원클릭으로 Manus에서 모든 스킬 실행

시작하기

secrets

스타18

포크1

업데이트2026년 4월 30일 11:43

Manage encrypted secrets with sops-nix

설치

Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.

Manus에서 실행

출처

DaRacci

DaRacci/nix-config

GitHub 저장소 열기 Creator 저장소 보기

다운로드

Manus에서 실행

Secrets

Overview

Repo uses sops-nix with age encryption. Secrets are grouped by scope and access level.

Secret Locations

Location	Scope
`hosts/secrets.yaml`	Global - all hosts
`hosts/server/secrets.yaml`	All server hosts
`hosts/<type>/<hostname>/secrets.yaml`	Single host
`home/<username>/secrets.yaml`	Single user

Adding New Secrets

Step 1: Determine scope

Pick right secrets file based on who needs access.

Step 2: Update `.sops.yaml` (if new path)

If creating new secrets file, add rule to .sops.yaml:

- path_regex: hosts/server/newhost/
  key_groups:
    - age:
        - age1... # newhost SSH key as age
        - age187xlhmks2... # admin key

Convert SSH key to age key:

ssh-to-age < hosts/server/newhost/ssh_host_ed25519_key.pub

Step 3: Add secret

# Edit existing file
sops hosts/server/myhost/secrets.yaml

# Or create new file
sops hosts/server/newhost/secrets.yaml

Add secrets in YAML format:

MY_SECRET: "secret-value"

# Or nested
SERVICE:
  API_KEY: "key-value"
  PASSWORD: "password-value"

Step 4: Declare in Nix

sops.secrets = {
  "SERVICE/API_KEY" = { };
  "SERVICE/PASSWORD" = {
    owner = "myservice";
  };
};

Step 5: Use secret

services.myservice = {
  apiKeyFile = config.sops.secrets."SERVICE/API_KEY".path;
};

Common Patterns

Simple secret declaration

sops.secrets = {
  "CLOUDFLARE/EMAIL" = { };
  "CLOUDFLARE/API_TOKEN" = { };
};

Custom permissions

sops.secrets."DATABASE_PASSWORD" = {
  owner = "postgres";
  group = "postgres";
  mode = "0400";
};

Using templates

Combine multiple secrets into config file:

sops = {
  secrets = {
    "DB/USER" = { };
    "DB/PASS" = { };
  };

  templates.db-env.content = ''
    DB_USER=${config.sops.placeholder."DB/USER"}
    DB_PASS=${config.sops.placeholder."DB/PASS"}
  '';
};

services.myapp.environmentFile = config.sops.templates.db-env.path;

Restart services on secret change

sops.secrets."API_KEY" = {
  restartUnits = [ "myservice.service" ];
};

Use entire file as secret

sops.secrets."config-file" = {
  sopsFile = ./secrets.yaml;
  key = "";  # Empty key = entire file
  path = "/etc/myservice/config.yaml";
};

Key Management

Age key sources

Host SSH keys: converted to age format
User SSH keys: in home/<user>/id_ed25519.pub
Admin key: shared admin access

Converting SSH to age

# Public key to age public key
ssh-to-age < ~/.ssh/id_ed25519.pub

# Private key to age private key
ssh-to-age --private-key -i ~/.ssh/id_ed25519

Accessing Secrets in Config

What	How
Secret file path	`config.sops.secrets."NAME".path`
Template file path	`config.sops.templates."NAME".path`
Placeholder in template	`config.sops.placeholder."NAME"`

이 저장소의 다른 Skills

같은 저장소

modules

DaRacci/nix-config

Create and modify NixOS and Home-Manager modules

2026-07-0218

systemd-hardening

DaRacci/nix-config

Hardens systemd services against security issues using sandboxing, capability restriction, and syscall filtering. Use when creating or modifying systemd services, writing NixOS modules with systemd.services, reviewing service security, or whenever a serviceConfig block is involved. Ensures services follow defense-in-depth principles with minimal privilege.

2026-06-1418

code-style-nix

DaRacci/nix-config

Write Nix code using repo conventions

2026-06-0718

conventional-commits

DaRacci/nix-config

Write and review Conventional Commits commit messages (v1.0.0) for semantic versioning and changelogs. Use when drafting git commit messages, PR titles, release notes, or enforcing conventional commit format like `type(scope): subject`, `BREAKING CHANGE`, footers, and `revert`.

2026-06-0718

jujutsu

DaRacci/nix-config

Manages version control with Jujutsu (jj), including rebasing, conflict resolution, and Git interop. Use when tracking changes, navigating history, squashing/splitting commits, or pushing to Git remotes.

