--- name: fnox-providers-fd6292890ca8 description: Use when configuring Fnox providers for encryption and secret storage. Covers age encryption, cloud providers (AWS, Azure, GCP), and password managers. allowed-tools: - Read - Write - Edit - Bash - Grep - Glob --- # Fnox - Providers Configuring encryption and secret storage providers in Fnox for secure secrets management. ## Provider Types Fnox supports three categories of providers: 1. **Encryption** - Local encryption (age, AWS KMS, Azure, GCP) 2. **Cloud Storage** - Remote secret storage (AWS Secrets Manager, Azure Key Vault, GCP Secret Manager, Vault) 3. **Password Managers** - Integration with password managers (1Password, Bitwarden, Infisical, pass) ## Age Encryption (Recommended) ### Setup Age Provider ```bash # Generate age key pair age-keygen -o ~/.config/fnox/keys/identity.txt # Get public key cat ~/.config/fnox/keys/identity.txt | grep "public key" # age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p ``` ### Configure Age in fnox.toml ```toml # fnox.toml (committed) [providers.age] type = "age" public_keys = ["age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p"] # fnox.local.toml (gitignored) [providers.age] identity = "~/.config/fnox/keys/identity.txt" ``` ### Store Secrets with Age ```bash # Set encrypted secret fnox set DATABASE_PASSWORD # Prompts for value, encrypts with age public key # Set from command echo "secret-value" | fnox set API_KEY --provider age ``` ### Team Setup with Age ```toml # Multiple recipients for team access [providers.age] type = "age" public_keys = [ "age1ql3z...", # Alice "age1qw4r...", # Bob "age1qx5t...", # CI/CD ] ``` ## AWS Secrets Manager ### Configure AWS Secrets Manager ```toml [providers.aws-sm] type = "aws-sm" region = "us-east-1" # Optional: profile = "production" ``` ### Store Secrets in AWS ```bash # Reference AWS secret fnox set DATABASE_URL --provider aws-sm # Enter: prod/database-url (AWS secret name) ``` ### AWS Secrets Manager Configuration ```toml [secrets] DATABASE_URL = { provider = "aws-sm", value = "prod/database-url", description = "Production database connection string" } API_KEY = { provider = "aws-sm", value = "prod/api-key" } ``` ## AWS KMS Encryption ### Configure AWS KMS ```toml [providers.kms] type = "aws-kms" key_id = "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012" region = "us-east-1" ``` ### Use AWS KMS ```bash # Encrypt with KMS fnox set SECRET_KEY --provider kms ``` ## Azure Key Vault ### Configure Azure ```toml [providers.azure] type = "azure-kv" vault_url = "https://my-vault.vault.azure.net" # Authentication via Azure CLI or environment variables ``` ### Azure Secrets ```toml [secrets] DATABASE_PASSWORD = { provider = "azure", value = "database-password", description = "Azure Key Vault secret name" } ``` ## GCP Secret Manager ### Configure GCP ```toml [providers.gcp] type = "gcp-sm" project_id = "my-project" # Authentication via gcloud or service account ``` ### GCP Secrets ```toml [secrets] API_KEY = { provider = "gcp", value = "projects/my-project/secrets/api-key/versions/latest" } ``` ## HashiCorp Vault ### Configure Vault ```toml [providers.vault] type = "vault" address = "https://vault.example.com" token = { env = "VAULT_TOKEN" } # From environment ``` ### Vault Secrets ```toml [secrets] DATABASE_URL = { provider = "vault", value = "secret/data/prod/database-url" } ``` ## 1Password ### Configure 1Password ```toml [providers.onepassword] type = "1password" # Requires 1Password CLI (op) installed ``` ### 1Password References ```toml [secrets] API_KEY = { provider = "onepassword", value = "op://Production/API Keys/api-key" } DATABASE_PASSWORD = { provider = "onepassword", value = "op://Production/Database/password" } ``` ## Bitwarden ### Configure Bitwarden ```toml [providers.bitwarden] type = "bitwarden" # Requires Bitwarden CLI (bw) installed and unlocked ``` ### Bitwarden Secrets ```toml [secrets] STRIPE_KEY = { provider = "bitwarden", value = "item-id/field-name" } ``` ## Provider Testing ### Test Provider Configuration ```bash # Test specific provider fnox provider test age fnox provider