sops

Builds a small alpine-based image containing statically linked sops, age,
age-keygen and ssh-to-age binaries downloaded from their GitHub releases
(checksum-verified), and exposes functions to encrypt and decrypt sops files
with age keys, SSH ed25519 keys (converted via ssh-to-age) or a remote sops
keyservice. Versions are pinned and can be overridden via WithSopsVersion,
WithAgeVersion and WithSshToAgeVersion.

Installation

dagger install github.com/daniel-naegele/daggerverse/sops@003f668d6c6d5649dddbc4e47637d61f07d76483

Entrypoint

Return Type

Sops !

Example

dagger -m github.com/daniel-naegele/daggerverse/sops@003f668d6c6d5649dddbc4e47637d61f07d76483 call \

func (m *MyModule) Example() *dagger.Sops  {
	return dag.
			Sops()
}

@function
def example() -> dagger.Sops:
	return (
		dag.sops()
	)

@func()
example(): Sops {
	return dag
		.sops()
}

Types

Sops 🔗

sopsVersion() 🔗

sops version (getsops/sops release, without “v” prefix).

Return Type

String !

Example

dagger -m github.com/daniel-naegele/daggerverse/sops@003f668d6c6d5649dddbc4e47637d61f07d76483 call \
 sops-version

func (m *MyModule) Example(ctx context.Context) string  {
	return dag.
			Sops().
			Sopsversion(ctx)
}

@function
async def example() -> str:
	return await (
		dag.sops()
		.sopsversion()
	)

@func()
async example(): Promise<string> {
	return dag
		.sops()
		.sopsVersion()
}

ageVersion() 🔗

age version (FiloSottile/age release, without “v” prefix).

Return Type

String !

Example

dagger -m github.com/daniel-naegele/daggerverse/sops@003f668d6c6d5649dddbc4e47637d61f07d76483 call \
 age-version

func (m *MyModule) Example(ctx context.Context) string  {
	return dag.
			Sops().
			Ageversion(ctx)
}

@function
async def example() -> str:
	return await (
		dag.sops()
		.ageversion()
	)

@func()
async example(): Promise<string> {
	return dag
		.sops()
		.ageVersion()
}

sshToAgeVersion() 🔗

ssh-to-age version (Mic92/ssh-to-age release, without “v” prefix).

Return Type

String !

Example

dagger -m github.com/daniel-naegele/daggerverse/sops@003f668d6c6d5649dddbc4e47637d61f07d76483 call \
 ssh-to-age-version

func (m *MyModule) Example(ctx context.Context) string  {
	return dag.
			Sops().
			Sshtoageversion(ctx)
}

@function
async def example() -> str:
	return await (
		dag.sops()
		.sshtoageversion()
	)

@func()
async example(): Promise<string> {
	return dag
		.sops()
		.sshToAgeVersion()
}

ageKeygen() 🔗

AgeKeygen generates a new age keypair with age-keygen.

Every call generates a fresh key, so read PublicKey and PrivateKey from the same returned object (in Go: pin it via ID / LoadSopsAgeKeypairFromID).

Return Type

AgeKeypair !

Example

dagger -m github.com/daniel-naegele/daggerverse/sops@003f668d6c6d5649dddbc4e47637d61f07d76483 call \
 age-keygen

func (m *MyModule) Example() *dagger.SopsAgeKeypair  {
	return dag.
			Sops().
			Agekeygen()
}

@function
def example() -> dagger.SopsAgeKeypair:
	return (
		dag.sops()
		.agekeygen()
	)

@func()
example(): SopsAgeKeypair {
	return dag
		.sops()
		.ageKeygen()
}

container() 🔗

Container returns a minimal alpine-based image with sops, age, age-keygen and ssh-to-age installed in /usr/local/bin. The entrypoint is sops and the working directory is /work.

Return Type

Container !

Arguments

Name	Type	Default Value	Description
platform	Scalar	-	Target platform (linux/amd64 or linux/arm64). Defaults to the engine’s platform.

Example

dagger -m github.com/daniel-naegele/daggerverse/sops@003f668d6c6d5649dddbc4e47637d61f07d76483 call \
 container

func (m *MyModule) Example() *dagger.Container  {
	return dag.
			Sops().
			Container()
}

@function
def example() -> dagger.Container:
	return (
		dag.sops()
		.container()
	)

@func()
example(): Container {
	return dag
		.sops()
		.container()
}

decrypt() 🔗

Decrypt decrypts a sops-encrypted file and returns the plaintext file (same name).

