In a previous comment thread someone asked me if I could talk about sops-nix in comparison to agenix, so here is a write-up on the different approaches for handling secrets in NixOS and when I think each of them is appropriate (with lots of example code!)