Secrets on bismigelhttps://bismigel.dev/tags/secrets/Recent content in Secrets on bismigelHugoen-usbismigelMon, 12 Oct 2026 00:00:00 +0000Secrets without plaintexthttps://bismigel.dev/posts/2026-10-12-secrets-without-plaintext/Mon, 12 Oct 2026 00:00:00 +0000https://bismigel.dev/posts/2026-10-12-secrets-without-plaintext/No secret sits in Git as readable text. Two tools handle the two halves.

In the cluster: Sealed Secrets

A controller in the cluster holds a private key. The matching public key encrypts:

shell 
kubectl create secret generic app \
  --from-literal=KEY=value --dry-run=client -o yaml \
  | kubeseal --format yaml > sealed-secret.yaml

The output is safe to commit. On sync the controller decrypts it into a real Secret.

On the host: SOPS with age

Host secrets, such as tunnel credentials, stay encrypted in the NixOS repo and are decrypted at activation. The age identity is the machine's own SSH host key.

shell 
sops secrets/homelab.yaml    # edit; re-encrypts on save

The rule

Plaintext never enters Git. If a value has to live in the repo, it is encrypted first.

Back up the sealing key. Without it, sealed secrets cannot be opened again.

]]>