onesecret
Keep just one secret to decrypt the rest. Commit your credentials encrypted next to your code, and keep a single age key to read them.
The files are SOPS files, so the sops CLI keeps working, but nothing has to be installed: encryption and decryption run in Node.js with no native binaries.
- One age key decrypts every environment.
- Plain settings and secrets live side by side in layers, and config() returns them as one object.
- Production never needs the key: deploys push the decrypted values to the platform, such as Kubernetes, Fly.io, Vercel, or AWS.
- It fails at boot and names exactly which secret is missing.