test aws-sm # List configured providers fnox provider list # Add provider interactively fnox provider add # Remove provider fnox provider remove age ``` ## Best Practices ### Choose the Right Provider ```toml # Development: age (simple, local encryption) [providers.age] type = "age" public_keys = ["age1ql3z..."] # Production: Cloud secret manager [providers.aws-sm] type = "aws-sm" region = "us-east-1" # Team collaboration: 1Password or Bitwarden [providers.onepassword] type = "1password" ``` ### Use Multiple Providers ```toml # Different providers for different secrets [providers.age] type = "age" public_keys = ["age1ql3z..."] [providers.aws-sm] type = "aws-sm" region = "us-east-1" [secrets] # Development secrets with age DEV_API_KEY = { provider = "age", value = "age[...]" } # Production secrets with AWS PROD_DATABASE_URL = { provider = "aws-sm", value = "prod/db-url" } ``` ### Provider Aliases ```toml # Name providers descriptively [providers.prod-secrets] type = "aws-sm" region = "us-east-1" [providers.staging-secrets] type = "aws-sm" region = "us-west-2" [secrets] DATABASE_URL = { provider = "prod-secrets", value = "prod/db" } ``` ## Common Patterns ### Development to Production Migration ```toml # fnox.toml (development) [providers.age] type = "age" public_keys = ["age1ql3z..."] [secrets] DATABASE_URL = { provider = "age", value = "age[...]" } # fnox.production.toml [providers.aws-sm] type = "aws-sm" region = "us-east-1" [secrets] DATABASE_URL = { provider = "aws-sm", value = "prod/database-url" } ``` ### Multi-Region Setup ```toml [providers.us-secrets] type = "aws-sm" region = "us-east-1" [providers.eu-secrets] type = "aws-sm" region = "eu-west-1" [secrets] US_API_ENDPOINT = { provider = "us-secrets", value = "us/api-endpoint" } EU_API_ENDPOINT = { provider = "eu-secrets", value = "eu/api-endpoint" } ``` ### Hybrid Approach ```toml # Development secrets: age encryption [providers.age] type = "age" public_keys = ["age1ql3z..."] # Shared team secrets: 1Password [providers.team] type = "1password" # Production secrets: AWS [providers.prod] type = "aws-sm" region = "us-east-1" [secrets] DEV_DATABASE_URL = { provider = "age", value = "age[...]" } TEAM_SLACK_WEBHOOK = { provider = "team", value = "op://Team/Slack/webhook" } PROD_DATABASE_URL = { provider = "prod", value = "prod/db-url" } ``` ## Anti-Patterns ### Don't Hardcode Credentials ```toml # Bad: Hardcoded credentials [providers.aws-sm] type = "aws-sm" region = "us-east-1" access_key_id = "AKIAIOSFODNN7EXAMPLE" # NEVER DO THIS secret_access_key = "wJalrXUtnFEMI/..." # NEVER DO THIS # Good: Use AWS credentials chain [providers.aws-sm] type = "aws-sm" region = "us-east-1" # Credentials from ~/.aws/credentials or environment ``` ### Don't Mix Provider Types Unnecessarily ```toml # Bad: Too many providers for simple project [providers.age] type = "age" [providers.aws-sm] type = "aws-sm" [providers.azure] type = "azure-kv" [providers.gcp] type = "gcp-sm" # Good: Choose one appropriate provider [providers.age] type = "age" public_keys = ["age1ql3z..."] ``` ### Don't Share Private Keys ```toml # Bad: Private key in config [providers.age] identity = "AGE-SECRET-KEY-..." # NEVER COMMIT THIS # Good: Reference external file [providers.age] identity = "~/.config/fnox/keys/identity.txt" # Gitignored ``` ## Provider-Specific Features ### Age: Multiple Recipients ```toml [providers.age] type = "age" public_keys = [ "age1ql3z...", # Team member 1 "age1qw4r...", # Team member 2 "age1qx5t...", # CI/CD system ] ``` ### AWS: Cross-Account Access ```toml [providers.shared-secrets] type = "aws-sm" region = "us-east-1" role_arn = "arn:aws:iam::123456789012:role/CrossAccountSecretsRole" ``` ### Vault: Namespace Support ```toml [providers.vault-prod] type = "vault" address = "https://vault.example.com" namespace = "production" token = { env = "VAULT_TOKEN" } ``` ## Related Skills - **configuration**: Managing fnox.toml structure and secrets - **security-best-practices**: Security guidelines for providers --- Source attribution: TheBushidoCollective Original project: