Managing Secrets

Automate secret encryption, decryption, rotation, and deployment in NixOS workflows.

4|Updated Jan 15, 2026

Search Tags:#deployment #security #configuration #secrets #sops #age #devbox

Ready to run

npx skills add https://github.com/johnnymo87/workstation --skill managing-secrets

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: Managing Secrets
Source: https://github.com/johnnymo87/workstation/tree/main/.claude/skills/managing-secrets
Command: npx skills add https://github.com/johnnymo87/workstation --skill managing-secrets

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Secrets are often mismanaged, leading to exposure or degraded deployments. This Skill provides a structured approach to securely store, decrypt, and use secrets on a NixOS devbox, ensuring secrets are decrypted at boot and consumed safely by services and scripts.

Core Features & Use Cases

Centralized secret management using sops-nix and age encryption to protect sensitive values
Automatic decryption at boot and controlled access via /run/secrets
Guidance for deploying, exporting as env vars, or mounting as files in applications

Quick Start

Use the Managing Secrets skill to decrypt and expose the secret files at /run/secrets for use by system services and CLI tools.

Frequently Asked Questions about Managing Secrets

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I securely manage secrets in a NixOS devbox environment?▼

Use sops-nix with age encryption to centrally manage secrets on your devbox. Secrets are encrypted at rest, automatically decrypted at boot, and accessed via /run/secrets by services and scripts, ensuring they remain protected throughout the system lifecycle.

What's the difference between storing secrets as files versus environment variables in NixOS?▼

Secrets can be deployed as mounted files in /run/secrets for direct file access, exported as environment variables for CLI tools, or passed as systemd service inputs. File-based access provides better isolation; environment variables suit tools requiring inline secret injection.

Do I need sops-nix and age encryption to manage secrets on devbox?▼

Yes. sops-nix provides the NixOS integration layer, and age handles the encryption. Together they automate secret decryption at boot and enforce controlled access patterns, which are core to this Skill's approach.

How do I prevent secrets from being exposed during deployment?▼

This Skill structures secret deployment so encrypted values stay in version control while decryption happens only at runtime on trusted machines. Secrets are isolated in /run/secrets with restricted permissions, preventing accidental exposure in logs or service outputs.

Can I rotate secrets without redeploying the entire NixOS configuration?▼

Rotation workflow depends on your deployment process. This Skill covers decryption and access patterns; rotation typically involves updating encrypted secret files and re-running boot or service restart, which can be done independently of full system redeploys.

What happens if I need to use secrets across multiple services on the same devbox?▼

Secrets stored in /run/secrets are accessible to all services with appropriate permissions. You can reference the same secret files across multiple systemd services, environment variables, or scripts, centralizing secret management while keeping access controlled.