From d29c53e630b652e300b5634d03c1746c329cdb99 Mon Sep 17 00:00:00 2001 From: Prad Nukala Date: Sun, 9 Aug 2026 14:48:13 -0400 Subject: [PATCH] feat(secrets): age-encrypt fish secrets; purge plaintext from history Co-Authored-By: Claude Fable 5 --- .beads/interactions.jsonl | 1 + .beads/issues.jsonl | 2 +- .../fish/conf.d/encrypted_secrets.fish.age | 28 +++++++++++++++++++ 3 files changed, 30 insertions(+), 1 deletion(-) create mode 100644 dot_config/fish/conf.d/encrypted_secrets.fish.age diff --git a/.beads/interactions.jsonl b/.beads/interactions.jsonl index 99bcacc..e536bfa 100644 --- a/.beads/interactions.jsonl +++ b/.beads/interactions.jsonl @@ -2,3 +2,4 @@ {"id":"int-9e6172d7","kind":"field_change","created_at":"2026-08-09T18:45:27.623863823Z","actor":"Prad Nukala","issue_id":"chezmoi-rnv","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Closed"}} {"id":"int-6bf2e4e2","kind":"field_change","created_at":"2026-08-09T18:45:27.838098287Z","actor":"Prad Nukala","issue_id":"chezmoi-byc","extra":{"field":"status","new_value":"in_progress","old_value":"open"}} {"id":"int-f4aa6fe4","kind":"field_change","created_at":"2026-08-09T18:45:27.978881011Z","actor":"Prad Nukala","issue_id":"chezmoi-1a0","extra":{"field":"status","new_value":"in_progress","old_value":"open"}} +{"id":"int-2daf66f4","kind":"field_change","created_at":"2026-08-09T18:47:05.649584079Z","actor":"Prad Nukala","issue_id":"chezmoi-byc","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"Closed"}} diff --git a/.beads/issues.jsonl b/.beads/issues.jsonl index 6ad1836..cff01f8 100644 --- a/.beads/issues.jsonl +++ b/.beads/issues.jsonl @@ -1,5 +1,5 @@ {"_type":"issue","id":"chezmoi-1a0","title":"Secrets audit: grep all candidate content for tokens before any chezmoi add","description":"Grep sk-, ghp_, glpat-, Bearer, token, key = across all files destined for repo. secrets.fish goes to age-encrypted encrypted_ path (key ~/.config/chezmoi/key.txt, manual distribution, document in README). Claude: never .credentials.json.","status":"in_progress","priority":1,"issue_type":"task","owner":"prad@sonr.io","created_at":"2026-08-09T18:41:50Z","created_by":"Prad Nukala","updated_at":"2026-08-09T18:45:28Z","started_at":"2026-08-09T18:45:28Z","dependency_count":0,"dependent_count":3,"comment_count":0} -{"_type":"issue","id":"chezmoi-byc","title":"Gating skeleton: .chezmoi.toml.tmpl + .chezmoiignore.tmpl + packages.yaml skeleton","description":"promptOnce name/email/role (desktop|laptop|mac|server); chezmoiignore gates linux-only trees on darwin and vice versa; .chezmoidata/packages.yaml skeleton {arch:{pacman,aur},darwin:{brew,cask},shared:{gh_extensions,go,cargo}}. Machinery before content.","status":"in_progress","priority":1,"issue_type":"task","owner":"prad@sonr.io","created_at":"2026-08-09T18:41:50Z","created_by":"Prad Nukala","updated_at":"2026-08-09T18:45:28Z","started_at":"2026-08-09T18:45:28Z","dependency_count":0,"dependent_count":13,"comment_count":0} +{"_type":"issue","id":"chezmoi-byc","title":"Gating skeleton: .chezmoi.toml.tmpl + .chezmoiignore.tmpl + packages.yaml skeleton","description":"promptOnce name/email/role (desktop|laptop|mac|server); chezmoiignore gates linux-only trees on