Adding a Forgejo Secret

The forgejo subcommand manages secrets for Forgejo Actions runners and Codeberg/Forgejo CI credential stores.

Secret types

SSH deploy key

Generate an Ed25519 key for a Forgejo Actions runner, optionally inject the public key as a runner credential:

# Source only (no runner credential)
secret-manager forgejo ssh \
  --name aur-ssh-key \
  --cred AUR_SSH_KEY

# With runner credential injection on instances
secret-manager forgejo ssh \
  --name aur-ssh-key \
  --cred AUR_SSH_KEY \
  --instance codeberg --instance nixTrusted

The public key is printed to stdout and embedded as a Nix comment in the generated module.

GPG key pair

Store only the armored OpenPGP private key as an agenix secret. The command derives plaintext .asc and .fingerprint files beside the encrypted source.

secret-manager forgejo gpg-key-pair \
  --name modde-apt-repo-gpg-key \
  --cred modde_apt_repo_gpg_key \
  --from-age age/secrets/modules/repos/apt/modde-apt-repo-gpg-key.age

New keys are generated when neither --from-age nor --from-file is passed. Use --rotate to replace an existing private-key source.

A Nix mkSecret { generator = "gpg-key-pair"; userId = "Name <email>"; … } passes userId to the generator as age.secrets.<name>.settings.userId. Forges mark a signature verified only when the key UID carries the committer’s verified email, so set it for signing identities.

Passphrase credential

secret-manager forgejo password \
  --name copr-token \
  --cred copr-token \
  --instance codeberg \
  --length 64

Text credential

echo "my-token" | secret-manager forgejo text \
  --cred COPR_TOKEN \
  --instance codeberg

The slug defaults from the --cred value (e.g. COPR_TOKEN becomes copr).

File credential

secret-manager forgejo file \
  --name copr-token \
  --cred COPR_TOKEN \
  --instance codeberg \
  --from-file ./token.txt

Key rotation

Pass --rotate to force regeneration of an existing SSH key:

secret-manager forgejo ssh \
  --name aur-ssh-key \
  --cred AUR_SSH_KEY \
  --rotate