Skip to content
dotfiles

Secrets

Secrets are managed with SOPS and sops-nix. The repository uses SSH-derived age recipients for normal host and user operation, plus a PGP recipient for bootstrap and recovery.

Recipient Model

Section titled “Recipient Model”
  • User secrets under secrets/johnson/ are encrypted to the user age recipient and the PGP recipient.
  • Core bootstrap secrets under secrets/johnson/core/ are PGP-only.
  • Service secrets under secrets/services/ are encrypted to host recipients and the PGP recipient.

The authoritative recipient rules live in .sops.yaml.

Common Commands

Section titled “Common Commands”

Edit a secret:

Terminal window
sops secrets/services/default.yaml
sops secrets/johnson/default.yaml

Update recipients after changing .sops.yaml:

Terminal window
sops updatekeys -y secrets/services/default.yaml

Validate decryption without printing the secret:

Terminal window
sops -d secrets/services/default.yaml >/dev/null

Bootstrap

Section titled “Bootstrap”

Initialize local keys for an existing host:

Terminal window
just init-local <host>

Initialize a remote machine:

Terminal window
just init-remote <host> <ip>

For the longer operational notes, see the Markdown source at docs/SOPS.md.