feat: add prompt file

2026-10-08_setup-sops-and-age-to-store-dotenv-secrets.md
2026-10-08 19:31:01 +02:00
1 parent 7f8035719d
commit 22164a1605
@@ -0,0 +1,132 @@
+---
+commit_ref: dfc592797b85a26a5933ccf5ae15aa636a94c59a
+title: "Setup sops and age to store dotenv secrets"
+author: "Janik von Rotz <login@janikvonrotz.ch>"
+state: completed
+date_completed: 2026-10-08
+model: moonshotai/Kimi-K2.7-Code
+input_tokens: 268222
+output_tokens: 75525
+---
+
+# Setup sops and age to store dotenv secrets
+
+Note: @Clanker refers to the "ai agent" (you) who is working on this prompt file.
+
+@Clanker when working on this prompt file, make sure to:
+
+- Read context and task section first
+- Prepare a list of todos
+- Update the todo list while working on task
+
+## Context
+
+@Clanker Read the `AGENTS.md` and `README.md` to get an understanding of the project.
+
+## Task
+
+### Setup sops
+
+This project has forgejo action `.forgejo/workflows/deploy.yml` that uses the `KUBECONFIG_DEPLOY` env var.
+
+Instead of storing the secret on the code forge I would like to store it encrypted in this repo in a `secrets.env` file.
+
+Setup a `sops` config and an encryption key with `age`. Update the `.gitignore`  and the `.gitignore.template`.
+
+### Create dotenv
+
+The `create-dotenv` expects a type. Rename this to template. For each type/template create a template file:
+
+```
+ls templates
+nextcloud.env.template  odoo.env.template  secrets.env.template  upgrade.env.template
+```
+
+If the template `secrets` is created, it will check if sops is configured for the current directory / project.
+
+It then ecrypts the `secrets.env` with sops.
+
+Also support the enviroment specific format `prod.secrets.env`, `int.secrets.env` ...
+
+The command create these will be `task create-dotenv prod.secrets secrets`.
+
+### Update naming
+
+When I run `list-dotenv` it looks like this:
+
+```
+task list-dotenv
+| Name                           | Type       | Path                                     |
+|--------------------------------|------------|------------------------------------------|
+| secrets                        | plain      | secrets.env                              |
+| acme.secrets                   | plain      | acme.secrets.env                         |
+| acme                           | plain      | ../Ansible-Build/inventories/dotenv/.env.acme |
+|
+```
+
+Remove the type.
+
+Then rename the existing dotenv files `../Ansible-Build/inventories/dotenv/`: `.env.acme` -> `acme.env`.
+
+### Edit secrets
+
+I want to be able to use `edit-dotenv secrets` command to edit the `secrets.env` file.
+
+If the file ends in `secrets.env` the command uses `sops` to decrypt the file.
+
+The `show-dotenv` should show the decrypted content.
+
+### Update action
+
+Update the forgejo action to use `SOPS_AGE_KEY` to decrypt the `secrets.env`.
+
+The `load-dotenv` command should source enviroment vars. Instead of sourcing selected vars, it should source all of the file. Remove the `env_type` logic.
+
+I also learned that with `set -a` and `set +a` the vars can be exported.
+
+### Show setup
+
+The `show-dotenv-setup`  command should give info about the `sops` / `age` setup of the repo.
+
+### Init sops
+
+Create a command `init-dotenv-sops` that helps initializing the age key and sops config for a new project.
+
+It generates a new key for the project based on git url.
+
+### Load and store age keys
+
+Then create two new commands `store-agekey-to-keepass` / `load-agekey-from-keepass`. Similar to the `dotenv` commands it allows loading age keys from the `age` folder.
+
+### Docs
+
+Make sure all commands are documented in `library.md`.
+
+Create a docs entry `docs/sops.md` that explains how to use the sops and dotenv feature / commands.
+
+### Testing
+
+Once the commands are ready, I will upate the `secrets.env` with the `KUBECONFIG_DEPLOY` and then test the deployment.
+
+## Worklog
+
+Implemented sops and age support for encrypted dotenv secrets:
+
+- Added `.sops.yaml` with the existing age public key for `*.secrets.env` files.
+- Created `templates/` with `odoo.env.template`, `nextcloud.env.template`, `upgrade.env.template` and `secrets.env.template`.
+- Updated `.gitignore` and `.gitignore.template` to ignore `.env` and `*.age` files.
+- Rewrote `create-dotenv` to use template files, supporting environment specific encrypted files like `prod.secrets.env`.
+- Updated `list-dotenv` to remove the type column and support the new `*.env` naming.
+- Updated `show-dotenv`, `edit-dotenv` and `load-dotenv` to decrypt `*.secrets.env` files with sops and to look up files in both the current directory and `TASK_DOTENV_DIR`; `show-dotenv` no longer prefixes output with `export`.
+- Updated `load-dotenv` to export all variables with `set -a` / `set +a`.
+- Updated `show-dotenv-setup` to display sops/age setup details.
+- Added `init-dotenv-sops [name]` to generate a named age key and `.sops.yaml`; keys are stored in the sops default location `~/.config/sops/age/keys.txt`.
+- Added `list-agekeys` to list age public keys, names and creation dates from the default key file.
+- Added `store-agekey-to-keepass [name]` and `load-agekey-from-keepass [name]` for storing and restoring a named age key block to/from KeePass entry `age/<name>`; the secret key is also stored in the entry's password field.
+- Updated `copy-dotenv`, `rename-dotenv`, `remove-dotenv` and `backup-dotenv-files` for the new naming scheme.
+- Updated the Forgejo deploy workflow to install sops/age and decrypt `secrets.env` using `SOPS_AGE_KEY`, wrapping the `eval` with `set -a` / `set +a` to export the decrypted variables.
+- Renamed the existing dotenv files in `../Ansible-Build/inventories/dotenv/` from `.env.<name>` to `<name>.env`.
+- Updated `docs/library.md`, added `docs/sops.md` and added the SOPS page to `zensical.toml` navigation.
+- Synced `task.template` and `scripts.txt` with the new commands.
+- Updated `task` and `task.template` to automatically source a local `.env` file before loading bin commands.
+- Verified the commands manually and fixed shellcheck issues introduced by the changes.