Skip to content

Encrypt files with SOPS and age

The taskfile library supports encrypting project secrets with sops and age.

Setup

Initialize sops and age for the current project:

task init-dotenv-sops

This command:

  • Derives the project name from the git URL.
  • Generates an age key pair.
  • Stores the private key in the sops default location ~/.config/sops/age/keys.txt.
  • Creates .sops.yaml with the age public key.

A custom key name can be given as the first argument:

task init-dotenv-sops taskfile.build

Show the current setup with:

task show-project-setup

List age keys in the default key file:

task list-agekeys

Create encrypted secrets

Create an encrypted .env file with the --secret flag:

task create-dotenv secrets odoo --secret

Create environment specific secrets such as prod.env:

task create-dotenv prod odoo --secret

The --secret flag requires .sops.yaml to be present. The created file is encrypted automatically.

Edit and show secrets

Edit an encrypted secrets file with sops:

task edit-dotenv secrets

Show the decrypted content:

task show-dotenv secrets

Load all variables including decrypted secrets into the current shell:

task load-dotenv secrets

Store and load age keys from KeePass

The KeePass commands will prompt you to select a database using fzf. You can also pre-select a database with:

task select-keepass-database

Store the age private key in KeePass:

task store-agekey-to-keepass

Reads the key block from ~/.config/sops/age/keys.txt, stores the secret key in the entry's password field and attaches the key block as keys.txt to the age/<project> KeePass entry. A sub path can be passed as the first argument to store a sub key, e.g. task store-agekey-to-keepass app stores the age/<project>/app entry.

Restore the age private key from KeePass:

task load-agekey-from-keepass

Restores the key block from the age/<project> KeePass entry and merges it into ~/.config/sops/age/keys.txt. A sub path can be passed as the first argument to restore a sub key, e.g. task load-agekey-from-keepass app.

Multiple keys per project

Add an age key with an encryption rule for a sub folder:

task add-agekey app

Generates the key <project>/app and appends a rule to .sops.yaml so files under app/ are encrypted with it. Multiple keys and rules can coexist and show-project-setup lists them all.

CI usage

In CI set SOPS_AGE_KEY to the private key and decrypt the env file before using the variables.

Example Forgejo workflow step:

- name: Decrypt secrets
  env:
    SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
  run: |
    set -a
    eval "$(task show-dotenv secrets)"
    set +a
    echo "$KUBECONFIG_DEPLOY" > $HOME/.kube/config

File naming

  • Shared dotenv files live in $TASK_DOTENV_DIR and are named <name>.env.
  • Legacy files named .env.<name> are still supported.
  • Encrypted project secrets live in the project root and are named *.env.
  • Sops encryption is detected by checking for sops markers in the file content.