Decryption keys can come from an age identity (ageKey), an SSH ed25519 private key (sshKey, converted to an age identity via ssh-to-age) and/or one or more sops keyservices (keyservice / keyserviceAddress) that hold the key, so the decrypting container never sees it.

Return Type

File !

Arguments

Name	Type	Default Value	Description
file	File !	-	sops-encrypted file. The format is detected from the file extension unless inputType is set.
ageKey	Secret	-	age identity file contents (“AGE-SECRET-KEY-1…”; multiple lines allowed).
sshKey	Secret	-	OpenSSH ed25519 private key; converted to an age identity with ssh-to-age. The file must have been encrypted to the matching ssh-to-age recipient.
keyservice	Service	-	sops keyservice to bind (e.g. from Keyservice()); reached at tcp://sops-keyservice:.
keyservicePort	Integer	5000	Port of the bound keyservice.
keyserviceAddress	[String ! ]	-	Additional keyservice addresses (e.g. “tcp://10.0.0.5:5000”).
inputType	String	-	Input format (yaml, json, dotenv, ini, binary). Defaults to the file extension.
outputType	String	-	Output format (yaml, json, dotenv, ini, binary). Defaults to the input format.
extract	String	-	Extract a single value, e.g. ‘[“database”][“password”]’.

Example

dagger -m github.com/daniel-naegele/daggerverse/sops@003f668d6c6d5649dddbc4e47637d61f07d76483 call \
 decrypt --file file:path

func (m *MyModule) Example(file *dagger.File) *dagger.File  {
	return dag.
			Sops().
			Decrypt(file)
}

@function
def example(file: dagger.File) -> dagger.File:
	return (
		dag.sops()
		.decrypt(file)
	)

@func()
example(file: File): File {
	return dag
		.sops()
		.decrypt(file)
}

encrypt() 🔗

Encrypt encrypts a plaintext file with sops and returns the encrypted file (same name).

Only public material is needed: age recipients, SSH public keys (converted to age recipients via ssh-to-age) and/or a .sops.yaml config with creation rules. No private or decryption key is required.

Return Type

File !

Arguments

Name	Type	Default Value	Description
file	File !	-	Plaintext file. The format is detected from the file extension unless inputType is set.
ageRecipients	[String ! ]	-	age recipients (“age1…”).
sshPublicKeys	[String ! ]	-	SSH ed25519 public keys (“ssh-ed25519 AAAA…”); converted to age recipients with ssh-to-age.
config	File	-	sops config (.sops.yaml) whose creation_rules select recipients and options.
filePath	String	-	Path of the file relative to the config, used to match creation_rules path_regex. Defaults to the file name.
encryptedRegex	String	-	Only encrypt values whose key matches this regex.
unencryptedRegex	String	-	Do not encrypt values whose key matches this regex.
encryptedSuffix	String	-	Only encrypt values whose key ends with this suffix.
unencryptedSuffix	String	-	Do not encrypt values whose key ends with this suffix.
inputType	String	-	Input format (yaml, json, dotenv, ini, binary). Defaults to the file extension.
outputType	String	-	Output format (yaml, json, dotenv, ini, binary). Defaults to the input format.

Example

dagger -m github.com/daniel-naegele/daggerverse/sops@003f668d6c6d5649dddbc4e47637d61f07d76483 call \
 encrypt --file file:path

func (m *MyModule) Example(file *dagger.File) *dagger.File  {
	return dag.
			Sops().
			Encrypt(file)
}

@function
def example(file: dagger.File) -> dagger.File:
	return (
		dag.sops()
		.encrypt(file)
	)

@func()
example(file: File): File {
	return dag
		.sops()
		.encrypt(file)
}

keyservice() 🔗

Keyservice returns a sops keyservice (gRPC over TCP) holding the given keys.

Bind it to another container and pass “–keyservice tcp://:” to sops there; that container can then decrypt without ever holding the key. Decrypt does this automatically via its keyservice argument.

Return Type

Service !