https://github.com/TheBushidoCollective/han/blob/19caa51d5fd144ef6b2764f2332f4c856aa5d1af/plugins/specialized/fnox/skills/providers/SKILL.md License: Apache-2.0 License information: https://www.apache.org/licenses/LICENSE-2.0 Original upstream instructions; downloaded from Mega AI Hub. ## Upstream license notice # Functional Source License, Version 1.1, ALv2 Future License ## Abbreviation FSL-1.1-ALv2 ## Notice Copyright 2025 The Bushido Collective ## Terms and Conditions ### Licensor ("We") The party offering the Software under these Terms and Conditions. ### The Software The "Software" is each version of the software that we make available under these Terms and Conditions, as indicated by our inclusion of these Terms and Conditions with the Software. ### License Grant Subject to your compliance with this License Grant and the Patents, Redistribution and Trademark clauses below, we hereby grant you the right to use, copy, modify, create derivative works, publicly perform, publicly display and redistribute the Software for any Permitted Purpose identified below. ### Permitted Purpose A Permitted Purpose is any purpose other than a Competing Use. A Competing Use means making the Software available to others in a commercial product or service that: 1. substitutes for the Software; 2. substitutes for any other product or service we offer using the Software that exists as of the date we make the Software available; or 3. offers the same or substantially similar functionality as the Software. Permitted Purposes specifically include using the Software: 1. for your internal use and access; 2. for non-commercial education; 3. for non-commercial research; and 4. in connection with professional services that you provide to a licensee using the Software in accordance with these Terms and Conditions. ### Patents To the extent your use for a Permitted Purpose would necessarily infringe our patents, the license grant above includes a license under our patents. If you make a claim against any party that the Software infringes or contributes to the infringement of any patent, then your patent license to the Software ends immediately. ### Redistribution The Terms and Conditions apply to all copies, modifications and derivatives of the Software. If you redistribute any copies, modifications or derivatives of the Software, you must include a copy of or a link to these Terms and Conditions and not remove any copyright notices provided in or with the Software. ### Disclaimer THE SOFTWARE IS PROVIDED "AS IS" AND WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF FITNESS FOR A PARTICULAR PURPOSE, MERCHANTABILITY, TITLE OR NON-INFRINGEMENT. IN NO EVENT WILL WE HAVE ANY LIABILITY TO YOU ARISING OUT OF OR RELATED TO THE SOFTWARE, INCLUDING INDIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES, EVEN IF WE HAVE BEEN INFORMED OF THEIR POSSIBILITY IN ADVANCE. ### Trademarks Except for displaying the License Details and identifying us as the origin of the Software, you have no right under these Terms and Conditions to use our trademarks, trade names, service marks or product names. ## Grant of Future License We hereby irrevocably grant you an additional license to use the Software under the Apache License, Version 2.0 that is effective on the second anniversary of the date we make the Software available. On or after that date, you may use the Software under the Apache License, Version 2.0, in which case the following will apply: Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. # Mega AI Hub resource metadata Creator / publisher: TheBushidoCollective Original project: https://github.com/TheBushidoCollective/han/blob/19caa51d5fd144ef6b2764f2332f4c856aa5d1af/plugins/specialized/fnox/skills/providers/SKILL.md Attribution basis: Source repository record Fields of work: Development & Engineering Roles: Backend Developer, DevOps / SRE, Security Engineer Specialties: API, Backend Tools: AWS, Azure, GCP, 1Password, Bitwarden, Vault Country applicability: Country not specified Classification basis: Source catalog labels Instruction SHA-256: 1a81475e15876c3a0dc3128be685dbd42f658b93445c89e91136d418957807e1