Verified:GitHub

GitLab Stack Secrets Manager

Migrates and manages Docker secrets for GitLab stack projects.

58|8|Updated Oct 18, 2025

Search Tags:#automation #devops #security #configuration #docker #secrets #gitlab

One-click install

npx skills add https://github.com/rknall/claude-skills --skill gitlab-stack-secrets-manager

Or copy as Structured Prompt for Agent▼

Please help me install this Agent Skill.
Skill: GitLab Stack Secrets Manager
Source: https://github.com/rknall/claude-skills/tree/main/secrets-manager
Command: npx skills add https://github.com/rknall/claude-skills --skill gitlab-stack-secrets-manager

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Secrets in .env or docker-compose.yml are critical security risks, leading to exposure in version control or insecure file permissions. This skill automates the secure migration and management of these secrets, ensuring your GitLab stack projects remain protected.

Core Features & Use Cases

Automated Migration: Effortlessly move secrets from .env or docker-compose.yml to secure Docker secrets, updating your docker-compose.yml automatically.
Comprehensive Validation: Automatically detect and report secrets in insecure locations, ensuring compliance with best practices and proper file permissions.
Secure Generation: Create new, cryptographically strong secrets with correct file permissions and Git exclusion, preventing accidental commits.
Use Case: Your stack-validator skill reports "CRITICAL: Secrets in .env file". Use this skill to automatically extract, secure, and configure these secrets as Docker secrets, then remove them from .env, all while verifying the migration.

Quick Start

claude "migrate all secrets from .env to Docker secrets"

Frequently Asked Questions about GitLab Stack Secrets Manager

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I move secrets from .env files to Docker secrets?▼

Migrate secrets from .env to Docker secrets by extracting them into individual files under ./secrets with 600 permissions, updating docker-compose.yml to reference those files in a secrets section, and removing sensitive data from .env. This prevents secrets from being committed to git and ensures they're mounted securely at /run/secrets in containers.

Why shouldn't I store secrets in docker-compose.yml environment variables?▼

Storing secrets in docker-compose.yml creates critical security risks: they can be accidentally committed to version control, exposed in logs, and accessed by anyone with repository access. Docker secrets provide encrypted storage and restrict access only to services that explicitly need them.

Can I automatically detect secrets stored insecurely in my GitLab project?▼

Yes, automated validation detects secrets in .env files and docker-compose.yml environment variables, reports their locations with severity levels, and checks file permissions. This compliance check ensures secrets meet Docker security standards before migration.

How do I generate new secrets with proper permissions and prevent accidental commits?▼

Generate cryptographically strong secrets with correct file permissions (700 for ./secrets directory, 600 for individual secret files) and configure Git exclusion rules to prevent accidental commits. New secrets are created securely in the ./secrets directory structure.

What file permissions are required for Docker secrets in GitLab stack projects?▼

The ./secrets directory requires 700 permissions (owner read/write/execute only) and individual secret files require 600 permissions (owner read/write only). These restrictive permissions prevent unauthorized access and comply with Docker secrets best practices.

Does this work with existing docker-compose.yml configurations?▼

Yes, it automatically updates your docker-compose.yml to add secrets sections referencing files, configure service mounts to /run/secrets paths, and remove environment variable secrets. The migration preserves your existing service configuration while securing secret handling.