Keep the personal half of the desktop in one place, and ask before installing it
Agent instructions, skills, SSH host aliases and expansion triggers are worth having identical on every machine one person owns, and belong in none of the shared configuration. They live in user/ now, with a manifest saying where each piece goes and a link-user stage that puts it there. That stage does nothing unless the machine said yes. Somebody who clones Panama to try the desktop keeps their own ~/.claude/CLAUDE.md exactly where it was; the question names the destinations and defaults to no. Anything displaced goes to config/old rather than being deleted. ~/.claude/CLAUDE.md and ~/.codex/AGENTS.md were byte-identical copies of one file, which is the drift this exists to prevent. Also adds the vitals toggles for the battery and Claude usage readouts, which had preferences and no way to reach them.
This commit is contained in:
Gabriel Brown
@@ -0,0 +1,37 @@
|
||||
---
|
||||
name: infisical-secret-syncs
|
||||
description: "Guide for configuring Infisical Secret Syncs to push secrets from Infisical to third-party services. Covers 38+ sync destinations including AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, GitHub, Vercel, HashiCorp Vault, Cloudflare, and more. Use this skill when someone asks about: syncing secrets to AWS/GCP/Azure, pushing secrets to GitHub Actions, Vercel environment variables, secret sync setup, App Connections, mapping behavior, key schemas, or 'how do I get my Infisical secrets into [service]'."
|
||||
---
|
||||
|
||||
# Infisical Secret Syncs Guide
|
||||
|
||||
You are a setup assistant helping users configure Infisical Secret Syncs — a feature that automatically pushes secrets from an Infisical project to third-party services.
|
||||
|
||||
## How to use this skill
|
||||
|
||||
Start by understanding what destination the user wants to sync secrets to, then guide them through:
|
||||
|
||||
1. **App Connection** — The prerequisite authenticated connection to the target service
|
||||
2. **Source** — Which Infisical environment and folder path to sync from
|
||||
3. **Destination** — Provider-specific config (region, vault URL, repo, etc.)
|
||||
4. **Sync Options** — Initial sync behavior, key schema, auto-sync, deletion protection
|
||||
|
||||
Read the relevant reference file(s) for the user's destination, then walk them through step by step.
|
||||
|
||||
## Reference files
|
||||
|
||||
| File | When to read |
|
||||
|------|-------------|
|
||||
| `references/sync-overview.md` | User asks general questions about how syncs work, or needs the common setup workflow |
|
||||
| `references/aws-gcp-azure.md` | User wants to sync to AWS Secrets Manager, GCP Secret Manager, or Azure Key Vault |
|
||||
| `references/github-vercel-cloudflare.md` | User wants to sync to GitHub (org/repo/env secrets), Vercel, or Cloudflare Workers |
|
||||
| `references/vault-and-others.md` | User wants to sync to HashiCorp Vault, or asks about other supported destinations |
|
||||
|
||||
## Guiding principles
|
||||
|
||||
- **App Connection first.** Every sync requires an App Connection with correct permissions. Verify this exists before configuring the sync.
|
||||
- **Recommend Key Schemas.** Always suggest using a key schema (e.g., `INFISICAL_{{secretKey}}`) to scope which secrets Infisical manages and avoid overwriting unrelated secrets at the destination.
|
||||
- **Infisical is the source of truth.** Warn users that secrets at the destination not present in Infisical may be overwritten, depending on initial sync behavior.
|
||||
- **Import when migrating.** If the user already has secrets at the destination and is migrating to Infisical, recommend "Import Secrets (Prioritize Destination)" for the initial sync so they don't lose existing values.
|
||||
- **Auto-sync is default.** Mention that auto-sync is on by default — changes in Infisical automatically propagate. They can disable it for manual-only syncing.
|
||||
- **Warn about provider quirks.** Azure Key Vault converts underscores to hyphens. GitHub doesn't support importing secrets. Vercel can't import sensitive env vars.
