DOSSIER 21 / 5 ARTICLES
SOPS encrypted configuration and key lifecycles
From hybrid encryption to runtime deployment, editing, templates, and key migration.
Start with the first articleFollow the question further.
Secret configuration enters version control as ciphertext, while decryption identities remain in controlled environments. Understand data keys and recipient wrapping first, then separate CLI encryption rules, sops-nix runtime deployment, and template-placeholder rendering. Finish with a two-recipient transition for migration and recovery verification.
- 01
Start with the data and key layers, distinguish structured and binary formats, then examine authorization and plaintext-leakage boundaries.
sops principles: hybrid encryption and recipients
Understand the boundaries of encrypted version control, data keys, and authorization for multiple recipients.
Read article - 02
Trace ciphertext, each secret output, and service consumption; check mount and user-creation ordering against the specific module version.
sops-nix integration: runtime, ordering, and SSH host keys
Connect encrypted source files, runtime secret files, and service dependencies.
Read article - 03
Read edit first, then compare temporary plaintext with set/unset; carefully check configuration discovery, encryption rules, and identity inputs.
sops usage guide: command-line operations
Edit encrypted files, inspect their status, and manage recipients and data keys.
Read article - 04
Separate CLI creation_rules, NixOS deployment configuration, and sops.templates, and verify defaults and output encoding.
sops configuration templates and runtime rendering
Understand encryption rules, sops-nix configuration, and runtime placeholders field by field.
Read article - 05
Keep the old recipient until the new identity and deployment chain are both verified, then consider rotating data keys, secret values, and recovery material.
sops key migration and rotation
Migrate keys through a two-recipient transition, distinguishing authorization updates from credential revocation.
Read article