Bill/docker-compose-config-skill
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Switch to encrypted_regex approach (preserves comments)

Browse Source
This commit is contained in:
Bill Ballou
2026-01-05 14:43:56 -05:00
parent 53f691df84
commit 0bb36511bf
1 changed files with 22 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
SKILL.md
View File

@@ -158,33 +158,39 @@ Private keys stay at `~/.config/sops/age/keys.txt` (never committed).
```yaml ```yaml
creation_rules: creation_rules:
- path_regex: env\.sops\.yaml$ - path_regex: env\.sops\.yaml$
unencrypted_regex: "_unencrypted$" encrypted_regex: "^(DB_PASSWORD|API_KEY|SECRET_.*|.*_SECRET|.*_PASSWORD|.*_TOKEN)$"
age: >- age: >-
age1abc...,age1def... age1abc...,age1def...
``` ```
Get recipient keys from `~/repos/sops-age-keys/recipients/*.pub`. - `encrypted_regex` specifies which keys to encrypt (only secrets)
- Get recipient keys from `~/repos/sops-age-keys/recipients/*.pub`
- Comments and non-matching keys remain unencrypted
### env.sops.yaml Format ### env.sops.yaml Format
Non-secret values use `_unencrypted` suffix (remain readable in git): Use normal variable names. Only keys matching `encrypted_regex` are encrypted:
```yaml ```yaml
# Non-secrets (readable in git) # Permissions
UID_unencrypted: "1000" UID: "1000"
GID_unencrypted: "1000" GID: "1000"
UPLOAD_LOCATION_unencrypted: "/mnt/user/pictures"
DB_DATA_LOCATION_unencrypted: "/mnt/user/appdata/immich"
APP_PORT_unencrypted: "2283"
DB_HOSTNAME_unencrypted: "database"
DB_USERNAME_unencrypted: "postgres"
DB_DATABASE_NAME_unencrypted: "immich"
# Secrets (encrypted by SOPS) # Paths
DB_PASSWORD: "actual_secret_value" UPLOAD_LOCATION: /mnt/user/pictures
DB_DATA_LOCATION: /mnt/user/appdata/immich
# Ports
APP_PORT: "2283"
# Database
DB_HOSTNAME: database
DB_USERNAME: postgres
DB_DATABASE_NAME: immich
DB_PASSWORD: secret_value_here
``` ```
After encryption, only `DB_PASSWORD` value is encrypted; `_unencrypted` values remain readable. After encryption, only `DB_PASSWORD` is encrypted; comments and other values remain readable.
### Makefile Targets ### Makefile Targets
@@ -193,7 +199,7 @@ SOURCE ?= env.sops.yaml
TARGET ?= .env TARGET ?= .env
decrypt: decrypt:
@sops decrypt --output-type dotenv $(SOURCE) | sed 's/_unencrypted=/=/g' > $(TARGET) @sops decrypt --output-type dotenv --output $(TARGET) $(SOURCE)
@echo "Decrypted $(SOURCE) -> $(TARGET)" @echo "Decrypted $(SOURCE) -> $(TARGET)"
encrypt: encrypt: