GitLab Stack Secrets Manager

If you're running GitLab stack projects with Docker and tired of secrets leaking into .env files or getting committed to repos, this handles the migration to Docker secrets properly. It'll audit your current setup, catch exposures in git, generate secure random values, and help you rotate credentials without breaking things. The skill enforces the core principle of keeping secrets out of compose files and environment variables entirely. Useful when you're inheriting a project with secrets sprawled everywhere or setting up a new stack and want to get the security model right from the start. Saves you from writing the same secret validation scripts again.

GitHub stars: 58
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add rknall/claude-skills --skill 'GitLab Stack Secrets Manager' --agent claude-code

Installs into .claude/skills of the current project.

Files

GitLab Stack Secrets Manager

This skill manages secrets for GitLab stack projects, ensuring secrets are stored securely, never exposed in configuration files, and properly integrated with Docker secrets.

When to Use This Skill

Activate this skill when the user requests:

Create or manage Docker secrets
Migrate environment variables to Docker secrets
Validate secret configuration and permissions
Audit secret usage and detect leaks
Ensure secrets aren't in .env or docker-compose.yml
Check if secrets are exposed in git
Generate secure random secrets
Rotate existing secrets
Fix secret-related security issues

Core Security Principles

CRITICAL RULES - Never violated:

No Secrets in .env: Secrets MUST NEVER be in .env file
No Secrets in docker-compose.yml: No plaintext secrets in environment variables
./secrets Directory: All secrets in ./secrets with 700 permissions
Secret Files: Individual files with 600 permissions
Git Protection: ./secrets/* in .gitignore, never committed
Proper Ownership: All files owned by Docker user (not root)
Docker Secrets Only: Use Docker secrets mechanism exclusively