sops-secrets

# Secrets Standard (sops 3.13+ / age) Canonical workflow for **sops** (structured-file encryption) with **age** (modern key pairs) — encrypted secrets live in git next to the code they configure, and plaintext exists only in memory. This operationalizes the global "No Secrets in Output" rule: no plaintext secret ever touches disk, logs, or a commit. ## 1. Core Model - **age** provides the key pair: one private key per machine/human, public recipients everywhere. Prefer age over PGP (simpler, no keyservers) and over cloud KMS for solo/portable use; add a `gcp_kms` recipient alongside age only when a team needs central revocation. - **sops** encrypts the **values** of YAML/JSON/ENV files — keys stay readable, so diffs review cleanly and `git log` still tells you _which_ secret changed, never _what_ it is. - **Naming Convention**: encrypted files are committed as `*.enc.yaml` / `*.enc.json` / `*.enc.env`; the [sops.yaml](references/sops.yaml) rules key off that suffix, and any plaintext siblings stay gitignored. - **Policy As File**: `.sops.yaml` at the repo root ([sops.yaml](references/sops.yaml)) declares which paths get encrypted and for which recipients — creation is automatic, ad-hoc flags are never needed. ## 2. Key Management 1. **Generate** once per machine: `age-keygen -o ~/.config/sops/age/keys.txt` — sops' default key location; print the public half anytime with `age-keygen -y ~/.config/sops/age/keys.txt`. 1. **Distribute** only the **public** key: paste it as th...