secrets

a secret moves in three steps: declare it once in your account store, attach it to a machine at creation, and ix materializes it inside the guest at boot. values are write-only: they go in through set and are never shown back.

declare

$ix secret set gh_token

the value comes from a hidden prompt, stdin, or --value-file: never from the command line, so it never lands in your shell history. run the same command again to rotate the value.

attach

$ix new --secret-env gh_token$ix new --secret-file gh_token

a secret reaches only the machines you attach it to. --secret-env delivers it as an environment variable named after the secret. --secret-file lands it as a file under /run/secrets. repeat either flag for several secrets.

manage

$ix secret ls$ix secret check gh_token npm_token$ix secret rm gh_token

list shows names and metadata only, never values. check exits non-zero naming any missing secrets, so deploy tooling can fail fast before any work starts. rm deletes from the store. machines that already attached the secret keep their copy.

rotation reaches new machines only

an attached copy is materialized at boot and stays as it was. after you rotate a value with ix secret set, recreate the machine to pick up the new value.