Gabriel Brown
89761a7da3
Agent instructions, skills, SSH host aliases and expansion triggers are worth having identical on every machine one person owns, and belong in none of the shared configuration. They live in user/ now, with a manifest saying where each piece goes and a link-user stage that puts it there. That stage does nothing unless the machine said yes. Somebody who clones Panama to try the desktop keeps their own ~/.claude/CLAUDE.md exactly where it was; the question names the destinations and defaults to no. Anything displaced goes to config/old rather than being deleted. ~/.claude/CLAUDE.md and ~/.codex/AGENTS.md were byte-identical copies of one file, which is the drift this exists to prevent. Also adds the vitals toggles for the battery and Claude usage readouts, which had preferences and no way to reach them.
3.8 KiB
3.8 KiB
Cloud Secret Manager Syncs: AWS, GCP, Azure
AWS Secrets Manager
Prerequisites
- AWS Connection with Secret Sync permissions
- Network allows inbound requests from Infisical
Destination Config
| Field | Required | Description |
|---|---|---|
| AWS Connection | Yes | The App Connection to authenticate with |
| Region | Yes | AWS region (e.g., us-east-1) |
| Mapping Behavior | Yes | one-to-one (each secret → separate AWS secret) or many-to-one (all secrets → single AWS secret as JSON) |
| Secret Name | If many-to-one | Name of the single AWS secret for many-to-one mapping |
Sync Options
| Field | Description |
|---|---|
| Initial Sync Behavior | overwrite-destination, import-prioritize-infisical, or import-prioritize-aws-secrets-manager |
| Key Schema | Template for key transformation (e.g., INFISICAL_{{secretKey}}) |
| KMS Key | Optional AWS KMS key ID or alias for encryption |
| Tags | Optional tags added to synced secrets |
| Sync Secret Metadata as Tags | If enabled, Infisical metadata becomes AWS tags (manual tags take precedence) |
| Auto-Sync Enabled | Default on — sync on changes |
| Disable Secret Deletion | Prevent Infisical from deleting destination secrets |
Gotchas
- Mapping behavior is unique to AWS SM — choose carefully as it affects how secrets are structured
- Many-to-one is ideal for apps that read a single JSON secret; one-to-one is better for per-secret access patterns
GCP Secret Manager
Prerequisites
- GCP Connection with Secret Sync permissions
- Enable APIs: Cloud Resource Manager API, Secret Manager API, Service Usage API
- Network allows inbound requests from Infisical
Destination Config
| Field | Required | Description |
|---|---|---|
| GCP Connection | Yes | The App Connection to authenticate with |
| Project | Yes | GCP project ID |
| Scope | Yes | global (all regions) or region (specific region) |
| Region | If scope=region | GCP region for regional secrets |
Sync Options
| Field | Description |
|---|---|
| Initial Sync Behavior | overwrite-destination, import-prioritize-infisical, or import-prioritize-gcp-secret-manager |
| Key Schema | Template for key transformation |
| Auto-Sync Enabled | Default on |
| Disable Secret Deletion | Prevent deletion at destination |
Gotchas
- Three GCP APIs must be enabled before creating the connection
- Regional scope restricts secret availability to that region only
Azure Key Vault
Prerequisites
- Azure Key Vault Connection
- User/service principal needs these secret permissions:
secrets/list,secrets/get,secrets/set,secrets/recover - Recommended role: Key Vault Secrets Officer
- Network allows inbound requests from Infisical
Destination Config
| Field | Required | Description |
|---|---|---|
| Azure Connection | Yes | The App Connection to authenticate with |
| Vault Base URL | Yes | Full URL of the Key Vault (e.g., https://my-vault.vault.azure.net) |
Sync Options
| Field | Description |
|---|---|
| Initial Sync Behavior | overwrite-destination, import-prioritize-infisical, or import-prioritize-azure-key-vault |
| Key Schema | Template for key transformation |
| Auto-Sync Enabled | Default on |
| Disable Secret Deletion | Prevent deletion at destination |
| Disable Certificate Import | Skip importing certificate objects from Azure Key Vault |
Gotchas
- Underscores are converted to hyphens. Azure Key Vault does not allow underscores in secret names.
DATABASE_URLbecomesDATABASE-URLat the destination. - The
secrets/recoverpermission is needed because Azure soft-deletes secrets — Infisical may need to recover a previously deleted secret before updating it.