什么是 Redshift CLI 用于去中心化机密管理？

Redshift 是一款高性能的命令行界面，专为优先考虑加密安全和去中心化的开发人员设计。通过集成 Openclaw Skills，用户可以跨多种基础设施管理应用程序机密、API 密钥和敏感环境变量。与依赖中心化云保险库的传统机密管理器不同，Redshift 利用 Nostr 协议和 NIP-59 Gift Wrap 进行客户端加密。这确保了敏感数据在离开您的机器之前就已加密，并存储在分布式的中继网络中，为标准解决方案提供了一个更具韧性和私密性的替代方案。

通过 Openclaw Skills 的实现，Redshift 允许通过 Nostr 私钥 (nsec) 或远程地堡 (NIP-46) 进行无缝身份验证。它旨在支持复杂的开发生命周期，提供每个目录的项目配置和环境特定的机密隔离。无论您是部署到自托管的家庭实验室还是大规模的云集群，Redshift 都能提供安全、本地优先的体验，并具备去中心化后端的灵活性。

下载入口:https://github.com/openclaw/skills/tree/main/skills/accolver/redshift

安装与下载

1. ClawHub CLI

从源直接安装技能的最快方式。

2. 手动安装

将技能文件夹复制到以下位置之一

优先级：工作区 > 本地 > 内置

3. 提示词安装

将此提示词复制到 OpenClaw 即可自动安装。

Redshift CLI 用于去中心化机密管理 应用场景

• 在没有中心化保险库的情况下安全地管理后端应用程序的环境变量。
• 使用 Nostr 身份验证和 Openclaw Skills 将加密的机密注入 CI/CD 流水线。
• 通过去中心化的 Nostr 中继在分布式团队成员之间同步项目特定的机密。
• 本地开发机密管理，可在开发、测试和生产环境之间轻松切换。
• 使用客户端加密存储替换明文 .env 文件，以防止意外泄露。

1. 用户使用 Redshift CLI 通过 Nostr 私钥 (nsec) 或远程地堡进行身份验证。
2. 使用 Openclaw Skills 并通过 redshift.yaml 文件初始化项目，定义项目标识符和 Nostr 中继列表。
3. 机密在用户机器上使用 NIP-59 Gift Wrap 加密在本地完成，确保不传输任何明文数据。
4. 加密后的负载作为去中心化事件发布到指定的 Nostr 中继。
5. 当执行类似 redshift run 的命令时，CLI 会获取并解密机密到内存中，将其作为环境变量或挂载文件注入。

Redshift CLI 用于去中心化机密管理 配置指南

要开始通过 Openclaw Skills 使用此技能，请确保您已安装 Redshift 二进制文件。您可以从官方仓库安装或从源代码构建。

# 登录并安装
redshift login

# 初始化项目环境
redshift setup -p my-project -c development

# 设置您的第一个机密
redshift secrets set API_KEY 'your-secret-value'

对于 CI/CD 环境，请配置 REDSHIFT_NSEC 环境变量以绕过交互式登录提示。

Redshift CLI 用于去中心化机密管理 数据架构与分类体系

Redshift 使用基于项目和环境的分层结构组织数据。配置通过本地文件系统和存储在用户目录中的全局设置进行管理。

name: redshift
description: Manage application secrets with the Redshift CLI (https://redshiftapp.com) — decentralized, encrypted secret management built on Nostr. Use when setting, getting, deleting, listing, uploading, or downloading secrets, injecting secrets into commands, configuring projects/environments, or authenticating with Nostr keys. Covers redshift secrets, redshift run, redshift setup, redshift login, and related commands.
homepage: https://redshiftapp.com
metadata:
  {
    "openclaw":
      {
        "emoji": "??",
        "requires":
          {
            "bins": ["redshift"],
            "envOptional": ["REDSHIFT_NSEC", "REDSHIFT_BUNKER", "REDSHIFT_CONFIG_DIR"],
          },
        "installHint": "Install from https://redshiftapp.com or build from source: https://github.com/accolver/redshift",
      },
  }

Redshift

Decentralized secret management via the redshift CLI. Secrets are client-side encrypted (NIP-59 Gift Wrap) and stored on Nostr relays — no central server.

