Managing Secrets

Use sops-nix with age encryption to centrally manage secrets on your devbox. Secrets are encrypted at rest, automatically decrypted at boot, and accessed via /run/secrets by services and scripts, ensuring they remain protected throughout the system lifecycle.

Secrets can be deployed as mounted files in /run/secrets for direct file access, exported as environment variables for CLI tools, or passed as systemd service inputs. File-based access provides better isolation; environment variables suit tools requiring inline secret injection.

Yes. sops-nix provides the NixOS integration layer, and age handles the encryption. Together they automate secret decryption at boot and enforce controlled access patterns, which are core to this Skill's approach.

This Skill structures secret deployment so encrypted values stay in version control while decryption happens only at runtime on trusted machines. Secrets are isolated in /run/secrets with restricted permissions, preventing accidental exposure in logs or service outputs.

Rotation workflow depends on your deployment process. This Skill covers decryption and access patterns; rotation typically involves updating encrypted secret files and re-running boot or service restart, which can be done independently of full system redeploys.

Secrets stored in /run/secrets are accessible to all services with appropriate permissions. You can reference the same secret files across multiple systemd services, environment variables, or scripts, centralizing secret management while keeping access controlled.