constraining the order in which they can run; for instance, this ought to do the trick:

systemd.user.services.agenix.Unit.After = [
  "basic.target"  # Ensures “basic boot-up” runs prior to agenix, including impermanence's bind-mounts
];

@nbraud thanks for the tip with systemd services, I didn't realize that.

I run with / mounted as tmpfs and mount everything persistent with impermanence.

I run with / mounted as tmpfs and mount everything persistent with impermanence.

I have a similar configuration but no impermanence: I used to have it imported until I realised it wasn't used, as I was doing everything with ZFS datasets anyways =^.^'=

FYI, when using agenix in the system config (as opposed to an hm one) the situation is different: it runs as an activationScript, whereas impermanence's NixOS module still uses services, so there's no easy way to order agenix after impermanence.
I just ran into a variant of that, as my laptop's SSH host key is held on a filesystem that is mounted by systemd, and isn't yet available when agenix runs.

I ran into this issue a while back in my btrfs-backed impermanence setup. What I ended up doing was manually mounting /etc/ssh's subvolume in my NixOS filesystems block, then letting impermanence handle the rest from my /persist directory.

Relevant block in my configuration

I'm surprised this isn't mentioned here, but it's possible to just specify the direct location for the SSH hostkeys, and not having impermanence "manage" it as such. This is a simple snippet that I'm currently using, which works quite nicely. Seems like the most elegant solution to the problem.

{ config, ... }:

let
  statePath = config.environment.persistence.root.persistentStoragePath + "/etc/ssh";
in {
  services.openssh.hostKeys = [
    { path = statePath + "/ssh_host_rsa_key"; type = "rsa"; bits = 4096; }
    { path = statePath + "/ssh_host_ed25519_key"; type = "ed25519"; }
  ];
}