2026-06-0718

tmux

DaRacci/nix-config

Manage background jobs, capture command output, and handle session multiplexing. Use when running long commands, capturing output from detached processes, or managing concurrent tasks in headless environments.

2026-06-0718

name	secrets
description	Manage encrypted secrets with sops-nix

Secrets

Overview

Repo uses sops-nix with age encryption. Secrets are grouped by scope and access level.

Secret Locations

Location	Scope
`hosts/secrets.yaml`	Global - all hosts
`hosts/server/secrets.yaml`	All server hosts
`hosts/<type>/<hostname>/secrets.yaml`	Single host
`home/<username>/secrets.yaml`	Single user

Adding New Secrets

Step 1: Determine scope

Pick right secrets file based on who needs access.

Step 2: Update `.sops.yaml` (if new path)

If creating new secrets file, add rule to .sops.yaml:

- path_regex: hosts/server/newhost/
  key_groups:
    - age:
        - age1... # newhost SSH key as age
        - age187xlhmks2... # admin key

Convert SSH key to age key:

ssh-to-age < hosts/server/newhost/ssh_host_ed25519_key.pub

Step 3: Add secret

# Edit existing file
sops hosts/server/myhost/secrets.yaml

# Or create new file
sops hosts/server/newhost/secrets.yaml

Add secrets in YAML format:

MY_SECRET: "secret-value"

# Or nested
SERVICE:
  API_KEY: "key-value"
  PASSWORD: "password-value"

Step 4: Declare in Nix

sops.secrets = {
  "SERVICE/API_KEY" = { };
  "SERVICE/PASSWORD" = {
    owner = "myservice";
  };
};

Step 5: Use secret

services.myservice = {
  apiKeyFile = config.sops.secrets."SERVICE/API_KEY".path;
};

Common Patterns

Simple secret declaration

sops.secrets = {
  "CLOUDFLARE/EMAIL" = { };
  "CLOUDFLARE/API_TOKEN" = { };
};

Custom permissions

sops.secrets."DATABASE_PASSWORD" = {
  owner = "postgres";
  group = "postgres";
  mode = "0400";
};

Using templates

Combine multiple secrets into config file:

sops = {
  secrets = {
    "DB/USER" = { };
    "DB/PASS" = { };
  };

  templates.db-env.content = ''
    DB_USER=${config.sops.placeholder."DB/USER"}
    DB_PASS=${config.sops.placeholder."DB/PASS"}
  '';
};

services.myapp.environmentFile = config.sops.templates.db-env.path;

Restart services on secret change

sops.secrets."API_KEY" = {
  restartUnits = [ "myservice.service" ];
};

Use entire file as secret

sops.secrets."config-file" = {
  sopsFile = ./secrets.yaml;
  key = "";  # Empty key = entire file
  path = "/etc/myservice/config.yaml";
};

Key Management

Age key sources

Host SSH keys: converted to age format
User SSH keys: in home/<user>/id_ed25519.pub
Admin key: shared admin access

Converting SSH to age

# Public key to age public key
ssh-to-age < ~/.ssh/id_ed25519.pub

# Private key to age private key
ssh-to-age --private-key -i ~/.ssh/id_ed25519

Accessing Secrets in Config

What	How
Secret file path	`config.sops.secrets."NAME".path`
Template file path	`config.sops.templates."NAME".path`
Placeholder in template	`config.sops.placeholder."NAME"`

secrets

Secrets

Overview

Secret Locations

Adding New Secrets

Step 1: Determine scope

Step 2: Update .sops.yaml (if new path)

Step 3: Add secret

Step 4: Declare in Nix

Step 5: Use secret

Common Patterns

Simple secret declaration

Custom permissions

Using templates

Restart services on secret change

Use entire file as secret

Key Management

Age key sources

Converting SSH to age

Accessing Secrets in Config

이 저장소의 다른 Skills

이 저장소의 다른 Skills

Secrets

Overview

Secret Locations

Adding New Secrets

Step 1: Determine scope

Step 2: Update .sops.yaml (if new path)

Step 3: Add secret

Step 4: Declare in Nix

Step 5: Use secret

Common Patterns

Simple secret declaration

Custom permissions

Using templates

Restart services on secret change

Use entire file as secret

Key Management

Age key sources

Converting SSH to age

Accessing Secrets in Config

Step 2: Update `.sops.yaml` (if new path)

Step 2: Update `.sops.yaml` (if new path)