|
||||
@@ -0,0 +1,88 @@
|
||||
# Cloud Secret Manager Syncs: AWS, GCP, Azure
|
||||
|
||||
## AWS Secrets Manager
|
||||
|
||||
### Prerequisites
|
||||
- AWS Connection with **Secret Sync** permissions
|
||||
- Network allows inbound requests from Infisical
|
||||
|
||||
### Destination Config
|
||||
| Field | Required | Description |
|
||||
|-------|----------|-------------|
|
||||
| AWS Connection | Yes | The App Connection to authenticate with |
|
||||
| Region | Yes | AWS region (e.g., `us-east-1`) |
|
||||
| Mapping Behavior | Yes | `one-to-one` (each secret → separate AWS secret) or `many-to-one` (all secrets → single AWS secret as JSON) |
|
||||
| Secret Name | If many-to-one | Name of the single AWS secret for many-to-one mapping |
|
||||
|
||||
### Sync Options
|
||||
| Field | Description |
|
||||
|-------|-------------|
|
||||
| Initial Sync Behavior | `overwrite-destination`, `import-prioritize-infisical`, or `import-prioritize-aws-secrets-manager` |
|
||||
| Key Schema | Template for key transformation (e.g., `INFISICAL_{{secretKey}}`) |
|
||||
| KMS Key | Optional AWS KMS key ID or alias for encryption |
|
||||
| Tags | Optional tags added to synced secrets |
|
||||
| Sync Secret Metadata as Tags | If enabled, Infisical metadata becomes AWS tags (manual tags take precedence) |
|
||||
| Auto-Sync Enabled | Default on — sync on changes |
|
||||
| Disable Secret Deletion | Prevent Infisical from deleting destination secrets |
|
||||
|
||||
### Gotchas
|
||||
- Mapping behavior is unique to AWS SM — choose carefully as it affects how secrets are structured
|
||||
- Many-to-one is ideal for apps that read a single JSON secret; one-to-one is better for per-secret access patterns
|
||||
|
||||
---
|
||||
|
||||
## GCP Secret Manager
|
||||
|
||||
### Prerequisites
|
||||
- GCP Connection with **Secret Sync** permissions
|
||||
- Enable APIs: Cloud Resource Manager API, Secret Manager API, Service Usage API
|
||||
- Network allows inbound requests from Infisical
|
||||
|
||||
### Destination Config
|
||||
| Field | Required | Description |
|
||||
|-------|----------|-------------|
|
||||
| GCP Connection | Yes | The App Connection to authenticate with |
|
||||
| Project | Yes | GCP project ID |
|
||||
| Scope | Yes | `global` (all regions) or `region` (specific region) |
|
||||
| Region | If scope=region | GCP region for regional secrets |
|
||||
|
||||
### Sync Options
|
||||
| Field | Description |
|
||||
|-------|-------------|
|
||||
| Initial Sync Behavior | `overwrite-destination`, `import-prioritize-infisical`, or `import-prioritize-gcp-secret-manager` |
|
||||
| Key Schema | Template for key transformation |
|
||||
| Auto-Sync Enabled | Default on |
|
||||
| Disable Secret Deletion | Prevent deletion at destination |
|
||||
|
||||
### Gotchas
|
||||
- Three GCP APIs must be enabled before creating the connection
|
||||
- Regional scope restricts secret availability to that region only
|
||||
|
||||
---
|
||||
|
||||
## Azure Key Vault
|
||||
|
||||
### Prerequisites
|
||||
- Azure Key Vault Connection
|
||||
- User/service principal needs these secret permissions: `secrets/list`, `secrets/get`, `secrets/set`, `secrets/recover`
|
||||
- Recommended role: **Key Vault Secrets Officer**
|
||||
- Network allows inbound requests from Infisical
|
||||
|
||||
### Destination Config
|
||||
| Field | Required | Description |
|
||||
|-------|----------|-------------|
|
||||
| Azure Connection | Yes | The App Connection to authenticate with |
|
||||
| Vault Base URL | Yes | Full URL of the Key Vault (e.g., `https://my-vault.vault.azure.net`) |
|
||||
|
||||
### Sync Options
|
||||
| Field | Description |
|
||||
|-------|-------------|
|
||||
| Initial Sync Behavior | `overwrite-destination`, `import-prioritize-infisical`, or `import-prioritize-azure-key-vault` |
|
||||
| Key Schema | Template for key transformation |
|
||||
| Auto-Sync Enabled | Default on |
|
||||
| Disable Secret Deletion | Prevent deletion at destination |
|
||||
| Disable Certificate Import | Skip importing certificate objects from Azure Key Vault |
|
||||
|
||||
### Gotchas
|
||||
- **Underscores are converted to hyphens.** Azure Key Vault does not allow underscores in secret names. `DATABASE_URL` becomes `DATABASE-URL` at the destination.
|
||||
- The `secrets/recover` permission is needed because Azure soft-deletes secrets — Infisical may need to recover a previously deleted secret before updating it.
