secs-man: Tool-independent secrets backup using age
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- secs-man is built around tool-independence: its README states encrypted secrets can be fully recovered using only a terminal, coreutils (
cp,mv,sha256sum), theageencryption library, and about 30 minutes of manual work, with no dependence on secs-man itself. - Files listed in a plaintext
.secrets-manifestare encrypted with age using a passphrase entered only through an interactive prompt — the tool never reads the passphrase from a file, argument, or environment variable, and produces timestamped snapshot directories on export. - secs-man is not published on crates.io, nixpkgs, or the AUR; installation is direct from the
Fran314/secrets-manager-rsGitHub repository vianix run, a NixOSfetchGit+callPackageimport, orcargo install --git. - A companion secs-man-ssh script deploys or pulls secrets from remote hosts without transmitting the encryption passphrase through the remote, using a non-root user with
sudofor thechown/chmodsteps the manifest may require. - The README warns that exported snapshots are not auto-cleaned, creating residual risk for "decrypting" secrets (disk keys, age/PGP identities, password-manager master keys) — if an old snapshot is leaked and the passphrase cracked, those high-value keys are exposed.
- Export integrity is enforced via companion sha256sum files generated and checked at export time, and the
verify-exportcommand can re-validate older snapshots for silent corruption.
Why it matters: For sysadmins and NixOS users managing local secrets, secs-man's 30-minute manual recovery path is a deliberate hedge against vendor lock-in — but the tool's own README flags that un-pruned timestamped snapshots of master keys are a concrete liability, meaning the operator is responsible for snapshot hygiene on anything beyond rotatable credentials like SSH keys.
Ask SkimNews
