nuxt-env

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

nuxt-env

Set up SOPS + age encryption for environment variables in a Nuxt project.

为Nuxt项目中的环境变量配置SOPS + age加密方案。

When to Use

适用场景

Setting up encrypted environment variable management for a project
Adding SOPS + age encryption workflow
User mentions
```
env:pull
```
,
```
env:push
```
,
```
env:encrypt
```
,
```
env:decrypt
```
Onboarding a project to the encrypted env bundle workflow

为项目配置加密的环境变量管理方案
添加SOPS + age加密工作流
用户提及
```
env:pull
```
、
```
env:push
```
、
```
env:encrypt
```
、
```
env:decrypt
```
时
为项目接入加密环境变量包工作流的新手上路场景

Pre-flight: System Dependencies

前置检查：系统依赖

Check and install system dependencies in order:

按顺序检查并安装系统依赖：

1. sops + age

bash

which sops && which age-keygen

If either is missing:

bash

brew install sops age

bash

which sops && which age-keygen

如果两者有缺失：

bash

brew install sops age

2. npm dependencies

2. npm依赖

Check if

chalk

is in the target project's

devDependencies

. If missing:

bash

bun add -d chalk

检查目标项目的

devDependencies

中是否包含

chalk

，如果缺失：

bash

bun add -d chalk

3. Age keypair

3. Age密钥对

Check if the age key file exists:

bash

test -f ~/.config/sops/age/keys.txt

If missing, generate one:

bash

mkdir -p ~/.config/sops/age
age-keygen -o ~/.config/sops/age/keys.txt

Display the public key to the user (they will need it for

.sops.yaml

bash

age-keygen -y ~/.config/sops/age/keys.txt

Tell the user to save this public key -- it goes into

.sops.yaml

and must be shared with teammates.

检查age密钥文件是否存在：

bash

test -f ~/.config/sops/age/keys.txt

如果缺失则生成：

bash

mkdir -p ~/.config/sops/age
age-keygen -o ~/.config/sops/age/keys.txt

向用户展示公钥（用户需要将其添加到

.sops.yaml

中）：

bash

age-keygen -y ~/.config/sops/age/keys.txt

告知用户保存此公钥——它需要写入

.sops.yaml

，且必须共享给团队成员。

Setup Steps

配置步骤

Run these steps in the target project root.

在目标项目根目录执行以下步骤：

1. Create directories

1. 创建目录

bash

mkdir -p secrets .tmp

bash

mkdir -p secrets .tmp

2. Add .gitignore entries

2. 添加.gitignore条目

Append to the project root

.gitignore

if not already present:

.tmp/

Ensure

secrets/

has proper git tracking -- encrypted files ARE tracked, plain JSON is NOT. Add

secrets/.gitignore

with:

undefined

如果项目根目录的

.gitignore

中不存在以下内容则追加：

.tmp/

确保

secrets/

目录有正确的git追踪规则——加密文件会被追踪，纯JSON文件不会被追踪。在

secrets/.gitignore

中添加以下内容：

undefined

Ignore decrypted plain JSON bundles

*.json

But track encrypted sops files

!*.sops.json !.gitignore !.gitkeep


Create `secrets/.gitkeep` if the directory is empty.

!*.sops.json !.gitignore !.gitkeep


如果目录为空，创建`secrets/.gitkeep`。

3. Create

.sops.yaml

3. 创建

.sops.yaml

Skip if
.sops.yaml
already exists. Otherwise create at project root:

yaml

undefined

如果
.sops.yaml
已存在则跳过，否则在项目根目录创建：

yaml

undefined

Replace the placeholder recipients below with real age public keys (age1...)

for your developer team and CI before encrypting secrets.

creation_rules: - path_regex: ^(.+[\/])?secrets[\/].*.sops.json$ age: >- AGE_PUBLIC_KEY_HERE


Prompt the user to replace `AGE_PUBLIC_KEY_HERE` with the public key displayed in pre-flight step 3. If the public key was just generated, offer to substitute it automatically.

creation_rules: - path_regex: ^(.+[\/])?secrets[\/].*.sops.json$ age: >- AGE_PUBLIC_KEY_HERE


提示用户将`AGE_PUBLIC_KEY_HERE`替换为前置检查第3步中展示的公钥。如果公钥是刚生成的，可提供自动替换功能。

4. Copy scripts

4. 复制脚本

Copy these files from this skill's

scripts/

directory to the target project's

scripts/

directory:

Source (skill)	Target (project)
`scripts/sops-bundle.ts`	`scripts/sops-bundle.ts`
`scripts/env-variables.ts`	`scripts/env-variables.ts`
`scripts/libs/load-env.ts`	`scripts/libs/load-env.ts`

Create

scripts/libs/

if it doesn't exist. Skip any file that already exists in the target -- warn the user instead.

