Secret management via dotenvx for all cloud providers (Cloudflare, Azure, AWS) and Terraform Cloud
Manages cloud provider secrets via dotenvx for Cloudflare, AWS, and Terraform Cloud.
/plugin marketplace add The-HOLE-Foundation/claude-plugins/plugin install the-hole-foundation-hole-infrastructure-hole-infrastructure@The-HOLE-Foundation/claude-pluginsThis skill inherits all available tools. When active, it can use any tool Claude has access to.
ALL HOLE Foundation cloud provider credentials are stored in dotenvx (centralized, encrypted secret management).
dotenvx Location: /Volumes/HOLE-RAID-DRIVE/dotenvx
Version: v1.51.4
Encryption: Yes (encrypted at rest)
Audit: Yes (docs/AUDIT_LOG.md)
| Secret Name | Type | Length | Used By |
|---|---|---|---|
CLOUDFLARE_API_TOKEN | API Token | 40 chars | Terraform, cf-terraforming, Wrangler |
Value: Nrgt3EdfAj5JbnEu-AH_79Qg5LiKpRu8TZNwh8aj
Loading:
cd /Volumes/HOLE-RAID-DRIVE/dotenvx
dotenvx get CLOUDFLARE_API_TOKEN
Environment Variables (for Terraform):
export CF_API_TOKEN="$(dotenvx get CLOUDFLARE_API_TOKEN)"
export TF_VAR_cloudflare_api_token="$CF_API_TOKEN"
Auto-loaded by:
terraform/cloudflare/foundation/tf-with-dotenvx.shterraform/cloudflare/foundation/import-with-dotenvx.sh| Secret Name | Type | Used By |
|---|---|---|
AWS_ACCESS_KEY_ID | Access Key | Terraform, AWS CLI, SDKs |
AWS_SECRET_ACCESS_KEY | Secret Key | Terraform, AWS CLI, SDKs |
Loading:
cd /Volumes/HOLE-RAID-DRIVE/dotenvx
export AWS_ACCESS_KEY_ID=$(dotenvx get AWS_ACCESS_KEY_ID)
export AWS_SECRET_ACCESS_KEY=$(dotenvx get AWS_SECRET_ACCESS_KEY)
Terraform Variables:
export TF_VAR_aws_access_key="$AWS_ACCESS_KEY_ID"
export TF_VAR_aws_secret_key="$AWS_SECRET_ACCESS_KEY"
Account: 420073135340 Region: us-east-1
Authentication Method: Azure CLI (not dotenvx)
Current Login: joe@theholetruth.org
Verification:
az account show
Re-authenticate (if needed):
az login
az account set --subscription "de602062-dafa-4c8b-91b7-98a75bcd7cff"
No secret in dotenvx - Azure uses interactive browser login with cached credentials.
| Secret Name | Type | Used By |
|---|---|---|
TF_CLOUD_TOKEN | API Token | Terraform Cloud API, terraform-mcp-server |
Stored in: dotenvx (TBD - may need to add)
Creating Token:
cd /Volumes/HOLE-RAID-DRIVE/dotenvx
dotenvx set TF_CLOUD_TOKEN "your-token"
File: terraform/cloudflare/foundation/tf-with-dotenvx.sh
#!/bin/bash
# Automatically loads secrets and runs Terraform
export CF_API_TOKEN=$(cd /Volumes/HOLE-RAID-DRIVE/dotenvx && dotenvx get CLOUDFLARE_API_TOKEN)
export TF_VAR_cloudflare_api_token="$CF_API_TOKEN"
terraform "$@"
Usage:
./tf-with-dotenvx.sh plan
./tf-with-dotenvx.sh apply
Benefits:
# Load secrets
cd /Volumes/HOLE-RAID-DRIVE/dotenvx
export AWS_ACCESS_KEY_ID=$(dotenvx get AWS_ACCESS_KEY_ID)
export AWS_SECRET_ACCESS_KEY=$(dotenvx get AWS_SECRET_ACCESS_KEY)
export TF_VAR_aws_access_key="$AWS_ACCESS_KEY_ID"
export TF_VAR_aws_secret_key="$AWS_SECRET_ACCESS_KEY"
# Use Terraform
cd /path/to/workspace
terraform plan
When to use: AWS doesn't have a wrapper script yet (could create one)
Azure CLI provides authentication - no explicit secret loading needed.
