// weyl-ai secrets management //

flake parts module for using weyl-ai secrets in a downstream repository.

// downstream usage //

since this is a private flake, you must add it to your flake's inputs like follows:

inputs.weyl-secrets.url = "git+ssh://git@github.com/weyl-ai/secrets.git";

after adding it to your inputs, you should add it as a flakeModule like so:

imports = [
  inputs.weyl-secrets.flakeModules.default
];

after this, your flake will have been extended with the following:

• a secrets devShell with useful scripts for interacting with secrets
• nix run bindings for all of those scripts
• a weyl-secrets top level module config option which contains all available secrets

Note: in a downstream flake you will not be able to edit these secrets as they are first copied into the nix store

// development //

this flake acts to dogfood the development of it's flake module. hence, the default devShell is bound to the secrets output from the flake module.

using any of the edit-* scripts in this repo will allow editing as expected.

// adding a new secret //

to add a new secret to the repository, use the wvault new command (weyl vault):

wvault new

this will walk you through an interactive prompt:

1. secret name: the identifier for your secret (e.g., db-password, api-key)
2. app name: which application this secret belongs to (default: global). suggestions include:
   • global - organization-wide secrets
   • client - frontend/client secrets
   • server - backend/api secrets
3. environment (optional): which environment the secret is for. choose from:
   • dev - development environment
   • staging - staging environment
   • prod - production environment
   • or skip to use root app level (no environment)
4. secret format: how to store the secret:
   • raw - plain text (string)
   • pem - certificate/key format
   • envfile - environment variables (KEY=VALUE pairs)
5. secret value:
   • for envfile format: opens an editor for entering environment variables
   • for other formats: choose between editor or inline input

the secret will be:

• encrypted using age and stored at secrets/<app>/<environment>/<name>.age (or secrets/<app>/<name>.age if no environment)
• added to inventory.yaml with metadata about the secret
• ready to be generated into secrets.nix via wvault gen-nix

example: creating a database password for the server app in production:

$ wvault new
✔ Secret name · db-password
✔ App name (default: global) · server
✔ Environment (optional, leave blank to skip) · prod
✔ Format · raw
✔ Use editor to enter value? · yes
# ... editor opens, enter the password, save and close
✓ Created secret: secrets/server/prod/db-password.age
✓ Added to inventory.yaml

then commit the changes:

git add inventory.yaml secrets/<app>/<environment>/<name>.age
git commit -m "add <app> <environment> <name> secret"
git push