メニュー
Use when running build, push, or deploy commands that need credentials (registry auth, API keys, tokens). Guides how to load credentials from the correct sources in this homelab.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
| name | credentials |
| description | Use when running build, push, or deploy commands that need credentials (registry auth, API keys, tokens). Guides how to load credentials from the correct sources in this homelab. |
| allowed-tools | Bash, Read |
| injectable | true |
Before running any command that requires credentials, load them from the correct source.
| Source | Location | Use for |
|---|---|---|
| Environment vars | Already set in shell | Highest priority — use if present |
~/.env | ~/.env | API keys, OAuth tokens, misc secrets |
| Container registry auth | ~/.config/containers/auth.json | skopeo, podman, buildah, registry pushes |
| SOPS secrets | ~/homelab-gitops/ or ~/nixos-config/secrets/ | Kubernetes secrets, NixOS service secrets |
~/.envAlways source ~/.env before running build or deploy commands if credentials might be needed:
set -a && source ~/.env && set +a
Contains: CLAUDE_CODE_OAUTH_TOKEN, GROK_API_KEY, and other personal API keys.
Registry: registry.sammasak.dev
Credentials are stored in ~/.config/containers/auth.json. Extract them when needed:
auth_encoded=$(jq -r '.auths["registry.sammasak.dev"].auth' ~/.config/containers/auth.json)
harbor_user=$(echo "$auth_encoded" | base64 -d | cut -d: -f1)
harbor_pass=$(echo "$auth_encoded" | base64 -d | cut -d: -f2-)
Or pass the authfile directly to skopeo:
skopeo copy --authfile ~/.config/containers/auth.json oci:./dir docker://registry.sammasak.dev/project/image:tag
publish-oci-image.shauto-readsauth.json— no env vars needed for image pushes.
Decrypt a SOPS file to read a secret:
sops -d ~/homelab-gitops/apps/workstations/secrets/some.secret.yaml
Never write plaintext secrets to /tmp — always decrypt in place or to the correct repo path.
auth.json is auto-used by publish-oci-image.sh; for manual skopeo/podman use --authfileset -a && source ~/.env && set +asops -d <file> and use the value directlyenv | grep -i harbor or similar before loadingUse when asked to document work, record decisions, create session records, write ADRs or RFCs, or update knowledge notes in ~/knowledge. Also use when confused about who a person is, what a company is, what situation the user is referring to, or any personal or professional context — read the vault before asking.
Use when creating or editing notes in an Obsidian vault, writing to ~/knowledge, or using Obsidian-specific syntax (wikilinks, callouts, embeds, frontmatter properties).
Use when reviewing any implementation. Replaces fixed spec+quality two-step with category-driven parallel specialists: an assessor picks relevant categories for the specific artifact, one specialist per category reviews in parallel, controller aggregates. Use after implementer completes a task in subagent-driven-development.
Use when dispatching work to background agents, defining custom subagents, or choosing between local agent dispatch and VM-based workers (claude-ctl).
Use when working with Kubernetes clusters, GitOps deployments, Flux reconciliation, Helm releases, or cluster troubleshooting. Guides declarative cluster management and GitOps workflows. Not for secrets encryption or SOPS operations — route those to secrets-management.
Use when sending a notification to ntfy from a homelab service, loop, or agent. Covers the canonical in-cluster publish pattern and the silent-failure trap of posting to the Authentik-gated public URL.