Secrets Management With SOPS and age

Fri, 11 Jul 2025 13:50:00 +0000

The moment you commit to managing your homelab as code, you hit the secrets problem within the hour. Your git repo describes every service beautifully — the compose files, the reverse-proxy config, the whole declarative lovely thing — and then one service needs a database password and the illusion cracks. You cannot commit the password to git, because git remembers forever and repos leak. You cannot leave it out, because then the repo doesn’t actually describe a working system. People solve this badly for years: passwords in a .env file that is gitignored and therefore backed up nowhere, or worse, committed “temporarily” and never scrubbed from history.

Age - vo.rs

Secrets Management With SOPS and age