一键在 Manus 中运行任何 Skill

开始使用

sops-decrypt

星标1

分支2

更新时间2026年2月1日 09:30

Decrypt and edit SOPS-encrypted secrets in this repo

安装

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

在 Manus 中运行

来源

abl030

abl030/nixosconfig

打开 GitHub 仓库查看创作者相关仓库

下载

在 Manus 中运行

SOPS Secret Decryption

Key Lookup Order

This machine has a user SSH key that can decrypt all secrets:

age_key=$(ssh-to-age -private-key -i ~/.ssh/id_ed25519 2>/dev/null)

Decrypt a secret to stdout

age_key=$(ssh-to-age -private-key -i ~/.ssh/id_ed25519 2>/dev/null) && \
  SOPS_AGE_KEY="$age_key" sops -d secrets/<filename>

Encrypt a plaintext file (must specify --config)

age_key=$(ssh-to-age -private-key -i ~/.ssh/id_ed25519 2>/dev/null) && \
  SOPS_AGE_KEY="$age_key" sops -e \
    --config /home/abl030/nixosconfig/secrets/.sops.yaml \
    --input-type dotenv --output-type dotenv \
    <plaintext-file> > <encrypted-output>

Edit a secret in-place (decrypt, modify, re-encrypt)

# 1. Decrypt to temp file
age_key=$(ssh-to-age -private-key -i ~/.ssh/id_ed25519 2>/dev/null)
SOPS_AGE_KEY="$age_key" sops -d secrets/<file>.env > /tmp/<file>_plain.env

# 2. Modify the plaintext (sed, python, etc.)
sed -i 's/OLD_VALUE/NEW_VALUE/' /tmp/<file>_plain.env

# 3. Re-encrypt back
SOPS_AGE_KEY="$age_key" sops -e \
  --config /home/abl030/nixosconfig/secrets/.sops.yaml \
  --input-type dotenv --output-type dotenv \
  /tmp/<file>_plain.env > secrets/<file>.env

# 4. Clean up plaintext
rm -f /tmp/<file>_plain.env

Important Notes

The .sops.yaml config lives at secrets/.sops.yaml
When encrypting, you MUST pass --config explicitly (sops won't find it automatically for files outside secrets/)
All secret files are in secrets/ directory
Format is typically dotenv (use --input-type dotenv --output-type dotenv)
The user's dc command does the same thing but opens in nvim (not usable non-interactively)
After modifying secrets, commit the encrypted file — never commit plaintext
Run sops updatekeys --yes <file> after adding new hosts to .sops.yaml

Secret Files

File	Contents
`kopia.env`	KOPIA_SERVER_USER, KOPIA_SERVER_PASSWORD, KOPIA_PASSWORD
`uptime-kuma.env`	KUMA_USERNAME, KUMA_PASSWORD
`uptime-kuma-api.env`	KUMA_API_KEY
`immich.env`	Immich DB and API credentials
`caddy-tailscale.env`	Tailscale auth key
`acme-cloudflare.env`	Cloudflare API token for ACME
Others	See `ls secrets/`

同仓库更多 Skills

同仓库

forgejo

abl030/nixosconfig

Create, search, comment on, and manage issues in the canonical nixosconfig Forgejo tracker via its REST API.

2026-07-191

pfsense

abl030/nixosconfig

Manage pfSense firewall - rules, NAT, VPN, DHCP, DNS, and system configuration

2026-07-191

gaming-vm

abl030/nixosconfig

Spin up and manage Apollo/Sunshine gaming Windows VMs on the prom hypervisor — clones of the GTX-1080-passthrough golden template, one per game, streamed via Moonlight/Artemis. Use when the user wants a new gaming VM, another gaming VM, a VM "for <game>", or to start/switch/stop/list/destroy their gaming VMs. Single GPU = one runs at a time. Trigger phrases include "new gaming vm", "spin up a gaming vm", "gaming vm for <game>", "make me a windows gaming vm", "another gaming machine", "start the <game> vm", "switch to <game>", "list gaming vms", "stop the gaming vm", "destroy the <game> vm".

2026-07-151

add-mcp

abl030/nixosconfig

Add an MCP server to the project and sync to all AI tools

2026-07-111

drift

abl030/nixosconfig

Detect configuration drift using hash-based verification.

2026-07-111

service-debug

abl030/nixosconfig

Debug a NixOS service that is down, unhealthy, or misbehaving. Identifies which host runs the service, connects via SSH if remote, and investigates using journalctl. Trigger phrases include "debug X", "X is down", "why is X broken", "check X service", "X not working", "investigate X".

2026-07-111

SOPS Secret Decryption

Key Lookup Order

This machine has a user SSH key that can decrypt all secrets:

age_key=$(ssh-to-age -private-key -i ~/.ssh/id_ed25519 2>/dev/null)

Decrypt a secret to stdout

age_key=$(ssh-to-age -private-key -i ~/.ssh/id_ed25519 2>/dev/null) && \ SOPS_AGE_KEY="$age_key" sops -d secrets/<filename>

Encrypt a plaintext file (must specify --config)

age_key=$(ssh-to-age -private-key -i ~/.ssh/id_ed25519 2>/dev/null) && \ SOPS_AGE_KEY="$age_key" sops -e \ --config /home/abl030/nixosconfig/secrets/.sops.yaml \ --input-type dotenv --output-type dotenv \ <plaintext-file> > <encrypted-output>

Edit a secret in-place (decrypt, modify, re-encrypt)

# 1. Decrypt to temp file age_key=$(ssh-to-age -private-key -i ~/.ssh/id_ed25519 2>/dev/null) SOPS_AGE_KEY="$age_key" sops -d secrets/<file>.env > /tmp/<file>_plain.env # 2. Modify the plaintext (sed, python, etc.) sed -i 's/OLD_VALUE/NEW_VALUE/' /tmp/<file>_plain.env # 3. Re-encrypt back SOPS_AGE_KEY="$age_key" sops -e \ --config /home/abl030/nixosconfig/secrets/.sops.yaml \ --input-type dotenv --output-type dotenv \ /tmp/<file>_plain.env > secrets/<file>.env # 4. Clean up plaintext rm -f /tmp/<file>_plain.env

Important Notes

The .sops.yaml config lives at secrets/.sops.yaml

When encrypting, you MUST pass --config explicitly (sops won't find it automatically for files outside secrets/)

All secret files are in secrets/ directory

Format is typically dotenv (use --input-type dotenv --output-type dotenv)

The user's dc command does the same thing but opens in nvim (not usable non-interactively)

After modifying secrets, commit the encrypted file — never commit plaintext

Run sops updatekeys --yes <file> after adding new hosts to .sops.yaml

Secret Files

File

Contents

kopia.env

KOPIA_SERVER_USER, KOPIA_SERVER_PASSWORD, KOPIA_PASSWORD

uptime-kuma.env

KUMA_USERNAME, KUMA_PASSWORD

uptime-kuma-api.env

KUMA_API_KEY

immich.env

Immich DB and API credentials

caddy-tailscale.env

Tailscale auth key

acme-cloudflare.env

Cloudflare API token for ACME

Others

See ls secrets/

name	sops-decrypt
description	Decrypt and edit SOPS-encrypted secrets in this repo