القائمة
Decrypt and edit SOPS-encrypted secrets in this repo
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Create, search, comment on, and manage issues in the canonical nixosconfig Forgejo tracker via its REST API.
Back up your durable brain and encrypted session snapshots to the private abl030/hermes-brain Forgejo repo while excluding credentials and disposable runtime state.
Read-only root cause analysis for homelab alerts. Investigate, diagnose, and optionally open a signed PR to fix config issues in nixosconfig.
Manage the *arr media stack — Radarr, Sonarr, Prowlarr (indexers) and NZBHydra2 (usenet) — plus the qBittorrent/NZBGet download clients, over their HTTP APIs. Use when the user mentions radarr, sonarr, prowlarr, indexers, an "arr" app, usenet/NZB, NZBHydra2, NZBGeek, qbt/qBittorrent grabs, or download-client / quality / delay-profile config.
Manage pfSense firewall - rules, NAT, VPN, DHCP, DNS, and system configuration
Manage UniFi network - devices, clients, networks, WLANs, and port profiles
| name | sops-decrypt |
| description | Decrypt and edit SOPS-encrypted secrets in this repo |
This machine has a user SSH key that can decrypt all secrets:
age_key=$(ssh-to-age -private-key -i ~/.ssh/id_ed25519 2>/dev/null)
age_key=$(ssh-to-age -private-key -i ~/.ssh/id_ed25519 2>/dev/null) && \
SOPS_AGE_KEY="$age_key" sops -d secrets/<filename>
age_key=$(ssh-to-age -private-key -i ~/.ssh/id_ed25519 2>/dev/null) && \
SOPS_AGE_KEY="$age_key" sops -e \
--config /home/abl030/nixosconfig/secrets/.sops.yaml \
--input-type dotenv --output-type dotenv \
<plaintext-file> > <encrypted-output>
# 1. Decrypt to temp file
age_key=$(ssh-to-age -private-key -i ~/.ssh/id_ed25519 2>/dev/null)
SOPS_AGE_KEY="$age_key" sops -d secrets/<file>.env > /tmp/<file>_plain.env
# 2. Modify the plaintext (sed, python, etc.)
sed -i 's/OLD_VALUE/NEW_VALUE/' /tmp/<file>_plain.env
# 3. Re-encrypt back
SOPS_AGE_KEY="$age_key" sops -e \
--config /home/abl030/nixosconfig/secrets/.sops.yaml \
--input-type dotenv --output-type dotenv \
/tmp/<file>_plain.env > secrets/<file>.env
# 4. Clean up plaintext
rm -f /tmp/<file>_plain.env
.sops.yaml config lives at secrets/.sops.yaml--config explicitly (sops won't find it automatically for files outside secrets/)secrets/ directorydotenv (use --input-type dotenv --output-type dotenv)dc command does the same thing but opens in nvim (not usable non-interactively)sops updatekeys --yes <file> after adding new hosts to .sops.yaml| File | Contents |
|---|---|
kopia.env | KOPIA_SERVER_USER, KOPIA_SERVER_PASSWORD, KOPIA_PASSWORD |
uptime-kuma.env | KUMA_USERNAME, KUMA_PASSWORD |
uptime-kuma-api.env | KUMA_API_KEY |
immich.env | Immich DB and API credentials |
caddy-tailscale.env | Tailscale auth key |
acme-cloudflare.env | Cloudflare API token for ACME |
| Others | See ls secrets/ |