将本skill的

scripts/

目录下的这些文件复制到目标项目的

scripts/

来源（skill）	目标（项目）
`scripts/sops-bundle.ts`	`scripts/sops-bundle.ts`
`scripts/env-variables.ts`	`scripts/env-variables.ts`
`scripts/libs/load-env.ts`	`scripts/libs/load-env.ts`

如果

scripts/libs/

不存在则创建。目标位置已存在的文件请跳过，并向用户发出警告。

5. Add package.json scripts

5. 添加package.json脚本

Read the target project's

package.json

. Add the following scripts, skipping any that already exist:

json

{
    "env:export": "bun scripts/env-variables.ts --export-json --out .tmp/env-bundle.json",
    "env:apply": "bun scripts/env-variables.ts --import-json --in .tmp/env-bundle.json",
    "env:apply:dry": "bun scripts/env-variables.ts --import-json --in .tmp/env-bundle.json --dry-run",
    "env:decrypt": "bun scripts/sops-bundle.ts decrypt",
    "env:encrypt": "bun scripts/sops-bundle.ts encrypt",
    "env:pull": "bun run env:decrypt && bun run env:apply",
    "env:push": "bun run env:export && bun run env:encrypt"
}

读取目标项目的

package.json

，添加以下脚本，已存在的脚本请跳过：

json

{
    "env:export": "bun scripts/env-variables.ts --export-json --out .tmp/env-bundle.json",
    "env:apply": "bun scripts/env-variables.ts --import-json --in .tmp/env-bundle.json",
    "env:apply:dry": "bun scripts/env-variables.ts --import-json --in .tmp/env-bundle.json --dry-run",
    "env:decrypt": "bun scripts/sops-bundle.ts decrypt",
    "env:encrypt": "bun scripts/sops-bundle.ts encrypt",
    "env:pull": "bun run env:decrypt && bun run env:apply",
    "env:push": "bun run env:export && bun run env:encrypt"
}

Post-setup Verification

配置后验证

After all steps, verify:

```
which sops && which age-keygen
```
-- both installed

ls scripts/sops-bundle.ts scripts/env-variables.ts scripts/libs/load-env.ts

-- all scripts exist

```
package.json
```
has all
```
env:*
```
scripts
```
.sops.yaml
```
exists with correct structure
```
secrets/.gitignore
```
exists with correct rules
```
.tmp/
```
is in
```
.gitignore
```

Print a summary of what was created/skipped.

所有步骤完成后，验证以下内容：

```
which sops && which age-keygen
```
-- 两者均已安装

ls scripts/sops-bundle.ts scripts/env-variables.ts scripts/libs/load-env.ts

-- 所有脚本均存在

```
package.json
```
包含所有
```
env:*
```
脚本
```
.sops.yaml
```
存在且结构正确
```
secrets/.gitignore
```
存在且规则正确
```
.tmp/
```
已加入
```
.gitignore
```

打印已创建/跳过内容的汇总信息。

Usage After Setup

配置完成后使用说明

Command	What it does
`bun run env:push`	Export .env files to JSON bundle, then SOPS-encrypt
`bun run env:pull`	SOPS-decrypt the bundle, then write .env files
`bun run env:encrypt`	Encrypt `.tmp/env-bundle.json` to `secrets/env-bundle.sops.json`
`bun run env:decrypt`	Decrypt `secrets/env-bundle.sops.json` to `.tmp/env-bundle.json`
`bun run env:export`	Export .env files to `.tmp/env-bundle.json`
`bun run env:apply`	Write `.tmp/env-bundle.json` back to .env files

命令	功能
`bun run env:push`	导出.env文件为JSON包，然后通过SOPS加密
`bun run env:pull`	SOPS解密包，然后写入.env文件
`bun run env:encrypt`	加密 `.tmp/env-bundle.json` 为 `secrets/env-bundle.sops.json`
`bun run env:decrypt`	解密 `secrets/env-bundle.sops.json` 为 `.tmp/env-bundle.json`
`bun run env:export`	导出.env文件到 `.tmp/env-bundle.json`
`bun run env:apply`	将 `.tmp/env-bundle.json` 内容写回.env文件

nuxt-env

Original

Translation

nuxt-env

nuxt-env

When to Use

适用场景

Pre-flight: System Dependencies

前置检查：系统依赖

1. sops + age

1. sops + age

2. npm dependencies

2. npm依赖

3. Age keypair

3. Age密钥对

Setup Steps

配置步骤

1. Create directories

1. 创建目录

2. Add .gitignore entries

2. 添加.gitignore条目

Ignore decrypted plain JSON bundles

Ignore decrypted plain JSON bundles

But track encrypted sops files

But track encrypted sops files

3. Create
`.sops.yaml`

3. 创建
`.sops.yaml`

Replace the placeholder recipients below with real age public keys (age1...)

Replace the placeholder recipients below with real age public keys (age1...)

for your developer team and CI before encrypting secrets.

for your developer team and CI before encrypting secrets.

4. Copy scripts

4. 复制脚本

5. Add package.json scripts

5. 添加package.json脚本

Post-setup Verification

配置后验证

Usage After Setup

配置完成后使用说明

nuxt-env

Original

Translation

nuxt-env

nuxt-env

When to Use

适用场景

Pre-flight: System Dependencies

前置检查：系统依赖

1. sops + age

1. sops + age

2. npm dependencies

2. npm依赖

3. Age keypair

3. Age密钥对

Setup Steps

配置步骤

1. Create directories

1. 创建目录

2. Add .gitignore entries

2. 添加.gitignore条目

Ignore decrypted plain JSON bundles

Ignore decrypted plain JSON bundles

But track encrypted sops files

But track encrypted sops files

3. Create .sops.yaml

3. 创建.sops.yaml

Replace the placeholder recipients below with real age public keys (age1...)

Replace the placeholder recipients below with real age public keys (age1...)

for your developer team and CI before encrypting secrets.

for your developer team and CI before encrypting secrets.

4. Copy scripts

4. 复制脚本

5. Add package.json scripts

5. 添加package.json脚本

Post-setup Verification

配置后验证

Usage After Setup

配置完成后使用说明

3. Create
`.sops.yaml`

3. 创建
`.sops.yaml`