1= Fleet Secrets Management System2:slug: secrets3:order: 145== Overview67Secret management system is a built-in way to deploy secrets to remote systems, similar to agenix and other similar systems.89Secrets are encrypted using system's host ssh key (/etc/ssh/ssh_host_ed25519_key), which is not required to build the10remote system/add secret to fleet configuration, fleet users are encrypting secrets using received public key instead,11they don't need the root access to receive the public encryption key.1213== Example1415[source,nix]16----17{18 fleet.secrets = {19 "my-secret" = {20 expectedOwners = [ "host1" "host2" ];21 regenerateOnOwnerAdded = true;22 generator = {mkImpureSecretGenerator}:23 mkImpureSecretGenerator {24 script = ''25 echo "secret content" | gh private -o $out/secret26 '';27 };28 };29 }30}31----3233== Limitations and Future Improvements3435- Pure secret generators are currently disabled36- Support for other secret management systems (e.g systemd-creds has planned asymmetric encryption support)37