# Just verify authentication
az account show
# Then use Terraform
terraform plan
cd /Volumes/HOLE-RAID-DRIVE/dotenvx
# List all secrets (as JSON)
dotenvx get --all
# Get specific secret
dotenvx get CLOUDFLARE_API_TOKEN
dotenvx get AWS_ACCESS_KEY_ID
cd /Volumes/HOLE-RAID-DRIVE/dotenvx
# Add or update secret
dotenvx set SECRET_NAME "secret-value"
# Example: Rotate Cloudflare token
dotenvx set CLOUDFLARE_API_TOKEN "new-token-here"
When rotating any secret:
dotenvx set SECRET_NAME "new-value"
echo "$(date): Rotated SECRET_NAME" >> docs/AUDIT_LOG.md
Different tools expect different variable names:
| Tool | Variable Name | Value From |
|---|---|---|
| cf-terraforming | CF_API_TOKEN | dotenvx get CLOUDFLARE_API_TOKEN |
| Terraform provider | TF_VAR_cloudflare_api_token | dotenvx get CLOUDFLARE_API_TOKEN |
| Wrangler | CLOUDFLARE_API_TOKEN | dotenvx get CLOUDFLARE_API_TOKEN |
Solution: Export all three:
TOKEN=$(cd /Volumes/HOLE-RAID-DRIVE/dotenvx && dotenvx get CLOUDFLARE_API_TOKEN)
export CF_API_TOKEN="$TOKEN"
export TF_VAR_cloudflare_api_token="$TOKEN"
export CLOUDFLARE_API_TOKEN="$TOKEN"
| Tool | Variable Names | Value From |
|---|---|---|
| Terraform | TF_VAR_aws_access_key, TF_VAR_aws_secret_key | dotenvx get AWS_* |
| AWS CLI | AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY | dotenvx get AWS_* |
| AWS SDKs | AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY | dotenvx get AWS_* |
Solution: Export both sets:
export AWS_ACCESS_KEY_ID=$(cd /Volumes/HOLE-RAID-DRIVE/dotenvx && dotenvx get AWS_ACCESS_KEY_ID)
export AWS_SECRET_ACCESS_KEY=$(cd /Volumes/HOLE-RAID-DRIVE/dotenvx && dotenvx get AWS_SECRET_ACCESS_KEY)
export TF_VAR_aws_access_key="$AWS_ACCESS_KEY_ID"
export TF_VAR_aws_secret_key="$AWS_SECRET_ACCESS_KEY"
✅ Always load from dotenvx (single source of truth) ✅ Use wrapper scripts where available ✅ Export to env vars (not hardcode) ✅ Rotate secrets regularly (quarterly) ✅ Update audit log when changing secrets ✅ Use separate secrets for dev/prod (if applicable)
❌ Commit secrets to git
❌ Hardcode secrets in .tf files
❌ Echo secrets in scripts (use ${#VAR} for length only)
❌ Share secrets in chat/email
❌ Store secrets in plaintext outside dotenvx
❌ Use same secret across multiple accounts (if possible)
These files must be in .gitignore:
*.auto.tfvars
terraform.tfvars
.env
.env.keys
.env.vault
terraform.tfstate
terraform.tfstate.backup
Cloud Providers:
CLOUDFLARE_API_TOKEN - Cloudflare Foundation + Personal accountsAWS_ACCESS_KEY_ID - AWS Foundation account (420073135340)AWS_SECRET_ACCESS_KEY - AWS Foundation accountServices:
ANTHROPIC_API_KEY - Claude APIGREPTILE_API_KEY - Greptile MCPDATABASE_URL - Neon PostgreSQLAUTH0_DOMAIN, AUTH0_CLIENT_ID, AUTH0_CLIENT_SECRET - Auth0TURNSTILE_SECRET_KEY - Cloudflare TurnstileTotal: 13+ secrets across all services
Azure: Uses Azure CLI interactive authentication
Terraform Cloud: May need to add TF_CLOUD_TOKEN
#!/bin/bash
cd /Volumes/HOLE-RAID-DRIVE/dotenvx
SECRET=$(dotenvx get SECRET_NAME)
export SECRET
export TF_VAR_my_secret=$(cd /Volumes/HOLE-RAID-DRIVE/dotenvx && dotenvx get MY_SECRET)
terraform plan
import { exec } from 'child_process';
import { promisify } from 'util';
const execAsync = promisify(exec);
async function getSecret(name: string): Promise<string> {
const { stdout } = await execAsync(
`cd /Volumes/HOLE-RAID-DRIVE/dotenvx && dotenvx get ${name}`
);
return stdout.trim();
}
const token = await getSecret('CLOUDFLARE_API_TOKEN');
import subprocess
def get_secret(name):
result = subprocess.run(
['dotenvx', 'get', name],
cwd='/Volumes/HOLE-RAID-DRIVE/dotenvx',
capture_output=True,
text=True
)
return result.stdout.strip()
token = get_secret('CLOUDFLARE_API_TOKEN')
Instead of loading from dotenvx every time, secrets can be stored in Terraform Cloud workspace variables.
