If you need to update the secrets or deploy to a new machine, then you'll need to unlock the git-crypt store. The secrets will automatically be encrypted again when committing.
./unlock.shTo rebuild the os configuration run
nixos-rebuild switch --target-host base@uranus --flake .#qaTagion infrastructure
Resources:
https://github.com/tagion/devopsdoc
https://astro.github.io/microvm.nix/intro.html
https://github.com/astro/microvm.nix
https://lgug2z.com/articles/handling-secrets-in-nixos-an-overview/