Sops Age

SOPS + age vault for swamp: encrypt secrets at rest with AES-256-GCM via Mozilla SOPS and age. Zero network dependency — fully local, file-based. Works with existing SOPS workflows and zo.space secrets dashboards.

Setup

Generate an age keypair and SOPS-encrypted secrets file:

  --input-type json --output-type json ~/.secrets/secrets.json

Create a vault instance:

  --config '{"secretsFile":"/home/user/.secrets/secrets.json","ageKeyFile":"/home/user/.secrets/age.key","agePublicKey":"age1..."}'

Usage

bash swamp vault list-keys my-secrets --json swamp vault read-secret my-secrets MY_SECRET --force swamp vault put my-secrets NEW_KEY=new_value In workflows:

  API_KEY: ${{ vault.get(my-secrets, OPENAI_API_KEY) }}

Required Tools

• sops CLI (https://github.com/mozilla/sops) - age CLI (https://github.com/FiloSottile/age)