Skip to content
Kitsy Docs Open CNOS
Kitsy Docs

Secrets and Vaults

Secrets and Vaults

Local vault:

Terminal window
cnos vault create default
cnos vault auth default
cnos secret set app.token super-secret --vault default

cnos vault create default initializes the local encrypted vault immediately. If CNOS cannot resolve a passphrase from env or keychain, it prompts interactively. cnos vault auth default is only for re-authenticating an existing vault and rejects wrong passphrases.

CI-backed vault:

Terminal window
cnos vault create github-ci --provider github-secrets --no-passphrase
cnos secret set app.token APP_TOKEN --vault github-ci

By default:

  • repo files store only refs
  • local secret material stays outside the repo
  • reads are masked unless --reveal is explicitly requested