Ejecuta cualquier Skill en Manus
con un clic

Ejecuta cualquier Skill en Manus con un clic

Comenzar

sops-decrypt

Estrellas1

Forks2

Actualizado1 de febrero de 2026 a las 09:30

Decrypt and edit SOPS-encrypted secrets in this repo

Instalación

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Ejecutar en Manus

Fuente

abl030

abl030/nixosconfig

Abrir repositorio de GitHub Ver repositorios del creador

Descarga

Ejecutar en Manus

Ocupaciones relacionadasSOC

Basado en la clasificación ocupacional SOC

Administradores de redes y sistemas informáticosOcupaciones informáticas y matemáticas·SOC 15-1244

SKILL.md

readonly

name	sops-decrypt
description	Decrypt and edit SOPS-encrypted secrets in this repo

SOPS Secret Decryption

Key Lookup Order

This machine has a user SSH key that can decrypt all secrets:

age_key=$(ssh-to-age -private-key -i ~/.ssh/id_ed25519 2>/dev/null)

Decrypt a secret to stdout

age_key=$(ssh-to-age -private-key -i ~/.ssh/id_ed25519 2>/dev/null) && \
  SOPS_AGE_KEY="$age_key" sops -d secrets/<filename>

Encrypt a plaintext file (must specify --config)

age_key=$(ssh-to-age -private-key -i ~/.ssh/id_ed25519 2>/dev/null) && \
  SOPS_AGE_KEY="$age_key" sops -e \
    --config /home/abl030/nixosconfig/secrets/.sops.yaml \
    --input-type dotenv --output-type dotenv \
    <plaintext-file> > <encrypted-output>

Edit a secret in-place (decrypt, modify, re-encrypt)

# 1. Decrypt to temp file
age_key=$(ssh-to-age -private-key -i ~/.ssh/id_ed25519 2>/dev/null)
SOPS_AGE_KEY="$age_key" sops -d secrets/<file>.env > /tmp/<file>_plain.env

# 2. Modify the plaintext (sed, python, etc.)
sed -i 's/OLD_VALUE/NEW_VALUE/' /tmp/<file>_plain.env

# 3. Re-encrypt back
SOPS_AGE_KEY="$age_key" sops -e \
  --config /home/abl030/nixosconfig/secrets/.sops.yaml \
  --input-type dotenv --output-type dotenv \
  /tmp/<file>_plain.env > secrets/<file>.env

# 4. Clean up plaintext
rm -f /tmp/<file>_plain.env

Important Notes

The .sops.yaml config lives at secrets/.sops.yaml
When encrypting, you MUST pass --config explicitly (sops won't find it automatically for files outside secrets/)
All secret files are in secrets/ directory
Format is typically dotenv (use --input-type dotenv --output-type dotenv)
The user's dc command does the same thing but opens in nvim (not usable non-interactively)
After modifying secrets, commit the encrypted file — never commit plaintext
Run sops updatekeys --yes <file> after adding new hosts to .sops.yaml

Secret Files

File	Contents
`kopia.env`	KOPIA_SERVER_USER, KOPIA_SERVER_PASSWORD, KOPIA_PASSWORD
`uptime-kuma.env`	KUMA_USERNAME, KUMA_PASSWORD
`uptime-kuma-api.env`	KUMA_API_KEY
`immich.env`	Immich DB and API credentials
`caddy-tailscale.env`	Tailscale auth key
`acme-cloudflare.env`	Cloudflare API token for ACME
Others	See `ls secrets/`

Más de este repositorio

mismo repositorio

forgejo

abl030/nixosconfig

Create, search, comment on, and manage issues in the canonical nixosconfig Forgejo tracker via its REST API.

2026-07-191

pfsense

abl030/nixosconfig

Manage pfSense firewall - rules, NAT, VPN, DHCP, DNS, and system configuration

2026-07-191

gaming-vm

abl030/nixosconfig

Spin up and manage Apollo/Sunshine gaming Windows VMs on the prom hypervisor — clones of the GTX-1080-passthrough golden template, one per game, streamed via Moonlight/Artemis. Use when the user wants a new gaming VM, another gaming VM, a VM "for <game>", or to start/switch/stop/list/destroy their gaming VMs. Single GPU = one runs at a time. Trigger phrases include "new gaming vm", "spin up a gaming vm", "gaming vm for <game>", "make me a windows gaming vm", "another gaming machine", "start the <game> vm", "switch to <game>", "list gaming vms", "stop the gaming vm", "destroy the <game> vm".

2026-07-151

add-mcp

abl030/nixosconfig

Add an MCP server to the project and sync to all AI tools

2026-07-111

drift

abl030/nixosconfig

Detect configuration drift using hash-based verification.

2026-07-111

service-debug

abl030/nixosconfig

Debug a NixOS service that is down, unhealthy, or misbehaving. Identifies which host runs the service, connects via SSH if remote, and investigates using journalctl. Trigger phrases include "debug X", "X is down", "why is X broken", "check X service", "X not working", "investigate X".

2026-07-111

SOPS Secret Decryption

Key Lookup Order

This machine has a user SSH key that can decrypt all secrets:

age_key=$(ssh-to-age -private-key -i ~/.ssh/id_ed25519 2>/dev/null)

Decrypt a secret to stdout

age_key=$(ssh-to-age -private-key -i ~/.ssh/id_ed25519 2>/dev/null) && \ SOPS_AGE_KEY="$age_key" sops -d secrets/<filename>

Encrypt a plaintext file (must specify --config)

age_key=$(ssh-to-age -private-key -i ~/.ssh/id_ed25519 2>/dev/null) && \ SOPS_AGE_KEY="$age_key" sops -e \ --config /home/abl030/nixosconfig/secrets/.sops.yaml \ --input-type dotenv --output-type dotenv \ <plaintext-file> > <encrypted-output>

Edit a secret in-place (decrypt, modify, re-encrypt)

# 1. Decrypt to temp file age_key=$(ssh-to-age -private-key -i ~/.ssh/id_ed25519 2>/dev/null) SOPS_AGE_KEY="$age_key" sops -d secrets/<file>.env > /tmp/<file>_plain.env # 2. Modify the plaintext (sed, python, etc.) sed -i 's/OLD_VALUE/NEW_VALUE/' /tmp/<file>_plain.env # 3. Re-encrypt back SOPS_AGE_KEY="$age_key" sops -e \ --config /home/abl030/nixosconfig/secrets/.sops.yaml \ --input-type dotenv --output-type dotenv \ /tmp/<file>_plain.env > secrets/<file>.env # 4. Clean up plaintext rm -f /tmp/<file>_plain.env

Important Notes

The .sops.yaml config lives at secrets/.sops.yaml

When encrypting, you MUST pass --config explicitly (sops won't find it automatically for files outside secrets/)

All secret files are in secrets/ directory

Format is typically dotenv (use --input-type dotenv --output-type dotenv)

The user's dc command does the same thing but opens in nvim (not usable non-interactively)

After modifying secrets, commit the encrypted file — never commit plaintext

Run sops updatekeys --yes <file> after adding new hosts to .sops.yaml

Secret Files

File

Contents

kopia.env

KOPIA_SERVER_USER, KOPIA_SERVER_PASSWORD, KOPIA_PASSWORD

uptime-kuma.env

KUMA_USERNAME, KUMA_PASSWORD

uptime-kuma-api.env

KUMA_API_KEY

immich.env

Immich DB and API credentials

caddy-tailscale.env

Tailscale auth key

acme-cloudflare.env

Cloudflare API token for ACME

Others

See ls secrets/