mirror of https://github.com/ivuorinen/dotfiles.git synced 2026-03-20 17:06:49 +00:00

Files

Ismo Vuorinen f2a3ae9a4b feat(fish): add secrets.d for secret env vars

Add config/fish/secrets.d/ directory pattern to .gitignore while
allowing *.example and README.md through. Add README and example file
documenting the secrets convention. Source secrets.d/*.fish files in
exports.fish so secret environment variables are loaded automatically.

2026-03-20 04:20:51 +02:00

2.1 KiB

Raw Blame History

Fish Shell Secrets Directory

This directory contains sensitive environment variables like API tokens and credentials.

Usage

Copy an example file (e.g., github.fish.example) to remove the .example suffix:
```
cp github.fish.example github.fish
```
Edit the file and replace placeholder values with your actual secrets:
```
$EDITOR github.fish
```
Reload your fish shell or source the exports:
```
source ~/.config/fish/exports.fish
```

Adding New Secret Files

Create a new .fish file in this directory with your environment variables:

# Example: openai.fish
set -x OPENAI_API_KEY "sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

Common secret patterns:

github.fish - GitHub Personal Access Token (GITHUB_TOKEN)
aws.fish - AWS credentials (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY)
openai.fish - OpenAI API key (OPENAI_API_KEY)
anthropic.fish - Anthropic API key (ANTHROPIC_API_KEY)

Security Best Practices

Never commit actual secrets - Only .example files are tracked by git
Use specific permissions - Consider chmod 600 for secret files
Rotate credentials regularly - Update tokens when compromised
Use environment-specific files - Separate dev/staging/prod credentials
Check before committing - Run git status to verify secrets aren't staged

How It Works

The exports.fish file automatically sources all *.fish files from this directory:

if test -d "$DOTFILES/config/fish/secrets.d"
    for secret_file in "$DOTFILES/config/fish/secrets.d"/*.fish
        if test -f "$secret_file"
            source "$secret_file"
        end
    end
end

Files ending in .example are ignored by the loader but tracked by git as templates.

Backward Compatibility

This directory supplements the existing exports-secret.fish pattern. Both methods work:

Legacy: config/fish/exports-secret.fish (single file, still supported)
New: config/fish/secrets.d/*.fish (multiple files, recommended)

Use whichever approach fits your workflow best.

2.1 KiB Raw Blame History