Post

also double check git history before making it public. any secret that was ever committed unencrypted is still in the old commits, so rotate those or rewrite history first

cow

@cow.computer

if you're worried about that I'd suggest maybe putting your sops-nix files in a different git repo that you keep private. Also be really careful with the .sops.yaml there are a few footguns that can leave ur stuff unencrypted. agenix cannot leave stuff unencrypted but has less features like template

haz

@haz.re

I've read about the separate repo thing but is there anywhere I can read on these foot guns you're talking about?

cow

@cow.computer

the footguns im talking about aren't something i saw too much online, more something I ran into and leaked my oauth2 private keys. github.com/getsops/sops... this is the issue i fell for but pretty much, sops can leave stuff unencrypted if you use it wrong, age can't.

cow

@cow.computer

I wouldn't change your choice of secret management tool over it, just be a little careful.