Search Documentation

Search for pages and headings in the documentation

Security & secrets

This configuration enforces strict security measures.

  • Secrets Management: Secrets are SOPS-encrypted and stored under secrets/. Access to sensitive directories (e.g. ~/.ssh, ~/.gnupg) is restricted.
  • Path Guard: the path-guard.ts extension enforces a path allowlist/denylist for file-access tools (read, write, edit) and bash commands.
  • Model Routing: providers and models are configured in pi-models.json (see models.mdx).
  • Cost Tracking: extensions track token usage and cost across providers (see extensions.mdx).
  • Hardening: modules/hardening.nix installs vulnix and trivy, sets a restrictive UMASK, and tightens shell-history permissions. It also defines sec-scan, trivy-scan, and sec-update shell aliases.

Secrets

Secrets are stored as SOPS-encrypted YAML files under secrets/ and decrypted at activation time by sops-nix.

To edit a secret you need your age private key. SOPS searches several locations via env vars; on this machine the key lives at ~/.config/sops/age/keys.txt:

SOPS_AGE_KEY_FILE=~/.config/sops/age/keys.txt sops secrets/filen.yaml
# to encrypt secrets and add metadata, and replace file
SOPS_AGE_KEY_FILE="$HOME/.config/sops/age/keys.txt" sops --encrypt --in-place secrets/anytype.yaml

SOPS decrypts the file, opens it in $EDITOR, and re-encrypts on save. After editing, re-run home-manager switch so activation scripts pick up the new values.

Filen credentials

secrets/filen.yaml holds the email and password keys used to authenticate filen-cli. modules/shell.nix exports them as FILEN_CLI_EMAIL and FILEN_CLI_PASSWORD at shell startup (the Rust filen-cli reads these env vars). The old Node CLI’s ~/.filen-cli/.filen-cli-credentials file is no longer used.

Anytype credentials

secrets/anytype.yaml holds the apiKey and workspaceId keys used by the Anytype integration. They are declared in modules/ai.nix and exported as ANYTYPE_API_KEY and ANYTYPE_WORKSPACE by modules/shell.nix for use by the pi extension. See the Anytype integration.

The path-guard extension

pi-extensions/path-guard/ enforces a read/write allowlist and denylist for agent tool calls. It blocks environment dumps and secret-named variable reads, and redacts leaked secret values from tool output. In a Firstmate session (the ~/firstmate home or a worker it launches) the outside-cwd confirmation for reads and bash under $HOME is skipped; the denylist still applies.

Other security-adjacent extensions

  • pi-extensions/curl/ restricts HTTP requests to a configured allowlist of domains and paths (see extensions.mdx).
  • pi-extensions/credential-leak/ scans session transcripts for leaked credentials and redacts leaked secret values.
  • pi-extensions/azure-guard/ blocks Azure/Microsoft 365 tools in unattended Firstmate sessions (see extensions.mdx).