|
||||
@@ -0,0 +1,98 @@
|
||||
# Platform Syncs: GitHub, Vercel, Cloudflare
|
||||
|
||||
## GitHub
|
||||
|
||||
### Prerequisites
|
||||
- GitHub Connection (via GitHub App or OAuth)
|
||||
- Network allows inbound requests from Infisical
|
||||
|
||||
### Destination Config
|
||||
| Field | Required | Description |
|
||||
|-------|----------|-------------|
|
||||
| GitHub Connection | Yes | The App Connection to authenticate with |
|
||||
| Scope | Yes | Where secrets are deployed: `organization`, `repository`, or `environment` |
|
||||
|
||||
**If scope = `organization`:**
|
||||
| Field | Required | Description |
|
||||
|-------|----------|-------------|
|
||||
| Organization Name | Yes | GitHub org name |
|
||||
| Visibility | Yes | `all-repositories`, `private-repositories` (requires Pro/Team), or `selected-repositories` |
|
||||
| Selected Repositories | If visibility=selected | Specific repos to grant access |
|
||||
|
||||
**If scope = `repository`:**
|
||||
| Field | Required | Description |
|
||||
|-------|----------|-------------|
|
||||
| Repository | Yes | Target repository (owner/repo) |
|
||||
|
||||
**If scope = `environment`:**
|
||||
| Field | Required | Description |
|
||||
|-------|----------|-------------|
|
||||
| Repository | Yes | Target repository |
|
||||
| Environment | Yes | GitHub environment name (e.g., `production`, `staging`) |
|
||||
|
||||
### Sync Options
|
||||
| Field | Description |
|
||||
|-------|-------------|
|
||||
| Initial Sync Behavior | **Only `overwrite-destination`** — GitHub does not support importing secrets |
|
||||
| Key Schema | Template for key transformation |
|
||||
| Auto-Sync Enabled | Default on |
|
||||
| Disable Secret Deletion | Prevent deletion at destination |
|
||||
|
||||
### Gotchas
|
||||
- **GitHub does not support importing secrets.** You cannot read existing GitHub secrets back — only overwrite. This means the initial sync will always be a one-way push.
|
||||
- Org visibility options depend on GitHub plan (Pro/Team required for `private-repositories`)
|
||||
- Environment secrets require the environment to already exist in the repository settings
|
||||
|
||||
---
|
||||
|
||||
## Vercel
|
||||
|
||||
### Prerequisites
|
||||
- Vercel Connection
|
||||
- Network allows inbound requests from Infisical
|
||||
|
||||
### Destination Config
|
||||
| Field | Required | Description |
|
||||
|-------|----------|-------------|
|
||||
| Vercel Connection | Yes | The App Connection to authenticate with |
|
||||
| Vercel App | Yes | Application to deploy secrets to |
|
||||
| Vercel App Environment | Yes | Target environment (e.g., `preview`, `production`, `development`) |
|
||||
| Vercel Preview Branch | No | Specific branch for preview deployments |
|
||||
|
||||
### Sync Options
|
||||
| Field | Description |
|
||||
|-------|-------------|
|
||||
| Initial Sync Behavior | `overwrite-destination`, `import-prioritize-infisical`, or `import-prioritize-vercel` |
|
||||
| Key Schema | Template for key transformation |
|
||||
| Auto-Sync Enabled | Default on |
|
||||
| Disable Secret Deletion | Prevent deletion at destination |
|
||||
|
||||
### Gotchas
|
||||
- **Vercel does not expose sensitive env var values.** During initial import, Vercel sensitive variables come in with empty values because Vercel's API doesn't return them.
|
||||
- After first sync, users must manually re-enter any sensitive variable values in Infisical to keep both platforms aligned.
|
||||
- Preview branch is optional — if set, secrets only apply to that branch's preview deployments
|
||||
|
||||
---
|
||||
|
||||
## Cloudflare Workers
|
||||
|
||||
### Prerequisites
|
||||
- Cloudflare Connection
|
||||
|
||||
### Destination Config
|
||||
| Field | Required | Description |
|
||||
|-------|----------|-------------|
|
||||
| Cloudflare Connection | Yes | The App Connection to authenticate with |
|
||||
| Workers Script | Yes | The specific Workers script to sync secrets to |
|
||||
|
||||
### Sync Options
|
||||
| Field | Description |
|
||||
|-------|-------------|
|
||||
| Initial Sync Behavior | `overwrite-destination` only — no import support |
|
||||
| Key Schema | Template for key transformation |
|
||||
| Auto-Sync Enabled | Default on |
|
||||
| Disable Secret Deletion | Prevent deletion at destination |
|
||||
|
||||
### Gotchas
|
||||
- Like GitHub, Cloudflare Workers does not support importing existing secrets
|
||||
- Secrets are synced as Workers secrets (encrypted environment variables), not plain text bindings
|
||||
@@ -0,0 +1,78 @@
|
||||
# Secret Syncs Overview
|
||||
|
||||
## What are Secret Syncs?
|
||||
|
||||
Secret Syncs are project-level resources that automatically push secrets from an Infisical source (environment + folder path) to third-party services. When secrets change in Infisical, the sync propagates those changes to the destination.
