darman/homelab
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

docs: warn against printing decrypted sops secrets

Browse Source 
Running sops --decrypt/edit_secrets --show and displaying the result
puts every plaintext secret in the file wherever that output lands,
not just the one value being checked. Point at `sops --set` instead
for adding/changing a single value non-interactively.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
darman
2026-08-18 00:38:12 +02:00
co-authored by Claude Sonnet 5
parent 7904433d34
commit f09ba07b63
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CLAUDE.md
+6
View File
@@ -59,6 +59,12 @@ Secrets (needs the admin age key at `~/.config/sops/age/keys.txt`):
./scripts/edit_secrets secrets/<host>.yaml ./scripts/edit_secrets secrets/<host>.yaml
``` ```
**Claude: never run `sops --decrypt`/`edit_secrets --show` and print the result — that
puts every plaintext secret in the file into the conversation transcript, not just the
one you wanted.** To add or change a single value non-interactively, use
`sops --set '["key"] "value"' secrets/<host>.yaml` (quote the value as JSON), which
writes without ever displaying the file's existing contents.
Test a service config BEFORE touching hardware — always do this for nontrivial changes: Test a service config BEFORE touching hardware — always do this for nontrivial changes:
``` ```
# x86 QEMU VM of mercury's DNS/DHCP stack (fast; validates pihole/unbound at runtime) # x86 QEMU VM of mercury's DNS/DHCP stack (fast; validates pihole/unbound at runtime)