Menu
Manage encrypted secrets with sops-nix
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Create and modify NixOS and Home-Manager modules
Hardens systemd services against security issues using sandboxing, capability restriction, and syscall filtering. Use when creating or modifying systemd services, writing NixOS modules with systemd.services, reviewing service security, or whenever a serviceConfig block is involved. Ensures services follow defense-in-depth principles with minimal privilege.
Write Nix code using repo conventions
Write and review Conventional Commits commit messages (v1.0.0) for semantic versioning and changelogs. Use when drafting git commit messages, PR titles, release notes, or enforcing conventional commit format like `type(scope): subject`, `BREAKING CHANGE`, footers, and `revert`.
Manages version control with Jujutsu (jj), including rebasing, conflict resolution, and Git interop. Use when tracking changes, navigating history, squashing/splitting commits, or pushing to Git remotes.
Manage background jobs, capture command output, and handle session multiplexing. Use when running long commands, capturing output from detached processes, or managing concurrent tasks in headless environments.
| name | secrets |
| description | Manage encrypted secrets with sops-nix |
Repo uses sops-nix with age encryption. Secrets are grouped by scope and access level.
| Location | Scope |
|---|---|
hosts/secrets.yaml | Global - all hosts |
hosts/server/secrets.yaml | All server hosts |
hosts/<type>/<hostname>/secrets.yaml | Single host |
home/<username>/secrets.yaml | Single user |
Pick right secrets file based on who needs access.
.sops.yaml (if new path)If creating new secrets file, add rule to .sops.yaml:
- path_regex: hosts/server/newhost/
key_groups:
- age:
- age1... # newhost SSH key as age
- age187xlhmks2... # admin key
Convert SSH key to age key:
ssh-to-age < hosts/server/newhost/ssh_host_ed25519_key.pub
# Edit existing file
sops hosts/server/myhost/secrets.yaml
# Or create new file
sops hosts/server/newhost/secrets.yaml
Add secrets in YAML format:
MY_SECRET: "secret-value"
# Or nested
SERVICE:
API_KEY: "key-value"
PASSWORD: "password-value"
sops.secrets = {
"SERVICE/API_KEY" = { };
"SERVICE/PASSWORD" = {
owner = "myservice";
};
};
services.myservice = {
apiKeyFile = config.sops.secrets."SERVICE/API_KEY".path;
};
sops.secrets = {
"CLOUDFLARE/EMAIL" = { };
"CLOUDFLARE/API_TOKEN" = { };
};
sops.secrets."DATABASE_PASSWORD" = {
owner = "postgres";
group = "postgres";
mode = "0400";
};
Combine multiple secrets into config file:
sops = {
secrets = {
"DB/USER" = { };
"DB/PASS" = { };
};
templates.db-env.content = ''
DB_USER=${config.sops.placeholder."DB/USER"}
DB_PASS=${config.sops.placeholder."DB/PASS"}
'';
};
services.myapp.environmentFile = config.sops.templates.db-env.path;
sops.secrets."API_KEY" = {
restartUnits = [ "myservice.service" ];
};
sops.secrets."config-file" = {
sopsFile = ./secrets.yaml;
key = ""; # Empty key = entire file
path = "/etc/myservice/config.yaml";
};
home/<user>/id_ed25519.pub# Public key to age public key
ssh-to-age < ~/.ssh/id_ed25519.pub
# Private key to age private key
ssh-to-age --private-key -i ~/.ssh/id_ed25519
| What | How |
|---|---|
| Secret file path | config.sops.secrets."NAME".path |
| Template file path | config.sops.templates."NAME".path |
| Placeholder in template | config.sops.placeholder."NAME" |