created: 2025-06-02T22:00:00Z

public key: age1abcdefghijk...

Copy that public key somewhere — you’ll need it for encrypting.

✅ You should now have:

secrets/ ├── age.key # keep this safe and private!

📝 3. Create Encrypted Secrets File

sops --age age1abcdefghijk... secrets/secrets.yaml

This opens a YAML file in your $EDITOR. Add secrets like:

forgejo-admin-password: "my-super-secret-password"

Save and close the file — it’s now encrypted using the public key.

✅ Now you should have:

secrets/ ├── age.key ├── secrets.yaml # encrypted file (safe to commit)

You can commit secrets.yaml, but do not commit age.key unless you're OK with putting it on a VM.

🧪 Test Decryption Locally

export SOPS_AGE_KEY_FILE=secrets/age.key

To test:

sops -d secrets/secrets.yaml

To edit:

sops secrets/secrets.yaml

[plasmagoat@forgejo:~]$ sudo chmod 400 /etc/sops/age.key && sudo chown root:root /etc/sops/age.key