nixos/docs/src/evalSecrets.md

Evaluation time secrets

Some secrets cannot be left in cleartext (e.g time zone, user's real names), but are required at evaluation time, and in some cases using sops-nix's template is really inconvenient. To handle this, currently i use strange approach: I manually encrypt files with sops, commit them and manually decrypt. git-agecrypt wasn't suitable for me. In future, i will replace it with my own implementation of transparent git encryption based on sops.

Also, this used only for secrets which may be safely left in world-readable store. For more sensitive secrets I use sops-nix, which decrypts secrets only at runtime.