Secrets at Rest: SOPS and Age for Docker Compose Homelabs (opens in new tab)

SOPS encrypts .env files in place, git tracks the encrypted versions, and sops exec-file decrypts them into memory at deploy time. Plaintext never touches disk.