explaingit

quentinmit/sops-nix

Analysis updated 2026-07-18 · repo last pushed 2024-02-21

Audience · ops devopsComplexity · 4/5DormantSetup · moderate

TLDR

A NixOS tool that lets you store encrypted secrets like passwords and API keys in Git, then auto-decrypts them safely at deploy time.

Mindmap

mindmap
  root((sops-nix))
    What it does
      Encrypts secrets in Git
      Auto-decrypts at deploy
      Sets file permissions
    Encryption methods
      GPG keys
      Age keys
      SSH key conversion
      Cloud KMS
    Formats supported
      YAML and JSON
      Dotenv and INI
      Binary
    Use cases
      NixOS system config
      Home-manager dotfiles
      Team secret sharing

Code map

Detail Auto

An interactive map of this repo's files and how they connect — its source is parsed live in your browser. Click Visualize to build it.

filefunction / class

What do people build with it?

USE CASE 1

Store database passwords and API keys encrypted alongside your NixOS configuration in Git.

USE CASE 2

Automatically decrypt secrets into the right place with correct permissions during NixOS deployment.

USE CASE 3

Roll back to a previous deployment and have the matching old secrets restored atomically.

USE CASE 4

Manage personal dotfile secrets with Home-manager without leaking them in version control.

What is it built with?

NixGPGage

How does it compare?

quentinmit/sops-nix00kaku/gallery-slider-block04amanrajj/netwatch
Stars——0
Language—JavaScriptRust
Last pushed2024-02-212021-05-19—
MaintenanceDormantDormant—
Setup difficultymoderateeasymoderate
Complexity4/52/53/5
Audienceops devopsgeneralops devops

Figures from each repo's GitHub metadata at analysis time.

How do you get it running?

Difficulty · moderate Time to first run · 1h+

Requires generating and managing GPG or age encryption keys before secrets can be encrypted and deployed.

Copy-paste prompts

Prompt 1
Show me how to set up sops-nix to encrypt a database password and use it in my NixOS configuration.
Prompt 2
Explain how sops-nix converts an existing SSH key into an age encryption key.
Prompt 3
Walk me through configuring sops-nix to use AWS KMS instead of GPG for secret encryption.
Prompt 4
How does sops-nix atomically swap in new secrets during a NixOS deployment, and how does rollback work?

Frequently asked questions

What is sops-nix?

A NixOS tool that lets you store encrypted secrets like passwords and API keys in Git, then auto-decrypts them safely at deploy time.

Is sops-nix actively maintained?

Dormant — no commits in 2+ years (last push 2024-02-21).

How hard is sops-nix to set up?

Setup difficulty is rated moderate, with roughly 1h+ to a first successful run.

Who is sops-nix for?

Mainly ops devops.

Open on GitHub → Explain another repo

This repo across BitVibe Labs

Verify against the repo before relying on details.

Alternatives & similar repos