Skip to content

secrets.md

Latest commit

 

History

History
36 lines (24 loc) · 758 Bytes

secrets.md

File metadata and controls

36 lines (24 loc) · 758 Bytes

Secrets

Secrets are managed with agenix under secrets/. That means the repo can keep encrypted secret files in Git without committing plaintext values.

Files

  • encrypted material: *.age
  • recipient mapping: secrets/secrets.nix

Standard Flow

# edit existing encrypted secret
agenix -e secrets/<service>.age

Add a New Secret

  1. Create encrypted file with agenix.
  2. Add recipients in secrets/secrets.nix.
  3. Reference the secret from host config:
age.secrets.<service>.file = ../../secrets/<service>.age;

Safety Rules

  • never commit plaintext secrets.
  • keep names service-oriented and lowercase.
  • validate affected host builds before merge.

Source

  • secrets/README.md
  • secrets/secrets.nix