No secret sits in Git as readable text. Two tools handle the two halves.

In the cluster: Sealed Secrets

A controller in the cluster holds a private key. The matching public key encrypts:

kubectl create secret generic app \
  --from-literal=KEY=value --dry-run=client -o yaml \
  | kubeseal --format yaml > sealed-secret.yaml

The output is safe to commit. On sync the controller decrypts it into a real Secret.

On the host: SOPS with age

Host secrets, such as tunnel credentials, stay encrypted in the NixOS repo and are decrypted at activation. The age identity is the machine's own SSH host key.

sops secrets/homelab.yaml    # edit; re-encrypts on save

The rule

Plaintext never enters Git. If a value has to live in the repo, it is encrypted first.

Back up the sealing key. Without it, sealed secrets cannot be opened again.