diff --git a/prompt.md b/prompt.md
index 15c59c9..72f8f0a 100644
--- a/prompt.md
+++ b/prompt.md
@@ -1,14 +1,14 @@
 ---
-title: "Support prompt path for create-prompt and prompt-with-pi"
+title: "Setup sops and age to store dotenv secrets"
 author: "Janik von Rotz <login@janikvonrotz.ch>"
 state: completed
-date_completed: 2026-10-07
+date_completed: 2026-10-08
 model: moonshotai/Kimi-K2.6
-input_tokens: 572041
-output_tokens: 11373
+input_tokens: 2695906
+output_tokens: 23684
 ---
 
-# Support prompt path for create-prompt and prompt-with-pi
+# Setup sops and age to store dotenv secrets
 
 Note: @Clanker refers to the "ai agent" (you) who is working on this prompt file.
 
@@ -24,20 +24,91 @@ Note: @Clanker refers to the "ai agent" (you) who is working on this prompt file
 
 ## Task
 
-I would like to pass a `[path]` to `create-prompt`, `load-prompt`, `commit-prompt`, `prompt-with-pi`.
+### Setup sops
 
-Here is an example: `task create-prompt "Some tile" tmp/prompt.md`
+This project has forgejo action `.forgejo/workflows/deploy.yml` that uses the `KUBECONFIG_DEPLOY` env var.
 
-The path must always be option and default is `./prompt.md`.
+Instead of storing the secret on the code forge I would like to store it encrypted in this repo in a `secrets.env` file.
 
-Also rename `list-taskfile-aliases` to `list-aliases`.
+Setup a `sops` config and an encryption key with `age`. Update the `.gitignore`  and the `.gitignore.template`.
+
+### Create dotenv
+
+The `create-dotenv` expects a type. Rename this to template. For each type/template create a template file:
+
+```
+ls templates
+nextcloud.env.template  odoo.env.template  secrets.env.template  upgrade.env.template
+```
+
+If the template `secrets` is created, it will check if sops is configured for the current directory / project.
+
+It then ecrypts the `secrets.env` with sops.
+
+Also support the enviroment specific format `prod.secrets.env`, `int.secrets.env` ...
+
+The command create these will be `task create-dotenv prod.secrets secrets`.
+
+### Update naming
+
+When I run `list-dotenv` it looks like this:
+
+```
+task list-dotenv
+| Name                           | Type       | Path                                     |
+|--------------------------------|------------|------------------------------------------|
+| secrets                        | plain      | secrets.env                              |
+| acme.secrets                   | plain      | acme.secrets.env                         |
+| acme                           | plain      | ../Ansible-Build/inventories/dotenv/.env.acme |
+|
+```
+
+Remove the type.
+
+Then rename the existing dotenv files `../Ansible-Build/inventories/dotenv/`: `.env.acme` -> `acme.env`.
+
+### Edit secrets
+
+I want to be able to use `edit-dotenv secrets` command to edit the `secrets.env` file.
+
+If the file ends in `secrets.env` the command uses `sops` to decrypt the file.
+
+The `show-dotenv` should show the decrypted content.
+
+### Update action
+
+Update the forgejo action to use `SOPS_AGE_KEY` to decrypt the `secrets.env`.
+
+The `load-dotenv` command should source enviroment vars. Instead of sourcing selected vars, it should source all of the file. Remove the `env_type` logic.
+
+I also learned that with `set -a` and `set +a` the vars can be exported.
+
+### Show setup
+
+The `show-dotenv-setup`  command should give info about the `sops` / `age` setup of the repo.
+
+### Init sops
+
+Create a command `init-dotenv-sops` that helps initializing the age key and sops config for a new project.
+
+It generates a new key for the project based on git url.
+
+### Load and store age keys
+
+Then create two new commands `store-agekey-from-keepass` / `load-agekey-from-keepass`. Similar to the `dotenv` commands it allows loading age keys from the `age` folder.
+
+### Docs
+
+Make sure all commands are documented in `library.md`.
+
+Create a docs entry `docs/sops.md` that explains how to use the sops and dotenv feature / commands.
+
+### Testing
+
+Once the commands are ready, I will upate the `secrets.env` with the `KUBECONFIG_DEPLOY` and then test the deployment.
 
 ## Worklog
 
-- Updated `bin/create-prompt` to accept an optional `[path]` argument defaulting to `prompt.md`, replacing the previous `[repo-path]` argument. It now ensures the target directory exists before writing.
-- Updated `bin/load-prompt` to accept an optional `[path]` argument defaulting to `prompt.md`. It now derives the repository root from the prompt file's directory using `git rev-parse --show-toplevel` and copies the selected prompt into the specified path.
-- Updated `bin/commit-prompt` to accept an optional `[path]` argument defaulting to `prompt.md`. It resolves the repository root from the path, computes the relative path within the repo, and reads the prompt file from that location.
-- `bin/prompt-with-pi` already supported `[path]` defaulting to `prompt.md`; no changes were needed.
-- Renamed `bin/list-taskfile-aliases` to `bin/list-aliases`, updated the function and alias (`la`) inside, and updated references in `task.template` and `docs/library.md`.
-- Updated `task.template` help rows to reflect new signatures for `create-prompt`, `commit-prompt`, and `load-prompt`, and renamed `list-taskfile-aliases` to `list-aliases`.
-- Verified all modified scripts pass `shellcheck` cleanly.
+@Clanker Add a summary here once the task has been completed.
+
+@Clanker Set frontmatter state to completed and update date and model. If you have access to session info also add token count.