Arguments

Name	Type	Default Value	Description
ageKey	Secret	-	age identity file contents (“AGE-SECRET-KEY-1…”).
sshKey	Secret	-	OpenSSH ed25519 private key; converted to an age identity with ssh-to-age.
port	Integer	5000	TCP port to listen on.

Example

dagger -m github.com/daniel-naegele/daggerverse/sops@003f668d6c6d5649dddbc4e47637d61f07d76483 call \
 keyservice

func (m *MyModule) Example() *dagger.Service  {
	return dag.
			Sops().
			Keyservice()
}

@function
def example() -> dagger.Service:
	return (
		dag.sops()
		.keyservice()
	)

@func()
example(): Service {
	return dag
		.sops()
		.keyservice()
}

latestAgeVersion() 🔗

LatestAgeVersion returns the latest released age version (e.g. “1.3.2”).

Return Type

String !

Arguments

Name	Type	Default Value	Description
token	Secret	-	GitHub token to avoid API rate limits.

Example

dagger -m github.com/daniel-naegele/daggerverse/sops@003f668d6c6d5649dddbc4e47637d61f07d76483 call \
 latest-age-version

func (m *MyModule) Example(ctx context.Context) string  {
	return dag.
			Sops().
			Latestageversion(ctx)
}

@function
async def example() -> str:
	return await (
		dag.sops()
		.latestageversion()
	)

@func()
async example(): Promise<string> {
	return dag
		.sops()
		.latestAgeVersion()
}

latestSopsVersion() 🔗

LatestSopsVersion returns the latest released sops version (e.g. “3.13.3”).

Return Type

String !

Arguments

Name	Type	Default Value	Description
token	Secret	-	GitHub token to avoid API rate limits.

Example

dagger -m github.com/daniel-naegele/daggerverse/sops@003f668d6c6d5649dddbc4e47637d61f07d76483 call \
 latest-sops-version

func (m *MyModule) Example(ctx context.Context) string  {
	return dag.
			Sops().
			Latestsopsversion(ctx)
}

@function
async def example() -> str:
	return await (
		dag.sops()
		.latestsopsversion()
	)

@func()
async example(): Promise<string> {
	return dag
		.sops()
		.latestSopsVersion()
}

latestSshToAgeVersion() 🔗

LatestSshToAgeVersion returns the latest released ssh-to-age version (e.g. “1.3.0”).

Return Type

String !

Arguments

Name	Type	Default Value	Description
token	Secret	-	GitHub token to avoid API rate limits.

Example

dagger -m github.com/daniel-naegele/daggerverse/sops@003f668d6c6d5649dddbc4e47637d61f07d76483 call \
 latest-ssh-to-age-version

func (m *MyModule) Example(ctx context.Context) string  {
	return dag.
			Sops().
			Latestsshtoageversion(ctx)
}

@function
async def example() -> str:
	return await (
		dag.sops()
		.latestsshtoageversion()
	)

@func()
async example(): Promise<string> {
	return dag
		.sops()
		.latestSshToAgeVersion()
}

publish() 🔗

Publish builds the multi-arch sops image and pushes it to a container registry.

Publishes two tags: - /sops: - /sops:latest

Returns the image reference (with digest) of the version tag.

Return Type

String !

Arguments

Name	Type	Default Value	Description
registry	String !	-	No description provided
username	String !	-	No description provided
password	Secret !	-	No description provided
platforms	String	"linux/amd64,linux/arm64"	No description provided

Example

dagger -m github.com/daniel-naegele/daggerverse/sops@003f668d6c6d5649dddbc4e47637d61f07d76483 call \
 publish --registry string --username string --password env:MYSECRET

func (m *MyModule) Example(ctx context.Context, registry string, username string, password *dagger.Secret) string  {
	return dag.
			Sops().
			Publish(ctx, registry, username, password)
}

@function
async def example(registry: str, username: str, password: dagger.Secret) -> str:
	return await (
		dag.sops()
		.publish(registry, username, password)
	)

@func()
async example(registry: string, username: string, password: Secret): Promise<string> {
	return dag
		.sops()
		.publish(registry, username, password)
}

sshToAge() 🔗

SshToAge converts an SSH ed25519 public key (“ssh-ed25519 AAAA…”) to an age recipient (“age1…”).

Return Type

String !

