Secrets: Add, Encrypt, and Decrypt

Secrets: Add, Encrypt, and Decrypt

This project uses SOPS (Mozilla) with PGP to encrypt secret files. Encrypted files are committed; decrypted files are gitignored and created locally (or in CI from secrets).

Prerequisites

• SOPS installed: brew install sops (or install)
• GPG with at least one of the PGP keys configured in .sops.yaml (so you can decrypt/encrypt)

Recipients in .sops.yaml are the only keys that can decrypt; only they (or someone with a recipient key) can re-encrypt after editing.

File naming

Kind	Encrypted file name	Decrypted file name
Suffix .enc	path/to/file.enc	path/to/file
Infix .enc.	path/to/file.enc.txt	path/to/file.decrypted.txt

The scripts derive the decrypted name from the encrypted name; stick to one of these two patterns.

Registry: encrypted_files.txt

All managed secret files are listed in encrypted_files.txt at the project root (paths relative to project root). The encrypt/decrypt scripts only process files in this list.

• One path per line.
• Encrypted path must contain .enc or .enc..
• Empty lines and lines starting with # are ignored.

Example:

# Backend Files
# (add paths here)

# Shaker Files
shaker/.env.dev.enc
shaker/.env.prod.enc

Decrypt (get secrets locally)

From the project root:

task decrypt_all

Or run the script directly:

./scripts/decrypt_all.sh

• Reads encrypted_files.txt.
• For each listed path, runs sops decrypt and writes the decrypted file (see naming above).
• Decrypted files are gitignored; do not commit them.

After decrypt, the root Taskfile also runs cd shaker && ln -sf .env.local .env for the shaker app.

Encrypt (save changes to secrets)

1. Edit the decrypted file (e.g. shaker/.env.dev or shaker/secrets/ios/shell_env.decrypted.txt).

2. From the project root:

   task encrypt_all

   Or:

   ./scripts/encrypt_all.sh

• Reads encrypted_files.txt.
• For each line, derives the decrypted path, runs sops encrypt on that file, and writes the encrypted file.
• Commit the updated encrypted file(s); do not commit decrypted files.

Add a new secret file

1. Create the decrypted file in the right place, with the correct name:
   • Either some/path/name.decrypted.txt (encrypted will be some/path/name.enc.txt), or
   • some/path/name (encrypted will be some/path/name.enc).
2. Add the encrypted path to encrypted_files.txt (the path you will commit), e.g.:
   • shaker/secrets/ios/shell_env.enc.txt
3. Encrypt it (from project root):

   task encrypt_all

4. Commit the new line in encrypted_files.txt and the new encrypted file (e.g. shaker/secrets/ios/shell_env.enc.txt). Do not commit the decrypted file.
5. Ensure the decrypted path is gitignored (e.g. *.decrypted.*, or the specific path).

iOS release secrets

iOS signing and App Store Connect credentials are not stored in this repo. They live in the team signing vault (r26d_signing_secrets) and are served per-session by autopen (autopen ios prepare for certificates/profiles, autopen ios release-env for the App Store Connect API key). See iOS TestFlight Deployment.

Remove decrypted files (clean)

To delete all decrypted files listed in encrypted_files.txt (e.g. before leaving a shared machine):

task clean

Or:

./scripts/clean_all.sh

Only decrypted paths derived from encrypted_files.txt are removed; other local files are untouched.

Summary

Goal	Command (project root)
Decrypt all listed secrets	task decrypt_all
Encrypt all (after editing decrypted files)	task encrypt_all
Remove decrypted files	task clean

| Add a new secret | 1) Create decrypted file 2) Add encrypted path to encrypted_files.txt 3) task encrypt_all 4) Commit encrypted file + encrypted_files.txt |