Via Terraform Cloud UI:
Via API (using script):
cd /Volumes/HOLE-RAID-DRIVE/Projects/hole-terraformer/terraform/cloudflare/foundation
export TF_CLOUD_TOKEN="your-token"
./set-tf-cloud-vars.sh "$(cd /Volumes/HOLE-RAID-DRIVE/dotenvx && dotenvx get CLOUDFLARE_API_TOKEN)"
Benefit: No need to load secrets locally Drawback: Secrets exist in two places (dotenvx + TF Cloud)
Recommendation: Use dotenvx + wrapper scripts (single source of truth)
1. Create new token:
2. Update dotenvx:
cd /Volumes/HOLE-RAID-DRIVE/dotenvx
dotenvx set CLOUDFLARE_API_TOKEN "new-token-here"
3. Test:
cd /Volumes/HOLE-RAID-DRIVE/Projects/hole-terraformer/terraform/cloudflare/foundation
./tf-with-dotenvx.sh plan
4. Revoke old token in Cloudflare Dashboard
5. Update audit log:
echo "$(date): Rotated CLOUDFLARE_API_TOKEN" >> /Volumes/HOLE-RAID-DRIVE/dotenvx/docs/AUDIT_LOG.md
1. Create new access key:
2. Update dotenvx:
cd /Volumes/HOLE-RAID-DRIVE/dotenvx
dotenvx set AWS_ACCESS_KEY_ID "new-key-id"
dotenvx set AWS_SECRET_ACCESS_KEY "new-secret-key"
3. Test:
export AWS_ACCESS_KEY_ID=$(dotenvx get AWS_ACCESS_KEY_ID)
export AWS_SECRET_ACCESS_KEY=$(dotenvx get AWS_SECRET_ACCESS_KEY)
aws sts get-caller-identity
4. Deactivate old key in AWS Console
5. Update audit log
Azure doesn't use dotenvx - re-authenticate via Azure CLI:
az logout
az login
az account set --subscription "de602062-dafa-4c8b-91b7-98a75bcd7cff"
Token stored by: Azure CLI (~/.azure/)
Location: terraform/cloudflare/foundation/tf-with-dotenvx.sh
What it does:
CLOUDFLARE_API_TOKEN from dotenvxCF_API_TOKEN and TF_VAR_cloudflare_api_tokenUsage:
./tf-with-dotenvx.sh plan
./tf-with-dotenvx.sh apply
./tf-with-dotenvx.sh state list
Could create: terraform/aws/foundation/tf-with-dotenvx.sh
#!/bin/bash
export AWS_ACCESS_KEY_ID=$(cd /Volumes/HOLE-RAID-DRIVE/dotenvx && dotenvx get AWS_ACCESS_KEY_ID)
export AWS_SECRET_ACCESS_KEY=$(cd /Volumes/HOLE-RAID-DRIVE/dotenvx && dotenvx get AWS_SECRET_ACCESS_KEY)
export TF_VAR_aws_access_key="$AWS_ACCESS_KEY_ID"
export TF_VAR_aws_secret_key="$AWS_SECRET_ACCESS_KEY"
terraform "$@"
Benefits: Same UX as Cloudflare wrapper
NEVER commit secrets to version control
NEVER echo secrets in scripts
# ❌ WRONG
echo "Token: $SECRET"
# ✅ CORRECT
echo "Token loaded (${#SECRET} chars)"
NEVER store in plaintext outside dotenvx
ALWAYS use environment variables for Terraform
# ✅ CORRECT
export TF_VAR_api_token="$(dotenvx get TOKEN)"
# ❌ WRONG
# Hardcoding in .tfvars file
ALWAYS audit secret access
Error: "Secret not found" when running dotenvx get
Solutions:
# 1. List all secrets
cd /Volumes/HOLE-RAID-DRIVE/dotenvx
dotenvx get --all
# 2. Check secret name (case-sensitive)
# Use exact name from list
# 3. Add secret if missing
dotenvx set SECRET_NAME "value"
Cloudflare:
# Verify token loaded
echo "CF_API_TOKEN length: ${#CF_API_TOKEN}"
echo "TF_VAR length: ${#TF_VAR_cloudflare_api_token}"
# Both should be 40
# Reload if needed
export CF_API_TOKEN=$(cd /Volumes/HOLE-RAID-DRIVE/dotenvx && dotenvx get CLOUDFLARE_API_TOKEN)
export TF_VAR_cloudflare_api_token="$CF_API_TOKEN"
AWS:
# Test credentials
aws sts get-caller-identity
# Should return account 420073135340
Azure:
