ワンクリックでManusで任意のスキルを実行

始める

sops-decrypt

スター1

フォーク2

更新日2026年2月1日 09:30

Decrypt and edit SOPS-encrypted secrets in this repo

インストール

Codex または Claude でインストールこの Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。

Manusで実行

ソース

abl030

abl030/nixosconfig

GitHub リポジトリを開く Creator のリポジトリを見る

ダウンロード

Manusで実行

SOPS Secret Decryption

Key Lookup Order

This machine has a user SSH key that can decrypt all secrets:

age_key=$(ssh-to-age -private-key -i ~/.ssh/id_ed25519 2>/dev/null)

Decrypt a secret to stdout

age_key=$(ssh-to-age -private-key -i ~/.ssh/id_ed25519 2>/dev/null) && \
  SOPS_AGE_KEY="$age_key" sops -d secrets/<filename>

Encrypt a plaintext file (must specify --config)

age_key=$(ssh-to-age -private-key -i ~/.ssh/id_ed25519 2>/dev/null) && \
  SOPS_AGE_KEY="$age_key" sops -e \
    --config /home/abl030/nixosconfig/secrets/.sops.yaml \
    --input-type dotenv --output-type dotenv \
    <plaintext-file> > <encrypted-output>

Edit a secret in-place (decrypt, modify, re-encrypt)

# 1. Decrypt to temp file
age_key=$(ssh-to-age -private-key -i ~/.ssh/id_ed25519 2>/dev/null)
SOPS_AGE_KEY="$age_key" sops -d secrets/<file>.env > /tmp/<file>_plain.env

# 2. Modify the plaintext (sed, python, etc.)
sed -i 's/OLD_VALUE/NEW_VALUE/' /tmp/<file>_plain.env

# 3. Re-encrypt back
SOPS_AGE_KEY="$age_key" sops -e \
  --config /home/abl030/nixosconfig/secrets/.sops.yaml \
  --input-type dotenv --output-type dotenv \
  /tmp/<file>_plain.env > secrets/<file>.env

# 4. Clean up plaintext
rm -f /tmp/<file>_plain.env

Important Notes

The .sops.yaml config lives at secrets/.sops.yaml
When encrypting, you MUST pass --config explicitly (sops won't find it automatically for files outside secrets/)
All secret files are in secrets/ directory
Format is typically dotenv (use --input-type dotenv --output-type dotenv)
The user's dc command does the same thing but opens in nvim (not usable non-interactively)
After modifying secrets, commit the encrypted file — never commit plaintext
Run sops updatekeys --yes <file> after adding new hosts to .sops.yaml

Secret Files

File	Contents
`kopia.env`	KOPIA_SERVER_USER, KOPIA_SERVER_PASSWORD, KOPIA_PASSWORD
`uptime-kuma.env`	KUMA_USERNAME, KUMA_PASSWORD
`uptime-kuma-api.env`	KUMA_API_KEY
`immich.env`	Immich DB and API credentials
`caddy-tailscale.env`	Tailscale auth key
`acme-cloudflare.env`	Cloudflare API token for ACME
Others	See `ls secrets/`

このリポジトリの他の Skills

同じリポジトリ

forgejo

abl030/nixosconfig

Create, search, comment on, and manage issues in the canonical nixosconfig Forgejo tracker via its REST API.

2026-07-191

pfsense

abl030/nixosconfig

Manage pfSense firewall - rules, NAT, VPN, DHCP, DNS, and system configuration

2026-07-191

gaming-vm

abl030/nixosconfig

Spin up and manage Apollo/Sunshine gaming Windows VMs on the prom hypervisor — clones of the GTX-1080-passthrough golden template, one per game, streamed via Moonlight/Artemis. Use when the user wants a new gaming VM, another gaming VM, a VM "for <game>", or to start/switch/stop/list/destroy their gaming VMs. Single GPU = one runs at a time. Trigger phrases include "new gaming vm", "spin up a gaming vm", "gaming vm for <game>", "make me a windows gaming vm", "another gaming machine", "start the <game> vm", "switch to <game>", "list gaming vms", "stop the gaming vm", "destroy the <game> vm".

2026-07-151

add-mcp

abl030/nixosconfig

Add an MCP server to the project and sync to all AI tools

2026-07-111

drift

abl030/nixosconfig

Detect configuration drift using hash-based verification.

2026-07-111

service-debug

abl030/nixosconfig

Debug a NixOS service that is down, unhealthy, or misbehaving. Identifies which host runs the service, connects via SSH if remote, and investigates using journalctl. Trigger phrases include "debug X", "X is down", "why is X broken", "check X service", "X not working", "investigate X".

2026-07-111

SOPS Secret Decryption

Key Lookup Order

This machine has a user SSH key that can decrypt all secrets:

age_key=$(ssh-to-age -private-key -i ~/.ssh/id_ed25519 2>/dev/null)

Decrypt a secret to stdout

age_key=$(ssh-to-age -private-key -i ~/.ssh/id_ed25519 2>/dev/null) && \ SOPS_AGE_KEY="$age_key" sops -d secrets/<filename>

Encrypt a plaintext file (must specify --config)

age_key=$(ssh-to-age -private-key -i ~/.ssh/id_ed25519 2>/dev/null) && \ SOPS_AGE_KEY="$age_key" sops -e \ --config /home/abl030/nixosconfig/secrets/.sops.yaml \ --input-type dotenv --output-type dotenv \ <plaintext-file> > <encrypted-output>

Edit a secret in-place (decrypt, modify, re-encrypt)

# 1. Decrypt to temp file age_key=$(ssh-to-age -private-key -i ~/.ssh/id_ed25519 2>/dev/null) SOPS_AGE_KEY="$age_key" sops -d secrets/<file>.env > /tmp/<file>_plain.env # 2. Modify the plaintext (sed, python, etc.) sed -i 's/OLD_VALUE/NEW_VALUE/' /tmp/<file>_plain.env # 3. Re-encrypt back SOPS_AGE_KEY="$age_key" sops -e \ --config /home/abl030/nixosconfig/secrets/.sops.yaml \ --input-type dotenv --output-type dotenv \ /tmp/<file>_plain.env > secrets/<file>.env # 4. Clean up plaintext rm -f /tmp/<file>_plain.env

Important Notes

The .sops.yaml config lives at secrets/.sops.yaml

When encrypting, you MUST pass --config explicitly (sops won't find it automatically for files outside secrets/)

All secret files are in secrets/ directory

Format is typically dotenv (use --input-type dotenv --output-type dotenv)

The user's dc command does the same thing but opens in nvim (not usable non-interactively)

After modifying secrets, commit the encrypted file — never commit plaintext

Run sops updatekeys --yes <file> after adding new hosts to .sops.yaml

Secret Files

File

Contents

kopia.env

KOPIA_SERVER_USER, KOPIA_SERVER_PASSWORD, KOPIA_PASSWORD

uptime-kuma.env

KUMA_USERNAME, KUMA_PASSWORD

uptime-kuma-api.env

KUMA_API_KEY

immich.env

Immich DB and API credentials

caddy-tailscale.env

Tailscale auth key

acme-cloudflare.env

Cloudflare API token for ACME

Others

See ls secrets/

name	sops-decrypt
description	Decrypt and edit SOPS-encrypted secrets in this repo