dotfiles/flakes/secrets-bao/readme.md

• Create machine in zitadel and generate a key. Put that at /machine-key.json
• sudo chmod

CLI

If ringofstorms.secretsBao.enable = true, you also get a sec helper.

It reads /run/openbao/* files, so it will sudo itself if needed.

• sec <kv-path> [field] reads a field (default: value) from KV v2.
• It reuses /run/openbao/vault-agent.token when available, otherwise it logs in via the same jwt auth mount path using /run/openbao/zitadel.jwt.

Example:

• sec machines/home_roaming/test value