hortusfox-setup reads both files as cfg.user, not root. Pointing either at an agenix/sops-nix secret without setting its owner/group to match cfg.user/cfg.group fails the service with a permission error rather than anything obviously related -- note it on both options. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>