cluster/services/cachix-deploy-agent/agent.nix

@@ -1,11 +1,9 @@
-{ config, depot, ... }:
+{ cluster, depot, ... }:
 
 {
-  age.secrets.cachixDeployToken.file = ./credentials/${config.networking.hostName}.age;
-
   services.cachix-agent = {
     enable = true;
-    credentialsFile = config.age.secrets.cachixDeployToken.path;
+    credentialsFile = cluster.config.services.cachix-deploy-agent.secrets.token.path;
     package = depot.packages.cachix;
   };
 }

cluster/services/cachix-deploy-agent/default.nix

@@ -1,6 +1,10 @@
 {
-  services.cachix-deploy-agent = {
+  services.cachix-deploy-agent = { config, ... }: {
     nodes.agent = [ "checkmate" "grail" "prophet" "VEGAS" "thunderskin" ];
     nixos.agent = ./agent.nix;
+    secrets.token = {
+      nodes = config.nodes.agent;
+      shared = false;
+    };
   };
 }