darwin and vice versa; .chezmoidata/packages.yaml skeleton {arch:{pacman,aur},darwin:{brew,cask},shared:{gh_extensions,go,cargo}}. Machinery before content.","status":"closed","priority":1,"issue_type":"task","owner":"prad@sonr.io","created_at":"2026-08-09T18:41:50Z","created_by":"Prad Nukala","updated_at":"2026-08-09T18:47:06Z","started_at":"2026-08-09T18:45:28Z","closed_at":"2026-08-09T18:47:06Z","close_reason":"Closed","dependency_count":0,"dependent_count":13,"comment_count":0} {"_type":"issue","id":"chezmoi-rnv","title":"Inventory: disposition table for all dotstate synced paths","description":"Parse .dotstate-profiles.toml (Noctalia/Inir/Rogz/Vertical-Rogz_AppleStudio). Every synced path gets decision: universal / arch-gated / defer / drop / secret. Output table in MIGRATION-NOTES.md. Blocks all content.","status":"closed","priority":1,"issue_type":"task","owner":"prad@sonr.io","created_at":"2026-08-09T18:41:50Z","created_by":"Prad Nukala","updated_at":"2026-08-09T18:45:28Z","started_at":"2026-08-09T18:44:23Z","closed_at":"2026-08-09T18:45:28Z","close_reason":"Closed","dependency_count":0,"dependent_count":13,"comment_count":0} {"_type":"issue","id":"chezmoi-42m","title":"Validation: Arch fresh bring-up in container","description":"docker run archlinux: bootstrap one-liner, packages install, chezmoi doctor clean, niri validate, fish -n all files, nvim --headless +Lazy! sync, tmux -f cfg new -d; kill-server, gh extension list matches manifest. Plus live machine chezmoi diff ~ empty.","status":"open","priority":2,"issue_type":"task","owner":"prad@sonr.io","created_at":"2026-08-09T18:42:17Z","created_by":"Prad Nukala","updated_at":"2026-08-09T18:42:17Z","dependencies":[{"issue_id":"chezmoi-42m","depends_on_id":"chezmoi-21v","type":"blocks","created_at":"2026-08-09T14:42:58Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-42m","depends_on_id":"chezmoi-4sj","type":"blocks","created_at":"2026-08-09T14:42:58Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-42m","depends_on_id":"chezmoi-9sg","type":"blocks","created_at":"2026-08-09T14:42:59Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-42m","depends_on_id":"chezmoi-a2k","type":"blocks","created_at":"2026-08-09T14:42:59Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-42m","depends_on_id":"chezmoi-exq","type":"blocks","created_at":"2026-08-09T14:42:59Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-42m","depends_on_id":"chezmoi-fde","type":"blocks","created_at":"2026-08-09T14:42:59Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-42m","depends_on_id":"chezmoi-hou","type":"blocks","created_at":"2026-08-09T14:42:58Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-42m","depends_on_id":"chezmoi-iu2","type":"blocks","created_at":"2026-08-09T14:42:59Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-42m","depends_on_id":"chezmoi-sd9","type":"blocks","created_at":"2026-08-09T14:42:58Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-42m","depends_on_id":"chezmoi-utl","type":"blocks","created_at":"2026-08-09T14:42:58Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-42m","depends_on_id":"chezmoi-uw2","type":"blocks","created_at":"2026-08-09T14:42:57Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-42m","depends_on_id":"chezmoi-x7f","type":"blocks","created_at":"2026-08-09T14:42:58Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-42m","depends_on_id":"chezmoi-xi5","type":"blocks","created_at":"2026-08-09T14:42:58Z","created_by":"Prad