Agent skill
sops-decrypt
Decrypt and edit SOPS-encrypted secrets in this repo
Install this agent skill to your Project
npx add-skill https://github.com/majiayu000/claude-skill-registry/tree/main/skills/other/other/sops-decrypt-abl030-nixosconfig
SKILL.md
SOPS Secret Decryption
Key Lookup Order
This machine has a user SSH key that can decrypt all secrets:
age_key=$(ssh-to-age -private-key -i ~/.ssh/id_ed25519 2>/dev/null)
Decrypt a secret to stdout
age_key=$(ssh-to-age -private-key -i ~/.ssh/id_ed25519 2>/dev/null) && \
SOPS_AGE_KEY="$age_key" sops -d secrets/<filename>
Encrypt a plaintext file (must specify --config)
age_key=$(ssh-to-age -private-key -i ~/.ssh/id_ed25519 2>/dev/null) && \
SOPS_AGE_KEY="$age_key" sops -e \
--config /home/abl030/nixosconfig/secrets/.sops.yaml \
--input-type dotenv --output-type dotenv \
<plaintext-file> > <encrypted-output>
Edit a secret in-place (decrypt, modify, re-encrypt)
# 1. Decrypt to temp file
age_key=$(ssh-to-age -private-key -i ~/.ssh/id_ed25519 2>/dev/null)
SOPS_AGE_KEY="$age_key" sops -d secrets/<file>.env > /tmp/<file>_plain.env
# 2. Modify the plaintext (sed, python, etc.)
sed -i 's/OLD_VALUE/NEW_VALUE/' /tmp/<file>_plain.env
# 3. Re-encrypt back
SOPS_AGE_KEY="$age_key" sops -e \
--config /home/abl030/nixosconfig/secrets/.sops.yaml \
--input-type dotenv --output-type dotenv \
/tmp/<file>_plain.env > secrets/<file>.env
# 4. Clean up plaintext
rm -f /tmp/<file>_plain.env
Important Notes
- The
.sops.yamlconfig lives atsecrets/.sops.yaml - When encrypting, you MUST pass
--configexplicitly (sops won't find it automatically for files outsidesecrets/) - All secret files are in
secrets/directory - Format is typically
dotenv(use--input-type dotenv --output-type dotenv) - The user's
dccommand does the same thing but opens in nvim (not usable non-interactively) - After modifying secrets, commit the encrypted file — never commit plaintext
- Run
sops updatekeys --yes <file>after adding new hosts to.sops.yaml
Secret Files
| File | Contents |
|---|---|
kopia.env |
KOPIA_SERVER_USER, KOPIA_SERVER_PASSWORD, KOPIA_PASSWORD |
uptime-kuma.env |
KUMA_USERNAME, KUMA_PASSWORD |
uptime-kuma-api.env |
KUMA_API_KEY |
immich.env |
Immich DB and API credentials |
caddy-tailscale.env |
Tailscale auth key |
acme-cloudflare.env |
Cloudflare API token for ACME |
| Others | See ls secrets/ |
Recommended Agent Skills
Expand your agent's capabilities with these related and highly-rated skills.
majiayu000/claude-skill-registry
agent-ops-spec
Manage specification documents in .agent/specs/. Use when user provides requirements, acceptance criteria, or feature descriptions that need to be tracked and validated against implementation.
majiayu000/claude-skill-registry
agent-ops-state
Maintain .agent state files. Use at session start, after meaningful steps, and before concluding: read/update constitution/memory/focus/issues/baseline consistently.
majiayu000/claude-skill-registry
agent-ops-spec
Manage specification documents in .agent/specs/. Use when user provides requirements, acceptance criteria, or feature descriptions that need to be tracked and validated against implementation.
majiayu000/claude-skill-registry
agent-ops-testing
Test strategy, execution, and coverage analysis. Use when designing tests, running test suites, or analyzing test results beyond baseline checks.
majiayu000/claude-skill-registry
agent-ops-testing
Test strategy, execution, and coverage analysis. Use when designing tests, running test suites, or analyzing test results beyond baseline checks.
majiayu000/claude-skill-registry
agent-ops-state
Maintain .agent state files. Use at session start, after meaningful steps, and before concluding: read/update constitution/memory/focus/issues/baseline consistently.
Didn't find tool you were looking for?