jm-secrets

Clients for the secrets server at https://secrets.jmalinowski.cc. Current version: 0.2.2.

If you are an agent working on a machine that needs a credential, this page is everything you need. No GitHub account or token is required to download anything here.

Install the CLI

curl -fsSL https://dl.jmalinowski.cc/cli/install.sh | bash

Installs jm-secrets-manager into a bin directory you already keep (~/.bin, ~/bin or ~/.local/bin), verifies the download against SHA256SUMS, and installs a Claude Code skill so agents on the machine discover the CLI on their own. Re-running when already current does nothing.

Then set two environment variables in your shell profile:

export JM_SECRETS_ENDPOINT=https://secrets.jmalinowski.cc
export JM_SECRETS_TOKEN=jm_secrets_...   # ask the user for this
jm-secrets-manager health

Using it

Every command prints JSON on stdout, so pipe it to jq.

jm-secrets-manager secrets list                       # inventory, no values
jm-secrets-manager secrets list --meta env=prod      # filter on metadata
jm-secrets-manager secrets read <id>                 # returns the value
jm-secrets-manager version                           # works without a token
Handling values. Prefer secrets list over secrets read: list answers most questions — what exists, which environment, when it changed — without putting a credential anywhere. When you do need a value, pipe it straight where it is needed rather than printing it. Never echo a secret back to the user, never write one into a git-tracked file, a log or a commit message. Note that create and update echo the value back too.

Terraform provider

Add this to your Terraform CLI config (~/.terraformrc, or %APPDATA%\terraform.rc): 

provider_installation {
  network_mirror {
    url     = "https://dl.jmalinowski.cc/tf/"
    include = ["registry.terraform.io/jmalinowski/*"]
  }
  direct {
    exclude = ["registry.terraform.io/jmalinowski/*"]
  }
}

The include/exclude pair matters: provider_installation replaces the default for every provider, so without it Terraform would look for hashicorp/aws here too and fail.

Then declare it as usual and run terraform init:

terraform {
  required_providers {
    jmsecrets = {
      source  = "jmalinowski/jmsecrets"
      version = "0.2.2"
    }
  }
}

provider "jmsecrets" {}

The provider reads JM_SECRETS_ENDPOINT and JM_SECRETS_TOKEN from the environment, same as the CLI.

What is here

Path Contents
/cli/install.sh The installer above
/cli/latest Latest version, as plain text
/cli/0.2.2/ Tarballs for darwin and linux, amd64 and arm64, plus SHA256SUMS
/cli/SKILL.md The Claude Code skill, if you want to install it by hand
/tf/ Terraform provider network mirror

Access

Downloads are public; the secrets themselves are not. Every call to the server needs a bearer token, and a token only reaches secrets covered by a grant — a (read|write, metadata filter) pair. An empty secrets list usually means "no grants", not "no secrets". Ask the user for a token; do not try to mint one.