otty / apps

All apps/SOPS

SOPS

sops

Simple and flexible tool for managing secrets.

Runs as sops|macOS, Linux, Windows|github.com

Open form in Otty otty.toml

Sync rules

What travels, what stays, what never leaves

SOPS in your home directory Every rule on this page, by file

· ~/.config/sops/age/keys.txt Never synced

· ~/Library/Application Support/sops/age/keys.txt Never synced

Only what the catalog names. A directory that syncs brings everything inside it except what is listed as excluded here.

apps/sops/otty.tomlThe file this page is generated from

id = "sops"

name = "SOPS"

homepage = "https://github.com/getsops/sops"

description = "Simple and flexible tool for managing secrets."

executables = ["sops"]

[dotfiles]

# https://github.com/getsops/sops (README, "age key file") and

# age/keysource.go document sops/age/keys.txt below the user config directory.

# Linux uses XDG_CONFIG_HOME with ~/.config fallback; macOS uses that variable

# when set and otherwise ~/Library/Application Support; Windows uses %APPDATA%.

# The three spellings preserve both macOS fallback and Windows explicitly.

paths = []

secret = [

"[configHome]/sops/age/keys.txt",

"[appData]/sops/age/keys.txt",

"%APPDATA%/sops/age/keys.txt",

]

side_effect = false

[commands]

format = 1

label = "SOPS"

description = "Encrypt or decrypt a file with sops. Editing, key rotation, key groups, publish and key-service options are left out."

quality = "ai-draft"

parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = true, short_bundles = false }

[[commands.subcommand]]

path = ["decrypt"]

label = "Decrypt a file"

description = "Decrypt a file and print it to stdout, or write it elsewhere."

[[commands.subcommand.source]]

id = "help"

kind = "help"

url = "https://github.com/getsops/sops/blob/main/cmd/sops/main.go"

evidence = """decrypt [file]: decrypt a file, and output the results to stdout. If no filename is provided, stdin will be used.

--in-place, -i write output back to the same file instead of stdout

--extract extract a specific key or branch from the input document.

--output Save the output after decryption to the file specified

--input-type currently json, yaml, dotenv, ini and binary are supported.

--output-type currently json, yaml, dotenv, ini and binary are supported."""

[[commands.subcommand.field]]

id = "file"

label = "Encrypted file"

type = "path"

position = 0

path = { kind = "file", role = "input" }

sources = ["help"]

[[commands.subcommand.field]]

id = "in_place"

label = "Decrypt in place"

type = "boolean"

option = ["--in-place", "-i"]

effect = "overwrite"

sources = ["help"]

[[commands.subcommand.field]]

id = "output"

label = "Output file"

type = "path"

option = ["--output"]

path = { kind = "file", role = "output" }

effect = "overwrite"

sources = ["help"]

[[commands.subcommand.field]]

id = "extract"

label = "Extract key"

type = "string"

option = ["--extract"]

sources = ["help"]

[[commands.subcommand.field]]

id = "input_type"

label = "Input type"

type = "enum"

option = ["--input-type"]

choices = [{ value = "json", label = "JSON" }, { value = "yaml", label = "YAML" }, { value = "dotenv", label = "dotenv" }, { value = "ini", label = "INI" }, { value = "binary", label = "Binary" }]

sources = ["help"]

[[commands.subcommand.field]]

id = "output_type"

label = "Output type"

type = "enum"

option = ["--output-type"]

choices = [{ value = "json", label = "JSON" }, { value = "yaml", label = "YAML" }, { value = "dotenv", label = "dotenv" }, { value = "ini", label = "INI" }, { value = "binary", label = "Binary" }]

sources = ["help"]

[[commands.subcommand.task]]

id = "show"

label = "Print decrypted"

fields = ["file", "extract", "output_type"]

required = ["file"]

[[commands.subcommand.task]]

id = "to-file"

label = "Decrypt to a file"

fields = ["file", "output", "output_type"]

required = ["file", "output"]

[[commands.subcommand.group]]

id = "basic"

label = "Basic"

fields = ["file", "output", "in_place", "extract"]

[[commands.subcommand.group]]

id = "advanced"

label = "Advanced"

fields = ["input_type", "output_type"]

[[commands.subcommand]]

path = ["encrypt"]

label = "Encrypt a file"

description = "Encrypt a file for age, PGP or cloud KMS recipients and print it to stdout, or write it elsewhere."