Arguments

Name	Type	Default Value	Description
publicKey	String !	-	No description provided

Example

dagger -m github.com/daniel-naegele/daggerverse/sops@003f668d6c6d5649dddbc4e47637d61f07d76483 call \
 ssh-to-age --public-key string

func (m *MyModule) Example(ctx context.Context, publicKey string) string  {
	return dag.
			Sops().
			Sshtoage(ctx, publicKey)
}

@function
async def example(publickey: str) -> str:
	return await (
		dag.sops()
		.sshtoage(publickey)
	)

@func()
async example(publicKey: string): Promise<string> {
	return dag
		.sops()
		.sshToAge(publicKey)
}

withAgeVersion() 🔗

WithAgeVersion returns this module configured to use the given age version.

Return Type

Sops !

Arguments

Name	Type	Default Value	Description
version	String !	-	No description provided

Example

dagger -m github.com/daniel-naegele/daggerverse/sops@003f668d6c6d5649dddbc4e47637d61f07d76483 call \
 with-age-version --version string

func (m *MyModule) Example(version string) *dagger.Sops  {
	return dag.
			Sops().
			Withageversion(version)
}

@function
def example(version: str) -> dagger.Sops:
	return (
		dag.sops()
		.withageversion(version)
	)

@func()
example(version: string): Sops {
	return dag
		.sops()
		.withAgeVersion(version)
}

withSopsVersion() 🔗

WithSopsVersion returns this module configured to use the given sops version.

Return Type

Sops !

Arguments

Name	Type	Default Value	Description
version	String !	-	No description provided

Example

dagger -m github.com/daniel-naegele/daggerverse/sops@003f668d6c6d5649dddbc4e47637d61f07d76483 call \
 with-sops-version --version string

func (m *MyModule) Example(version string) *dagger.Sops  {
	return dag.
			Sops().
			Withsopsversion(version)
}

@function
def example(version: str) -> dagger.Sops:
	return (
		dag.sops()
		.withsopsversion(version)
	)

@func()
example(version: string): Sops {
	return dag
		.sops()
		.withSopsVersion(version)
}

withSshToAgeVersion() 🔗

WithSshToAgeVersion returns this module configured to use the given ssh-to-age version.

Return Type

Sops !

Arguments

Name	Type	Default Value	Description
version	String !	-	No description provided

Example

dagger -m github.com/daniel-naegele/daggerverse/sops@003f668d6c6d5649dddbc4e47637d61f07d76483 call \
 with-ssh-to-age-version --version string

func (m *MyModule) Example(version string) *dagger.Sops  {
	return dag.
			Sops().
			Withsshtoageversion(version)
}

@function
def example(version: str) -> dagger.Sops:
	return (
		dag.sops()
		.withsshtoageversion(version)
	)

@func()
example(version: string): Sops {
	return dag
		.sops()
		.withSshToAgeVersion(version)
}

AgeKeypair 🔗

AgeKeypair is a freshly generated age identity and its recipient.

publicKey() 🔗

age recipient (“age1…”), safe to share.

Return Type

String !

Example

dagger -m github.com/daniel-naegele/daggerverse/sops@003f668d6c6d5649dddbc4e47637d61f07d76483 call \
 age-keygen \
 public-key

func (m *MyModule) Example(ctx context.Context) string  {
	return dag.
			Sops().
			Agekeygen().
			Publickey(ctx)
}

@function
async def example() -> str:
	return await (
		dag.sops()
		.agekeygen()
		.publickey()
	)

@func()
async example(): Promise<string> {
	return dag
		.sops()
		.ageKeygen()
		.publicKey()
}

privateKey() 🔗

age identity file contents (“AGE-SECRET-KEY-1…”).

Return Type

Secret !

Example

dagger -m github.com/daniel-naegele/daggerverse/sops@003f668d6c6d5649dddbc4e47637d61f07d76483 call \
 age-keygen \
 private-key

func (m *MyModule) Example() *dagger.Secret  {
	return dag.
			Sops().
			Agekeygen().
			Privatekey()
}

@function
def example() -> dagger.Secret:
	return (
		dag.sops()
		.agekeygen()
		.privatekey()
	)

@func()
example(): Secret {
	return dag
		.sops()
		.ageKeygen()
		.privateKey()
}