Secrets OPerationS & age encryption

SOPS encrypts secret values in files and can use an age keypairs (among others) for encryption/decryption of the values. Age is a simple, modern and secure encryption tool with small explicit keys.

age

link

Generate a new keypair:

age-keygen -o newkey.txt

Output looks like:

Public key: age1h73d4w9srs6vaz7dfc8nlc4mpcpjarft9gzz7u5kt7e5f6v5uqyssdezaj

Content of the newkey.txt looks like:

# created: 2026-06-10T18:23:10+02:00
# public key: age1h73d4w9srs6vaz7dfc8nlc4mpcpjarft9gzz7u5kt7e5f6v5uqyssdezaj
AGE-SECRET-KEY-1FNC7L8KQQ8C3JH72WF22TJGV8N60T3D68YHSHZD9HM7VUKZH254S5S0Q4D

SOPS

link

SOPS searches for age keys in: ~/.config/sops/age/keys.txt.
Main repo configuration:

cat .sops.yaml

---
stores:
  yaml:
    indent: 2

creation_rules:
  - path_regex: .*\.sops\.ya?ml$
    age: >-
      age123...,
      age456...,
      age789...

Encrypt and decrypt a file:

sops -e -i <filename>
sops -d -i <filename>

Update keys in encrypted file:

sops updatekeys -y <filename>

Use find for larger operations:

find . -type f \( -name '*secrets.sops.yaml' -o -name '*secrets.sops.yml' \) -exec sops updatekeys -y {} \;