# Verify authentication
az account show
# Should show subscription de602062...
Check:
Azure-specific:
# Switch subscription
az account set --subscription "de602062-dafa-4c8b-91b7-98a75bcd7cff"
#!/bin/bash
# Deploy across Cloudflare and AWS
set -e
echo "Loading secrets from dotenvx..."
cd /Volumes/HOLE-RAID-DRIVE/dotenvx
# Cloudflare
export CF_API_TOKEN=$(dotenvx get CLOUDFLARE_API_TOKEN)
export TF_VAR_cloudflare_api_token="$CF_API_TOKEN"
# AWS
export AWS_ACCESS_KEY_ID=$(dotenvx get AWS_ACCESS_KEY_ID)
export AWS_SECRET_ACCESS_KEY=$(dotenvx get AWS_SECRET_ACCESS_KEY)
export TF_VAR_aws_access_key="$AWS_ACCESS_KEY_ID"
export TF_VAR_aws_secret_key="$AWS_SECRET_ACCESS_KEY"
echo "✓ All secrets loaded"
# Deploy to AWS
echo "Deploying AWS infrastructure..."
cd /Volumes/HOLE-RAID-DRIVE/Projects/hole-terraformer/terraform/aws/foundation
terraform apply -auto-approve
# Deploy to Cloudflare
echo "Deploying Cloudflare infrastructure..."
cd /Volumes/HOLE-RAID-DRIVE/Projects/hole-terraformer/terraform/cloudflare/foundation
./tf-with-dotenvx.sh apply -auto-approve
echo "✓ Multi-cloud deployment complete!"
| Provider | Secret | Command |
|---|---|---|
| Cloudflare | CLOUDFLARE_API_TOKEN | dotenvx get CLOUDFLARE_API_TOKEN |
| AWS | AWS_ACCESS_KEY_ID | dotenvx get AWS_ACCESS_KEY_ID |
| AWS | AWS_SECRET_ACCESS_KEY | dotenvx get AWS_SECRET_ACCESS_KEY |
| Azure | N/A | az account show |
| Terraform Cloud | TF_CLOUD_TOKEN | dotenvx get TF_CLOUD_TOKEN (TBD) |
| Provider | Script | Location |
|---|---|---|
| Cloudflare | tf-with-dotenvx.sh | terraform/cloudflare/foundation/ |
| AWS | None (create one?) | terraform/aws/foundation/ |
| Azure | None (uses az CLI) | terraform/production/ |
Path: /Volumes/HOLE-RAID-DRIVE/dotenvx
Key Files:
.env - Encrypted secrets.env.keys - Encryption keys (NEVER commit)docs/AUDIT_LOG.md - Secret change historyREADME.md - Complete dotenvx documentationAlternative to dotenvx: Store secrets directly in Terraform Cloud workspace variables.
Pros:
Cons:
Recommendation: Use dotenvx + wrapper scripts (current approach) for consistency.
This skill should be used when the user asks to "create a hookify rule", "write a hook rule", "configure hookify", "add a hookify rule", or needs guidance on hookify rule syntax and patterns.
Create distinctive, production-grade frontend interfaces with high design quality. Use this skill when the user asks to build web components, pages, or applications. Generates creative, polished code that avoids generic AI aesthetics.