[[commands.subcommand.source]]

id = "help"

kind = "help"

url = "https://github.com/getsops/sops/blob/main/cmd/sops/main.go"

evidence = """encrypt [file]: encrypt a file, and output the results to stdout. If no filename is provided, stdin will be used.

--in-place, -i write output back to the same file instead of stdout

--output Save the output after encryption to the file specified

--age, -a comma separated list of age recipients

--pgp, -p comma separated list of PGP fingerprints

--kms, -k comma separated list of KMS ARNs

--encrypted-regex set the encrypted key regex. When specified, only keys matching the regex will be encrypted.

--unencrypted-regex set the unencrypted key regex. When specified, only keys matching the regex will be left unencrypted.

--input-type currently json, yaml, dotenv, ini and binary are supported.

--output-type currently json, yaml, dotenv, ini and binary are supported."""

[[commands.subcommand.field]]

id = "file"

label = "Plaintext file"

type = "path"

position = 0

path = { kind = "file", role = "input" }

sources = ["help"]

[[commands.subcommand.field]]

id = "in_place"

label = "Encrypt in place"

type = "boolean"

option = ["--in-place", "-i"]

effect = "overwrite"

sources = ["help"]

[[commands.subcommand.field]]

id = "output"

label = "Output file"

type = "path"

option = ["--output"]

path = { kind = "file", role = "output" }

effect = "overwrite"

sources = ["help"]

[[commands.subcommand.field]]

id = "age"

label = "age recipients"

description = "Comma separated list of age recipients."

type = "string"

option = ["--age", "-a"]

sources = ["help"]

[[commands.subcommand.field]]

id = "pgp"

label = "PGP fingerprints"

description = "Comma separated list of PGP fingerprints."

type = "string"

option = ["--pgp", "-p"]

sources = ["help"]

[[commands.subcommand.field]]

id = "kms"

label = "KMS ARNs"

description = "Comma separated list of KMS ARNs."

type = "string"

option = ["--kms", "-k"]

sources = ["help"]

[[commands.subcommand.field]]

id = "encrypted_regex"

label = "Encrypted key regex"

type = "string"

option = ["--encrypted-regex"]

sources = ["help"]

[[commands.subcommand.field]]

id = "unencrypted_regex"

label = "Unencrypted key regex"

type = "string"

option = ["--unencrypted-regex"]

sources = ["help"]

[[commands.subcommand.field]]

id = "input_type"

label = "Input type"

type = "enum"

option = ["--input-type"]

choices = [{ value = "json", label = "JSON" }, { value = "yaml", label = "YAML" }, { value = "dotenv", label = "dotenv" }, { value = "ini", label = "INI" }, { value = "binary", label = "Binary" }]

sources = ["help"]

[[commands.subcommand.field]]

id = "output_type"

label = "Output type"

type = "enum"

option = ["--output-type"]

choices = [{ value = "json", label = "JSON" }, { value = "yaml", label = "YAML" }, { value = "dotenv", label = "dotenv" }, { value = "ini", label = "INI" }, { value = "binary", label = "Binary" }]

sources = ["help"]

[[commands.subcommand.task]]

id = "age"

label = "Encrypt for age"

fields = ["file", "age", "output", "encrypted_regex"]

required = ["file", "age"]

[[commands.subcommand.task]]

id = "in-place"

label = "Encrypt in place"

set = { in_place = [true] }

lock = ["in_place"]

fields = ["file", "in_place", "age", "pgp", "kms"]

required = ["file"]

[[commands.subcommand.group]]

id = "basic"

label = "Basic"

fields = ["file", "age", "pgp", "kms", "output", "in_place"]

[[commands.subcommand.group]]

id = "advanced"

label = "Advanced"

fields = ["encrypted_regex", "unencrypted_regex", "input_type", "output_type"]

Use it with your dotfile manager

Same data, in the shape your tool already reads

Opens Otty and adds this tool to what it syncs

Opens otty://sync/add/sops. Otty ships with this catalog, so the link only has to name the tool — nothing is downloaded.

Every one of these keeps all credential files out.