|
||||
|
||||
**Infisical is the source of truth.** Secrets at the destination not present in Infisical may be overwritten depending on the initial sync behavior setting.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
Every sync requires an **App Connection** — an authenticated connection to the target service with the correct permissions. Create the App Connection first, then create the sync.
|
||||
|
||||
## Common Setup Workflow
|
||||
|
||||
1. **Create App Connection** for the target service (one-time setup, reusable across syncs)
|
||||
2. **Navigate to** Project → Integrations → Secret Syncs tab → Add Sync
|
||||
3. **Select destination** (e.g., AWS Secrets Manager, GitHub, etc.)
|
||||
4. **Configure Source:**
|
||||
- Environment: project environment slug (e.g., `dev`, `staging`, `prod`)
|
||||
- Secret Path: folder path (e.g., `/`, `/api-keys`, `/database`)
|
||||
5. **Configure Destination:** provider-specific fields (region, vault URL, repo, etc.)
|
||||
6. **Configure Sync Options:**
|
||||
- Initial Sync Behavior
|
||||
- Key Schema (recommended)
|
||||
- Auto-Sync toggle
|
||||
- Disable Secret Deletion toggle
|
||||
7. **Name the sync** and create
|
||||
|
||||
## Key Concepts
|
||||
|
||||
### Initial Sync Behavior
|
||||
|
||||
Controls what happens on the first sync:
|
||||
|
||||
| Option | Behavior |
|
||||
|--------|----------|
|
||||
| **Overwrite Destination** | Removes any secrets at the destination not present in Infisical |
|
||||
| **Import (Prioritize Infisical)** | Imports existing destination secrets into Infisical first, Infisical values win on conflict |
|
||||
| **Import (Prioritize Destination)** | Imports existing destination secrets into Infisical first, destination values win on conflict |
|
||||
|
||||
> Not all destinations support importing. GitHub only supports "Overwrite Destination."
|
||||
|
||||
### Key Schema
|
||||
|
||||
A template that transforms secret names when syncing. Uses `{{secretKey}}` as a placeholder for the original name and `{{environment}}` for the environment slug.
|
||||
|
||||
**Example:** Key schema `INFISICAL_{{secretKey}}` transforms Infisical key `DATABASE_URL` into `INFISICAL_DATABASE_URL` at the destination.
|
||||
|
||||
**Why use it:** Prevents Infisical from accidentally managing secrets it didn't create. Highly recommended for all syncs.
|
||||
|
||||
When importing secrets, the key schema is stripped from keys before importing into Infisical.
|
||||
|
||||
### Mapping Behavior (AWS Secrets Manager only)
|
||||
|
||||
- **One-to-One:** Each Infisical secret becomes a separate secret in the destination
|
||||
- **Many-to-One:** All Infisical secrets are packed into a single destination secret (as JSON key-value pairs)
|
||||
|
||||
### Auto-Sync
|
||||
|
||||
Enabled by default. Secrets automatically sync when changes occur in the Infisical source. Disable for manual-only syncing.
|
||||
|
||||
### Disable Secret Deletion
|
||||
|
||||
When enabled, Infisical will not remove secrets from the destination. Use this if you manage some secrets manually outside of Infisical.
|
||||
|
||||
## Supported Destinations (38+)
|
||||
|
||||
Cloud Secret Managers: AWS Secrets Manager, AWS Parameter Store, GCP Secret Manager, Azure Key Vault, OCI Vault, HashiCorp Vault
|
||||
|
||||
CI/CD & Platforms: GitHub, GitLab, Bitbucket, Vercel, Netlify, Cloudflare Workers, Cloudflare Pages, Railway, Render, Fly.io, Heroku, Northflank, Digital Ocean, Supabase
|
||||
|
||||
DevOps & Monitoring: TeamCity, CircleCI, Jenkins (via Octopus Deploy), Terraform Cloud, Humanitec, Chef, Camunda, Checkly, Windmill, Zabbix, Databricks, Laravel Forge
|
||||
|
||||
Other: 1Password, Azure DevOps, Azure Entra ID (SCIM), External Infisical instance
|
||||
|
||||
## Secret Imports for Multiple Paths
|
||||
|
||||
If you need to sync secrets from multiple folder locations into a single sync, use Infisical's **Secret Imports** feature to consolidate them into one path first, then sync that path.
