44 lines
1.1 KiB
Markdown
44 lines
1.1 KiB
Markdown
# Secrets (agenix)
|
|
|
|
This repo supports local + CI secrets management via `agenix`/`age`.
|
|
|
|
CI deploys use one Forgejo Actions secret:
|
|
|
|
- `AGE_FORGE_SSH_KEY`: SSH private key used to decrypt repo-tracked `.age` files.
|
|
|
|
Set/update it with:
|
|
|
|
```sh
|
|
nix develop -c ./scripts/fj-set-age-key-secret.sh ~/.config/every.channel/keys/forge_ci_ed25519
|
|
```
|
|
|
|
## Files
|
|
|
|
- `secrets/secrets.nix`: recipients + secret file mapping
|
|
- `secrets/cloudflare-api-token.age`: encrypted Cloudflare API token (used by deploy workflow)
|
|
- `secrets/forge-token.age`: encrypted Forgejo API token for admin scripts (optional, preferred)
|
|
- `secrets/codeberg-token.age`: encrypted Codeberg token for compatibility/mirror admin scripts (optional)
|
|
|
|
## Create / edit secrets (local)
|
|
|
|
Enter the dev shell:
|
|
|
|
```sh
|
|
nix develop
|
|
```
|
|
|
|
Encrypt (create) a secret:
|
|
|
|
```sh
|
|
agenix -e secrets/cloudflare-api-token.age
|
|
```
|
|
|
|
Decrypt (inspect) a secret:
|
|
|
|
```sh
|
|
agenix -d secrets/cloudflare-api-token.age
|
|
```
|
|
|
|
## Decryption identity
|
|
|
|
`agenix`/`age` decrypts using SSH private key material. The private key must be available locally (or injected as CI secret) and is never committed to the repo.
|