Menu
Decrypt and edit SOPS-encrypted secrets in this repo
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Create, search, comment on, and manage issues in the canonical nixosconfig Forgejo tracker via its REST API.
Manage pfSense firewall - rules, NAT, VPN, DHCP, DNS, and system configuration
Spin up and manage Apollo/Sunshine gaming Windows VMs on the prom hypervisor — clones of the GTX-1080-passthrough golden template, one per game, streamed via Moonlight/Artemis. Use when the user wants a new gaming VM, another gaming VM, a VM "for <game>", or to start/switch/stop/list/destroy their gaming VMs. Single GPU = one runs at a time. Trigger phrases include "new gaming vm", "spin up a gaming vm", "gaming vm for <game>", "make me a windows gaming vm", "another gaming machine", "start the <game> vm", "switch to <game>", "list gaming vms", "stop the gaming vm", "destroy the <game> vm".
Add an MCP server to the project and sync to all AI tools
Detect configuration drift using hash-based verification.
Debug a NixOS service that is down, unhealthy, or misbehaving. Identifies which host runs the service, connects via SSH if remote, and investigates using journalctl. Trigger phrases include "debug X", "X is down", "why is X broken", "check X service", "X not working", "investigate X".
| name | sops-decrypt |
| description | Decrypt and edit SOPS-encrypted secrets in this repo |
This machine has a user SSH key that can decrypt all secrets:
age_key=$(ssh-to-age -private-key -i ~/.ssh/id_ed25519 2>/dev/null)
age_key=$(ssh-to-age -private-key -i ~/.ssh/id_ed25519 2>/dev/null) && \
SOPS_AGE_KEY="$age_key" sops -d secrets/<filename>
age_key=$(ssh-to-age -private-key -i ~/.ssh/id_ed25519 2>/dev/null) && \
SOPS_AGE_KEY="$age_key" sops -e \
--config /home/abl030/nixosconfig/secrets/.sops.yaml \
--input-type dotenv --output-type dotenv \
<plaintext-file> > <encrypted-output>
# 1. Decrypt to temp file
age_key=$(ssh-to-age -private-key -i ~/.ssh/id_ed25519 2>/dev/null)
SOPS_AGE_KEY="$age_key" sops -d secrets/<file>.env > /tmp/<file>_plain.env
# 2. Modify the plaintext (sed, python, etc.)
sed -i 's/OLD_VALUE/NEW_VALUE/' /tmp/<file>_plain.env
# 3. Re-encrypt back
SOPS_AGE_KEY="$age_key" sops -e \
--config /home/abl030/nixosconfig/secrets/.sops.yaml \
--input-type dotenv --output-type dotenv \
/tmp/<file>_plain.env > secrets/<file>.env
# 4. Clean up plaintext
rm -f /tmp/<file>_plain.env
.sops.yaml config lives at secrets/.sops.yaml--config explicitly (sops won't find it automatically for files outside secrets/)secrets/ directorydotenv (use --input-type dotenv --output-type dotenv)dc command does the same thing but opens in nvim (not usable non-interactively)sops updatekeys --yes <file> after adding new hosts to .sops.yaml| File | Contents |
|---|---|
kopia.env | KOPIA_SERVER_USER, KOPIA_SERVER_PASSWORD, KOPIA_PASSWORD |
uptime-kuma.env | KUMA_USERNAME, KUMA_PASSWORD |
uptime-kuma-api.env | KUMA_API_KEY |
immich.env | Immich DB and API credentials |
caddy-tailscale.env | Tailscale auth key |
acme-cloudflare.env | Cloudflare API token for ACME |
| Others | See ls secrets/ |