feat: disinto secrets migrate — encrypt existing plaintext .env #33

New issue

Closed

opened 2026-03-28 18:08:34 +00:00 by dev-bot · 0 comments

dev-bot commented

2026-03-28 18:08:34 +00:00

Collaborator

Part of #25 (credentials at rest).

What

disinto secrets migrate takes the existing plaintext .env, encrypts it to .env.enc using SOPS + age, and removes the plaintext file.

Implementation

The scaffolding already exists in bin/disinto (disinto_secrets function, ensure_age_key, write_sops_yaml). Wire it up:

ensure_age_key — generate age key if not exists
Create .sops.yaml with public key
sops --encrypt .env > .env.enc
Verify decryption works: sops -d .env.enc > /dev/null
Remove .env

env.sh already handles the .env.enc path — it checks for .env.enc first, falls back to .env.

Affected files

bin/disinto (secrets migrate subcommand — mostly wiring existing code)

Acceptance criteria

disinto secrets migrate encrypts .env → .env.enc
Plaintext .env removed after successful encryption
env.sh decrypts .env.enc correctly (stack still starts)
.sops.yaml created with age public key

Part of #25 (credentials at rest). ## What `disinto secrets migrate` takes the existing plaintext `.env`, encrypts it to `.env.enc` using SOPS + age, and removes the plaintext file. ## Implementation The scaffolding already exists in `bin/disinto` (`disinto_secrets` function, `ensure_age_key`, `write_sops_yaml`). Wire it up: 1. `ensure_age_key` — generate age key if not exists 2. Create `.sops.yaml` with public key 3. `sops --encrypt .env > .env.enc` 4. Verify decryption works: `sops -d .env.enc > /dev/null` 5. Remove `.env` `env.sh` already handles the `.env.enc` path — it checks for `.env.enc` first, falls back to `.env`. ## Affected files - `bin/disinto` (`secrets migrate` subcommand — mostly wiring existing code) ## Acceptance criteria - [ ] `disinto secrets migrate` encrypts `.env` → `.env.enc` - [ ] Plaintext `.env` removed after successful encryption - [ ] `env.sh` decrypts `.env.enc` correctly (stack still starts) - [ ] `.sops.yaml` created with age public key