+ doc workflow details

doc/src/faq.md

@@ -1,5 +1,7 @@
 # Frequent Asked Questions
 
-1. rebooting deploy failed with could not found ssh private key, but it indeed just there.
+**Q.** Rebooting and unit failed with could not found ssh private key, but it indeed just there.
 
-   Check if using `root on tmpfs`, and modify [hostKeys](https://oluceps.github.io/vaultix/nixos-option.html#hostkeys) path to Absolute path string to your REAL private key location (not bind mounted or symlinked etc.)
+**A.**   Check if using `root on tmpfs`, and modify [hostKeys](https://oluceps.github.io/vaultix/nixos-option.html#hostkeys) path to Absolute path string to your REAL private key location (not bind mounted or symlinked etc.)
+
+---

doc/src/flake-option.md

@@ -52,9 +52,6 @@ Recipients used for backup. Any of identity of them will able to decrypt all sec
 
 > Changing this will not take effect to `renc` command output. The hash of host pub key re-encrypted filename is `blake3(encrypted secret content + host public key)`.
 
-I personally don't recommend setting this.
-
-
 ### cache =
 
 **String** of path that **relative** to flake root, used for storing host public key

doc/src/nixos-option.md

@@ -144,7 +144,7 @@ This pretend the secret which `id` (the keyof attribute of secrets) was defined.
 
 ```nix
 secrets = {
-  # the id is example. despite `name`.
+  # the id is 'example'. despite `name`.
   example = {
     file = ./secret/example.age;
   };

doc/src/workflow.md

@@ -1,2 +1,63 @@
-# TODO
-Common used workflow with vaultix
+# Workflows
+Common used workflow with vaultix.
+
+## Add new secret
+
+
+### 1. Run edit:
+
+```bash
+nix run .#vaultix.app.x86_64-linux.edit -- ./where/new-to-add.age
+```
+
+### 2. Add a secret to nixos module:
+
+```nix
+secrets = {
+  #...
+  new-to-add.file = ./where/new-to-add.age;
+};
+```
+
+### 3. Run renc:
+
+
+```bash
+nix run .#vaultix.app.x86_64-linux.renc
+```
+
+### 4. Add new produced stuff to git.
+
+
+
+## Modify existed secret
+
+
+```bash
+nix run .#vaultix.app.x86_64-linux.edit -- ./where/to-edit.age
+```
+
+```bash
+nix run .#vaultix.app.x86_64-linux.renc
+```
+
+Then add changes to git.
+
+## Remove secret
+
+
+```diff
+secrets = {
+  #...
+-  new-to-add.file = ./where/new-to-add.age;
+};
+```
+
+```bash
+rm ./where/new-to-add.age
+```
+
+```bash
+nix run .#vaultix.app.x86_64-linux.renc
+```
+Then add changes to git.