Env files are plaintext today. That is fine on kind. It fights the usual habit: encrypt in git, decrypt only on the machine that runs plan / deploy.
Use SOPS. Detect ciphertext, decrypt in memory, then parse dotenv as we do now. Age, PGP, and cloud KMS stay SOPS's problem. Plaintext files stay unchanged.
age-keygen -o ~/.config/sops/age/keys.txt
sops -e -i .env.production
deployah plan production
Point envFile at the encrypted file the same way you would at a plaintext one. No new required field. Never write decrypted bytes next to the repo. Fail hard if the file is encrypted and no key is available. Plan JSON still masks Secret values.
Out of scope: Vault / External Secrets, encrypting extras YAML, a deployah secrets edit command (use sops).
Related: #8 (catalog-generated env files should be encryptable the same way).
Env files are plaintext today. That is fine on kind. It fights the usual habit: encrypt in git, decrypt only on the machine that runs
plan/deploy.Use SOPS. Detect ciphertext, decrypt in memory, then parse dotenv as we do now. Age, PGP, and cloud KMS stay SOPS's problem. Plaintext files stay unchanged.
age-keygen -o ~/.config/sops/age/keys.txt sops -e -i .env.production deployah plan productionPoint
envFileat the encrypted file the same way you would at a plaintext one. No new required field. Never write decrypted bytes next to the repo. Fail hard if the file is encrypted and no key is available. Plan JSON still masks Secret values.Out of scope: Vault / External Secrets, encrypting extras YAML, a
deployah secrets editcommand (usesops).Related: #8 (catalog-generated env files should be encryptable the same way).