Secrets Options

secrets.all-public-keys

All configured SOPS recipient public keys after applying Nix-based fallbacks.

secrets.codegen

Code generation targets keyed by name (e.g., typescript, go, python). Used to drive language-specific env/secret helpers.

secrets.codegen.<name>.directory

Output directory for generated code (repo-relative)

secrets.codegen.<name>.language

Target language for generated code (e.g., "typescript", "go", "python"). Informational only for now; codegen selection is based on the target key.

secrets.codegen.<name>.name

Name of the generated package/module (defaults to the target key)

secrets.creation-rules

SOPS creation rules rendered into .stack/secrets/.sops.yaml.

These rules mirror SOPS directly and can reference both direct recipients and reusable recipient groups.

Example:

[
  {
    path-regex = "^dev/web\\.sops\\.yaml$";
    recipient-groups = [ "dev-team" ];
  }
  ]

secrets.creation-rules.*.path-regex

Regex matched against SOPS file paths.

Example:

"^dev/web\\.sops\\.yaml$"

secrets.creation-rules.*.recipient-groups

Named recipient groups expanded into this rule.

Example:

[
  "dev-team"
  "ci"
]

secrets.creation-rules.*.recipients

Direct recipient names included in this rule.

Example:

[
  "alice"
]

secrets.creation-rules.*.unencrypted-comment-regex

Regex for comments that mark plaintext values in SOPS files.

secrets.enable

Enable secrets management

secrets.environments

Legacy environment-specific secrets configuration.

secrets.environments.<name>.name

Name of the environment (e.g., dev, staging, production)

secrets.environments.<name>.public-keys

AGE public keys that can decrypt secrets for this environment. New secrets for this env are encrypted to these recipients.

secrets.environments.<name>.sources

List of SOPS-encrypted source files for this environment (without .yaml extension). These files are decrypted and merged to provide secrets for the environment.

secrets.groups

Deprecated legacy groups option.

secrets.input-directory

Directory containing SOPS-encrypted secrets (legacy SOPS layout). Used when decrypting/merging YAML sources defined under environments.

secrets.kms.aws-profile

Optional AWS profile name to pass alongside the KMS ARN in .sops.yaml.

Example:

"production"

secrets.kms.aws-role-arn

Optional AWS IAM role ARN for assume-role. Added to the SOPS KMS entry as role_arn when set.

Example:

"arn:aws:iam::123456789012:role/sops-decryptor"

secrets.kms.key-arn

AWS KMS key ARN to add as a SOPS recipient in .stack/secrets/.sops.yaml.

When set, every creation rule will encrypt to this KMS key in addition to the configured AGE recipients.

Example:

"arn:aws:kms:us-east-1:123456789012:key/mrk-abc123"

secrets.master-keys

Master keys for encrypting and decrypting individual .age secret files.

These are separate from the SOPS recipient list used for vars/*.sops.yaml. A default local key is always configured so local development works out of the box.

Default:

{
  local = {
    age-pub = "";
    ref = "ref+file://.stack/keys/local.txt";
  };
}

Example:

{
  local = {
    age-pub = "age1...";
    ref = "ref+file://.stack/keys/local.txt";
  };
  ci = {
    age-pub = "age1...";
    ref = "ref+awsssm://stackpanel/keys/ci";
  };
}

secrets.master-keys.<name>.age-pub

AGE public key for encrypting secrets to this key. Format: age1... (bech32-encoded)

secrets.master-keys.<name>.ref

Vals reference that resolves to the AGE private key. Examples:

secrets.master-keys.<name>.resolve-cmd

Custom command to resolve the private key (overrides ref). The command should output the AGE private key to stdout. Example: op read 'op://vault/stackpanel/age-key'

secrets.recipient-groups

Reusable recipient sets that can be referenced by SOPS creation rules.

Example:

{
  dev-team.recipients = [ "alice" "bob" ];
  ci.recipients = [ "buildkite" ];
}

secrets.recipient-groups.<name>.recipients

Named recipients included by this reusable recipient group.

Example:

[
  "alice"
  "buildkite"
]

secrets.recipients

SOPS recipients declared in Nix.

These entries are rendered into .stack/secrets/.sops.yaml. If left empty, Stackpanel falls back to recipients derived from stackpanel.users.*.public-keys and secrets-allowed-environments.

Example:

{
  cooper = {
    public-key = "age1psa52j93p0t7rej4lyzeww6hzg9hh4ylxu6v30tcgag44apw8als2xg3ef";
    tags = [ "dev" "prod" "shared" ];
  };
  coop_mac_studio = {
    public-key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFauRe+VXvSmsca73hmxrylRPiueX/aHbXUu1jz7kGB8";
    tags = [ "dev" ];
  };
}

secrets.recipients.<name>.public-key

Public key to include in the generated .stack/secrets/.sops.yaml.

Supports both AGE (age1...) and SSH Ed25519 (ssh-ed25519 ...) recipients.

Example:

"age1psa52j93p0t7rej4lyzeww6hzg9hh4ylxu6v30tcgag44apw8als2xg3ef"

secrets.recipients.<name>.tags

Tags used to select this recipient for secret groups.

A secret group includes every recipient whose tags overlap with the group's configured tags.

Example:

[
  "dev"
  "shared"
]

secrets.secrets-dir

Directory where secret .age files are stored (default: .stack/secrets)

secrets.sops-age-keys.op-refs

Optional op:// references queried with op read.

If configured, sops-age-keys attempts these references after configured file paths.

Example:

[
  "op://travel/age-keys/local/private"
  "op://travel/age-keys/shared/private"
]

secrets.sops-age-keys.paths

Additional private key file paths searched by sops-age-keys after user-key-path and repo-key-path.

Paths are tested with [[ -f ]] as provided, so they can be absolute or relative to your current working directory.

Example:

[
  "/tmp/team-keys/sops.age"
  "/run/secrets/ci.age"
]

secrets.sops-age-keys.repo-key-path

Repo-local fallback AGE key path generated by Stackpanel for development.

This is convenient for bootstrapping, but a user-level or external key source is preferred for long-term use.

Example:

"\".stack/keys/local.txt\""

secrets.sops-age-keys.sources

Ordered key sources tried by sops-age-keys.

This is the preferred configuration model for the UI. File-like sources are tried in order until one yields an AGE private key.

Default:

[
  {
    name = "User key path";
    type = "user-key-path";
    value = "$HOME/Library/Application Support/sops/age/keys.txt";
  }
  {
    name = "Repo key path";
    type = "repo-key-path";
    value = ".stack/keys/local.txt";
  }
]

secrets.sops-age-keys.sources.*.account

Optional account selector for sources that support it, such as 1Password or macOS Keychain.

secrets.sops-age-keys.sources.*.enabled

Whether this source is active.

secrets.sops-age-keys.sources.*.id

Optional UI identifier for this source.

secrets.sops-age-keys.sources.*.name

Optional UI label for this source.

secrets.sops-age-keys.sources.*.priority

Optional UI ordering metadata for this source.

secrets.sops-age-keys.sources.*.type

Ordered source type used by sops-age-keys.

secrets.sops-age-keys.sources.*.value

Path or reference value for this source.

secrets.sops-age-keys.user-key-path

Primary user-level AGE key path for SOPS.

This should point to a user-managed key file outside the repo. Stackpanel checks this before any additional custom paths.

Example:

"\"$HOME/Library/Application Support/sops/age/keys.txt\""

secrets.system-keys

System-level AGE public keys (CI, deploy servers, etc.). These keys can decrypt all secrets regardless of environment restrictions.