Nukala","metadata":"{}"}],"dependency_count":13,"dependent_count":1,"comment_count":0} {"_type":"issue","id":"chezmoi-5by","title":"Cutover: freeze dotstate for migrated paths","description":"After both validations: remove migrated paths from .dotstate-profiles.toml, tag dotstate pre-chezmoi-freeze, stop Dolt sync for those paths. Archive, never delete.","status":"open","priority":2,"issue_type":"task","owner":"prad@sonr.io","created_at":"2026-08-09T18:42:17Z","created_by":"Prad Nukala","updated_at":"2026-08-09T18:42:17Z","dependencies":[{"issue_id":"chezmoi-5by","depends_on_id":"chezmoi-42m","type":"blocks","created_at":"2026-08-09T14:42:25Z","created_by":"Prad Nukala","metadata":"{}"},{"issue_id":"chezmoi-5by","depends_on_id":"chezmoi-udp","type":"blocks","created_at":"2026-08-09T14:42:25Z","created_by":"Prad Nukala","metadata":"{}"}],"dependency_count":2,"dependent_count":0,"comment_count":0} diff --git a/dot_config/fish/conf.d/encrypted_secrets.fish.age b/dot_config/fish/conf.d/encrypted_secrets.fish.age new file mode 100644 index 0000000..d27da3e --- /dev/null +++ b/dot_config/fish/conf.d/encrypted_secrets.fish.age @@ -0,0 +1,28 @@ +-----BEGIN AGE ENCRYPTED FILE----- +YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqSmlXaFRWOWNKZ2xaNncy +TTNDZGdPT3ZzTkc5U2l4TG9XeTNpYzNsV0c4CjlqZnpndy85S3ZsSXkyWXFRLzJt +V3A2a1dGK0RqcVFQQXhNTjZYbGxXSncKLS0tIGVwQ3p4aFlpS2R1aU9jUjY0WUpk +UlJZSGF1ZnA2cUdHcUQ3andvWm9rQk0KC+0hZ1OP3Rhs9EfnTIkG8lTEEx7z7iMo +eEptnWQfOyweio6jqmHeDGe7Lz3QUD0QE16+IXkl1E2/w1u/VHgBodk0hen8BEBM +ZcVsaks7CDw6ZLFCF0S4i+HxQeV47Kop5bKiIqliBKSZ6BpMbngdp4gmxTkr2XRw +zweRmCcUEQFtr4B0GqhYZwApRknCltneLxRSbFf2G5V+7YWPm/Fy3T5MH2K85APg +oPXtkStIvvOwaidnE2K+L54t8Hfk3GenuanigoLJpfisfIdiR1relNa8hwE1PprY +GNpY9gH6W3faoj7IwaWrKhsdoBvzqe5cHfuhHN4lFA+/yDdeP020coaJd2dtDNTO +LCnb7qUwJu7nMESVuHLgVpm2YomNuBiuq9LDpKZeBJ+gAhGezcQ5sqmGZW0TrA0m +U9gVeJjuMwURO1sS7V0r+sspZYa4SEOz+CWWmtzLpJK5iXOobfxEhmO0fUEvAN1O +Z0a6SnW9cZZRz44xrEJ3JxLqCwX3bAuGp9x8jqDCjvKLTwDAaRkXWUnj1f5pZldr +YH3saW+RQOb8h0/cUnhKukefN0tDOmdEvLdwwcfhmJjAM+nHUE8wWJxtXoOoKGZc +9pEf3LWg7D92S9DG2IOv2MZ2WTBv1PPFcePAc8+FPGo/ScUZ7BIIdGrM5ZAcUD8W +EeM1JppJHbTkALuzVjVlBQNdrTctOaXin2sgj47QEGWU5reKWfI8ZLeS+iEVAgfa +ewSZaRdXYOWJyAke+BNVpRTQm3LfvNg4qrH3r4IRVXWo7oyMlbUNGSfet9/821Jm +b6AwUGcBcsN0NWS4v1e6K/nKh0w1dE/IfER8W15o821z5pfjHb/fldMRc7sXuKSC +XAefGT8GqTbNW0i4KxIVlhHrXvArhv0NnldLRcMu9VT1LWpUGAMHbBHs3TIyn20L +2j+Xw9UiPkU6Ooo0o5xI11QLnpTEoV00OcnBft5VSL8PFDgsTJekQ4BE5P4x0h5w +hEmcW3Yy1iwSRuiWT5gsfROHh9eGtkydn2qblmBxRUdGzeMzlfvaUhzbJcMpo+ES +SeE8UUQ6MTB5jwoq9JLifNO6HfKmcz6SOOgQBHb0GB9lSaoWWHlVLJAm9KvXYtuQ +alDoua9RnNmXBlk9DPKMU9KPeEUFOxfHAF/UL3Q1qic01j7h+pA5wmgZHpZTH4rK +ayDJvigOlJa+yeymPF5MgEKjQk2n5Pb4OLmUD4N4oNi0TMPWJG9ZPkjud5o/mSK5 +KTaXl1Z/nEOlEgxKKuzX25OXl669p1o8k4+8xzsrd25tlhOSQWsCfCGY8E5fRV5H +YqqXpxBXpDJelVsH+6BBhAdrIDcZHXJMzx+Mr1rCThNfADFiYjouH8nES2HdQTdN +PCCl0pB2c3e2oP6o9U2R5aPhLLtmkGY1alJ00PHQecw= +-----END AGE ENCRYPTED FILE-----