Project homepage: https://redshiftapp.com

Key concepts

• Project (-p): a project slug (e.g. backend, myapp)
• Config/Environment (-c): an environment slug (e.g. dev, staging, production)
• redshift.yaml: per-directory project config created by redshift setup
• When -p/-c are omitted, Redshift reads from redshift.yaml in the current directory

Security considerations

• Never pass secret values directly on the command line in shared/logged environments — prefer redshift secrets set interactively or pipe from stdin
• Use REDSHIFT_NSEC / REDSHIFT_BUNKER env vars for CI/CD rather than CLI flags
• Avoid redshift serve --host 0.0.0.0 unless you intend to expose the web UI to the network — default 127.0.0.1 is localhost-only
• All encryption is client-side; secrets never leave the device unencrypted
• Private keys are stored in the system keychain, not in plaintext config files

Authentication

redshift login                    # Interactive (recommended)
redshift login --nsec nsec1...    # Direct private key (use env var in CI instead)
redshift login --bunker "bunker://pubkey?relay=wss://relay.example&secret=xxx"  # NIP-46 (ALWAYS quote the URL)
redshift login --connect          # Generate NostrConnect URI for bunker app
redshift me                       # Check current identity
redshift logout                   # Clear credentials

CI/CD: set REDSHIFT_NSEC or REDSHIFT_BUNKER env vars instead of redshift login. These should be stored in your CI platform's secret management (e.g. GitHub Actions secrets), never hardcoded.

Project setup

redshift setup                                  # Interactive
redshift setup -p myapp -c production           # Non-interactive
redshift setup --no-interactive -p app -c dev   # Strict non-interactive

Creates redshift.yaml with project, environment, and relay list.

Secrets

# List all
redshift secrets                          # Redacted values
redshift secrets --raw                    # Show plaintext values
redshift secrets --json                   # JSON output
redshift secrets --only-names             # Names only

# Get
redshift secrets get API_KEY
redshift secrets get API_KEY --plain      # Raw value, no formatting
redshift secrets get API_KEY --copy       # Copy to clipboard
redshift secrets get KEY1 KEY2            # Multiple keys

# Set
redshift secrets set API_KEY sk_live_xxx
redshift secrets set API_KEY '123' DB_URL 'postgres://...'    # Multiple at once

# Delete
redshift secrets delete OLD_KEY
redshift secrets delete KEY1 KEY2 -y      # Skip confirmation

# Download
redshift secrets download ./secrets.json                     # JSON (default)
redshift secrets download --format=env --no-file             # Print .env to stdout
redshift secrets download --format=env ./secrets.env         # Save as .env file
# Formats: json, env, yaml, docker, env-no-quotes

# Upload
redshift secrets upload secrets.env

Override project/environment on any secrets command with -p / -c:

redshift secrets -p backend -c production --raw
redshift secrets set -p myapp -c staging FEATURE_FLAG true

Run with secrets injected

Important: Only run commands the user has explicitly requested. Never construct arbitrary commands to pass to redshift run. Always confirm the command with the user before executing.

redshift run -- npm start
redshift run -- python app.py
redshift run --command "npm start && npm test"
redshift run -p myapp -c prod -- docker-compose up

# Mount secrets to a file instead of env vars
redshift run --mount secrets.json -- cat secrets.json
redshift run --mount secrets.env --mount-format env -- cat secrets.env

# Fallback for offline mode
redshift run --fallback ./fallback.json -- npm start
redshift run --fallback-only -- npm start          # Read only from fallback

# Preserve existing env values for specific keys
redshift run --preserve-env PORT,HOST -- npm start

Configuration

redshift configure                    # Show config
redshift configure --all              # Show all saved options
redshift configure get project        # Get specific option
redshift configure set project=myapp  # Set option
redshift configure unset project      # Remove option
redshift configure reset --yes        # Reset to initial state

Web UI

redshift serve                        # http://127.0.0.1:3000 (localhost only)
redshift serve --port 8080 --open     # Custom port, auto-open browser
redshift serve --host 0.0.0.0         # ?? Exposes to network — use with caution

Global flags

Environment variables

Important notes

• Always quote bunker URLs (--bunker "bunker://...") — shell interprets & otherwise
• Secret values with spaces or special chars should be quoted
• Complex values (objects/arrays) are auto-JSON-stringified when injected by redshift run