Secrets Management with SOPS

All credentials and secrets are encrypted using SOPS.

Decrypting a File

Export the AGE secret key:

PASSWORD_STORE_DIR=~/projects/medapsis/pass pass ci/age-secret-key > $HOME/projects/medapsis/key.txt
export SOPS_AGE_KEY_FILE=$HOME/projects/medapsis/key.txt

Decrypt:

sops -d --input-type json --output-type json deploy/staging/secrets.enc > deploy/staging/secrets.json

Encrypting a File

Get the AGE public key:

PASSWORD_STORE_DIR=~/projects/medapsis/pass pass ci/age-public-key

Encrypt (replace agexxxxx with the actual public key):

sops -e --age agexxxxx --input-type json --output-type json deploy/staging/secrets.json > deploy/staging/secrets.enc