gitwtfhub

wtf is sops-nix?

quentinmit/sops-nix — explained in plain English

Analysis updated 2026-07-18 · repo last pushed 2024-02-21

Audience · ops devopsComplexity · 4/5DormantSetup · moderate

TL;DR

A NixOS tool that lets you store encrypted secrets like passwords and API keys in Git, then auto-decrypts them safely at deploy time.

Mindmap

mindmap
  root((sops-nix))
    What it does
      Encrypts secrets in Git
      Auto-decrypts at deploy
      Sets file permissions
    Encryption methods
      GPG keys
      Age keys
      SSH key conversion
      Cloud KMS
    Formats supported
      YAML and JSON
      Dotenv and INI
      Binary
    Use cases
      NixOS system config
      Home-manager dotfiles
      Team secret sharing

Code map

Detail Auto

An interactive map of this repo's files and how they connect — its source is parsed live in your browser. Click Visualize to build it.

filefunction / class

Why would anyone build with this?

REASON 1

Store database passwords and API keys encrypted alongside your NixOS configuration in Git.

REASON 2

Automatically decrypt secrets into the right place with correct permissions during NixOS deployment.

REASON 3

Roll back to a previous deployment and have the matching old secrets restored atomically.

REASON 4

Manage personal dotfile secrets with Home-manager without leaking them in version control.

What's in the stack?

NixGPGage

How it stacks up

quentinmit/sops-nix0verflowme/alarm-clock0verflowme/seclists
Language—CSS—
Last pushed2024-02-212022-10-032020-05-03
MaintenanceDormantDormantDormant
Setup difficultymoderateeasyeasy
Complexity4/52/51/5
Audienceops devopsvibe coderops devops

Figures from each repo's GitHub metadata at analysis time.

How do you spin it up?

Difficulty · moderate Time to first run · 1h+

Requires generating and managing GPG or age encryption keys before secrets can be encrypted and deployed.

Yoink these prompts

Prompt 1
Show me how to set up sops-nix to encrypt a database password and use it in my NixOS configuration.
Prompt 2
Explain how sops-nix converts an existing SSH key into an age encryption key.
Prompt 3
Walk me through configuring sops-nix to use AWS KMS instead of GPG for secret encryption.
Prompt 4
How does sops-nix atomically swap in new secrets during a NixOS deployment, and how does rollback work?

Frequently asked questions

wtf is sops-nix?

A NixOS tool that lets you store encrypted secrets like passwords and API keys in Git, then auto-decrypts them safely at deploy time.

Is sops-nix actively maintained?

Dormant — no commits in 2+ years (last push 2024-02-21).

How hard is sops-nix to set up?

Setup difficulty is rated moderate, with roughly 1h+ to a first successful run.

Who is sops-nix for?

Mainly ops devops.

View the repo → Decode another repo

This repo across BitVibe Labs

Don't trust strangers blindly. Verify against the repo.

Other repos in this lane