every-channel/every.channel
1
0
Fork 0
Code Releases Activity Actions 2
every.channel/secrets/README.md
every.channel 223272db7d
dev: import plaintext token into agenix secret
2026-02-15 17:54:36 -05:00

836 B
Raw Blame History

Secrets (agenix)

This repo supports optional local secrets management via agenix.

CI should prefer Forgejo Actions secrets (e.g. CLOUDFLARE_API_TOKEN) rather than decrypting secrets in runners.

Files

  • secrets/secrets.nix: recipients + secret file mapping
  • secrets/cloudflare-api-token.age: encrypted Cloudflare API token (optional)
  • secrets/codeberg-token.age: encrypted Codeberg/Forgejo token for fj (optional)

Create / edit secrets (local)

Enter the dev shell:

nix develop

Encrypt (create) a secret:

agenix -e secrets/cloudflare-api-token.age

Decrypt (inspect) a secret:

agenix -d secrets/cloudflare-api-token.age

Decryption identity

agenix decrypts using your local SSH key material. The private key must be available locally but is never committed to the repo.