# Announcing SecretSpec: Declarative Secrets Management
**URL:** https://discourse.nixos.org/t/announcing-secretspec-declarative-secrets-management/67021
**Category:** Announcements
**Created:** [July 21, 2025, 5:38pm UTC](https://discourse.nixos.org/t/announcing-secretspec-declarative-secrets-management/67021 "2025-07-21T17:38:54Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@domenkozar](https://discourse.nixos.org/u/domenkozar)
#### Post date: [July 21, 2025, 5:38pm UTC](https://discourse.nixos.org/t/announcing-secretspec-declarative-secrets-management/67021/1 "2025-07-21T17:38:54Z")
> **[Announcing SecretSpec: Declarative Secrets Management - devenv](https://devenv.sh/blog/2025/07/21/announcing-secretspec-declarative-secrets-management/)**
>
> Fast, Declarative, Reproducible, and Composable Developer Environments using Nix
---
### Author:  [@cafkafk](https://discourse.nixos.org/u/cafkafk)
#### Post date: [July 21, 2025, 6:21pm UTC](https://discourse.nixos.org/t/announcing-secretspec-declarative-secrets-management/67021/2 "2025-07-21T18:21:19Z")
I’ve skimmed this and it looks genuinely impressive, multiple providers and a Rust SDK is a very good place to start.
Is there plans to add support for Nix(OS) for SecretSpec? E.g. a module that functions similar to something like [sops-nix](https://github.com/Mic92/sops-nix) would make this very useful for deploying infrastructure, being able to easily provision testing/staging/production secrets just by changing what profile to use could be a powerful abstraction for these kinds of systems.
---
### Author:  [@domenkozar](https://discourse.nixos.org/u/domenkozar)
#### Post date: [July 21, 2025, 6:36pm UTC](https://discourse.nixos.org/t/announcing-secretspec-declarative-secrets-management/67021/3 "2025-07-21T18:36:29Z")
Thanks! I think the first step is to [support sops as a provider](https://github.com/cachix/secretspec/issues/5) and then we can look into possible replacements 🙂
---
### Author:  [@teto](https://discourse.nixos.org/u/teto)
#### Post date: [July 21, 2025, 7:52pm UTC](https://discourse.nixos.org/t/announcing-secretspec-declarative-secrets-management/67021/4 "2025-07-21T19:52:19Z")
cool ! for a tool with a different philosophy, aka fetching from several providers without the ability to specify one, check out [GitHub - PierreBeucher/novops: Cross-platform secret & config manager for development and CI environments](https://github.com/PierreBeucher/novops/) .
---
### Author:  [@srd424](https://discourse.nixos.org/u/srd424)
#### Post date: [July 22, 2025, 7:53am UTC](https://discourse.nixos.org/t/announcing-secretspec-declarative-secrets-management/67021/5 "2025-07-22T07:53:23Z")
Definitely very interesting, and some decent tooling in this space is long overdue. I’m under caffeinated at the moment, but my instinct is some integration with systemd secrets management might be useful, and might help with “native” deployment of services on nixos.
---
### Author:  [@domenkozar](https://discourse.nixos.org/u/domenkozar)
#### Post date: [July 24, 2025, 2:56am UTC](https://discourse.nixos.org/t/announcing-secretspec-declarative-secrets-management/67021/6 "2025-07-24T02:56:47Z")
Happy to see someone explore that!
I’m going to focus first on multiple providers and generating secrets, while supporting community contributions for any provider.
---
### Author:  [@con-f-use](https://discourse.nixos.org/u/con-f-use)
#### Post date: [September 22, 2025, 6:20am UTC](https://discourse.nixos.org/t/announcing-secretspec-declarative-secrets-management/67021/7 "2025-09-22T06:20:12Z")
If I could request two providers, it would be [gopass](https://www.gopass.pw/) and [vault](https://www.hashicorp.com/en/products/vault) / [openbao](https://github.com/openbao/openbao). I also second the system-secrets integration.
---
### Author:  [@domenkozar](https://discourse.nixos.org/u/domenkozar)
#### Post date: [September 22, 2025, 10:06am UTC](https://discourse.nixos.org/t/announcing-secretspec-declarative-secrets-management/67021/8 "2025-09-22T10:06:11Z")
Could you open issues on [GitHub - cachix/secretspec: Declarative secrets, every environment, any provider.](https://github.com/cachix/secretspec) (or upvote if they already exist)? That way it’s easier to know what’s next, thank you 🙂
---
### Author:  [@con-f-use](https://discourse.nixos.org/u/con-f-use)
#### Post date: [September 22, 2025, 11:16am UTC](https://discourse.nixos.org/t/announcing-secretspec-declarative-secrets-management/67021/9 "2025-09-22T11:16:24Z")
Done:
>
>
> https://openbao.org/
>
>
> https://www.passwordstore.org/
>
>
> \[Systemd-credentials\](https://systemd.io/CREDENTIALS/) are a way to securely sto…re passwords on a machine. The machines TPM (or software stand-in) handles encryption while systemd handles access management on the machine.
>
> The mechanism is already used by many NixOS modules, e.g. \[forgejo\](https://github.com/NixOS/nixpkgs/blob/50177cbee811f57de236a20c10ff29cc3e3f348a/nixos/modules/services/misc/forgejo.nix#L779)
I invite anybody reading this to add info or make a PR 😉