|
||||
@@ -0,0 +1,96 @@
|
||||
# HashiCorp Vault & Other Syncs
|
||||
|
||||
## HashiCorp Vault
|
||||
|
||||
### Prerequisites
|
||||
- HashiCorp Vault Connection (token or AppRole auth)
|
||||
|
||||
### Destination Config
|
||||
| Field | Required | Description |
|
||||
|-------|----------|-------------|
|
||||
| Vault Connection | Yes | The App Connection to authenticate with |
|
||||
| Secrets Engine Mount | Yes | KV secrets engine mount point (e.g., `secret`, `kv`) |
|
||||
| Path | Yes | Path within the engine (e.g., `dev/nested`, `myapp/config`) |
|
||||
|
||||
### Sync Options
|
||||
| Field | Description |
|
||||
|-------|-------------|
|
||||
| Initial Sync Behavior | `overwrite-destination`, `import-prioritize-infisical`, or `import-prioritize-hashicorp-vault` |
|
||||
| Key Schema | Template for key transformation |
|
||||
| Auto-Sync Enabled | Default on |
|
||||
| Disable Secret Deletion | Prevent deletion at destination |
|
||||
|
||||
### Gotchas
|
||||
- Paths are auto-created if they don't exist — no need to pre-create them in Vault
|
||||
- Works with KV v2 secrets engines
|
||||
- This is useful for migrating from Vault to Infisical gradually — sync back to Vault while transitioning
|
||||
|
||||
---
|
||||
|
||||
## Other Supported Destinations
|
||||
|
||||
All destinations follow the same general pattern: App Connection → Source → Destination → Sync Options. Key differences are in the destination config fields.
|
||||
|
||||
### AWS Parameter Store
|
||||
- **Destination Config:** Region, KMS Key ID (optional), Path prefix
|
||||
- **Mapping:** Each Infisical secret → separate SSM parameter
|
||||
- **Type:** Secrets stored as `SecureString` parameters
|
||||
|
||||
### GitLab
|
||||
- **Destination Config:** Group or Project, Environment scope
|
||||
- **Mapping:** CI/CD variables
|
||||
|
||||
### Bitbucket
|
||||
- **Destination Config:** Workspace, Repository
|
||||
- **Mapping:** Repository variables
|
||||
|
||||
### Netlify
|
||||
- **Destination Config:** Site, Context (production/deploy-preview/branch-deploy)
|
||||
|
||||
### Railway
|
||||
- **Destination Config:** Project, Environment, Service (optional)
|
||||
|
||||
### Render
|
||||
- **Destination Config:** Service
|
||||
|
||||
### Fly.io
|
||||
- **Destination Config:** App name
|
||||
|
||||
### Heroku
|
||||
- **Destination Config:** App name
|
||||
- **Note:** Secrets synced as config vars — Heroku restarts the dyno on changes
|
||||
|
||||
### Terraform Cloud
|
||||
- **Destination Config:** Organization, Workspace
|
||||
- **Mapping:** Workspace variables (sensitive)
|
||||
|
||||
### Databricks
|
||||
- **Destination Config:** Host, Secret Scope
|
||||
|
||||
### 1Password
|
||||
- **Destination Config:** Vault
|
||||
|
||||
### Supabase
|
||||
- **Destination Config:** Project reference
|
||||
|
||||
### TeamCity
|
||||
- **Destination Config:** Project
|
||||
|
||||
### CircleCI
|
||||
- **Destination Config:** Organization, Project
|
||||
|
||||
### Digital Ocean App Platform
|
||||
- **Destination Config:** App ID
|
||||
|
||||
## Choosing a Sync Destination
|
||||
|
||||
| If the user wants to... | Recommend... |
|
||||
|--------------------------|-------------|
|
||||
| Secrets in AWS services | AWS Secrets Manager (app-level) or AWS Parameter Store (config/infra-level) |
|
||||
| Secrets in GCP services | GCP Secret Manager |
|
||||
| Secrets in Azure services | Azure Key Vault |
|
||||
| Secrets in GitHub Actions | GitHub sync with `repository` or `environment` scope |
|
||||
| Secrets in Vercel deployments | Vercel sync targeting the correct app + environment |
|
||||
| Gradual migration from Vault | HashiCorp Vault sync (bidirectional via import) |
|
||||
| Secrets in CI/CD pipelines | GitHub, GitLab, Bitbucket, CircleCI, or TeamCity sync depending on their CI provider |
|
||||
| Secrets in PaaS platforms | Vercel, Netlify, Railway, Render, Fly.io, Heroku, or Digital Ocean sync |
|
||||
Reference in New Issue
Block a user