# Secrets Don’t Belong in Config

**URL:** https://discourse.nixos.org/t/secrets-don-t-belong-in-config/79078
**Category:** Links
**Created:** [July 21, 2026, 12:02am UTC](https://discourse.nixos.org/t/secrets-don-t-belong-in-config/79078 "2026-07-21T00:02:22Z")
**Posts on this page:** 1
**Showing post:** 40

<div class="post-metadata">

### Author: ![domenkozar](https://discourse.nixos.org/user_avatar/discourse.nixos.org/domenkozar/32/38357_2.png) [@domenkozar](https://discourse.nixos.org/u/domenkozar)
#### Post date: [August 26, 2026, 1:08pm UTC](https://discourse.nixos.org/t/secrets-don-t-belong-in-config/79078/40 "2026-08-26T13:08:24Z")

</div>

The idea of secretspec is to fix it upstream.

We’ve since [created IPC for resolver and provider](https://github.com/cachix/secretspec/pull/362) that [Nix will use](https://github.com/NixOS/nix/pull/16300).

We provide integrations for [docker](https://secretspec.dev/integrations/docker/) and [git](https://secretspec.dev/integrations/git/) using existing credentials helpers but those protocols are subpar.

There’s also [devenv machines](https://github.com/cachix/devenv/pull/3073) which allows you to use secretspec when provisioning NixOS machines.

Fixing upstream software will take time, but with integrations guides and coding agents these days it’s not that much work.

---

_[View the full topic](https://discourse.nixos.org/t/secrets-don-t-belong-in-config/79078)._