Encrypted Configuration#

InfraGuard supports encrypted configuration files using age (direct file encryption) and SOPS (per-value encryption within YAML). This keeps secrets out of version control while allowing the rest of the configuration to remain readable.

age Encryption#

age encrypts the entire configuration file. The file is decrypted at load time before YAML parsing.

Creating an Encrypted Config#

# Generate an age keypair
age-keygen -o infraguard.key

# Encrypt the config
age -r age1... -o config.yaml.age config.yaml

# Delete the plaintext
rm config.yaml

Identity Resolution#

InfraGuard looks for the age decryption key in this order:

1. INFRAGUARD_AGE_KEY environment variable (the key itself, inline)
2. INFRAGUARD_AGE_KEY_FILE environment variable (path to key file)
3. Default locations: ~/.config/infraguard/age.key, ./infraguard.key

Loading#

Age-encrypted configs are detected by the .age file extension:

# InfraGuard automatically detects and decrypts .age files
infraguard --config config.yaml.age

SOPS Encryption#

SOPS encrypts individual values within the YAML file, leaving keys and structure visible. This is useful when the config is stored in version control and you want reviewers to see which fields exist without exposing their values.

Creating a SOPS Config#

# Encrypt specific keys in the config
sops --encrypt --age age1... \
  --encrypted-regex '^(api_key|password|token|secret|upstream)$' \
  config.yaml > config.sops.yaml

Detection#

SOPS-encrypted files are auto-detected by the presence of a sops top-level key in the YAML:

domains:
  cdn.example.com:
    upstream: ENC[AES256_GCM,data:...,iv:...,tag:...]
sops:
  kms: []
  age:
    - recipient: age1...
      enc: |
        -----BEGIN AGE ENCRYPTED FILE-----
        ...

InfraGuard calls sops --decrypt on the file before parsing.

Combined with age Identity#

SOPS age decryption uses the same identity resolution as direct age encryption. Set INFRAGUARD_AGE_KEY or INFRAGUARD_AGE_KEY_FILE once and both mechanisms work.

Environment Variable Substitution#

Regardless of encryption method, InfraGuard supports ${ENV_VAR} interpolation in config values:

reputation_monitor:
  google_safebrowsing_api_key: "${GSB_API_KEY}"

Environment variables are resolved after decryption, so you can combine encrypted configs with runtime secrets from the environment.

.env File Support#

InfraGuard loads .env files from the working directory before resolving ${ENV_VAR} references:

# .env
GSB_API_KEY=AIzaSy...
INFRAGUARD_AGE_KEY_FILE=/run/secrets/age.key

Terraform State Encryption#

For infrastructure-as-code deployments, InfraGuard provides helpers to encrypt and decrypt Terraform state files using age:

# Encrypt state after apply
infraguard deploy encrypt-state --key age1... --state terraform.tfstate

# Decrypt state for inspection
infraguard deploy decrypt-state --key-file infraguard.key --state terraform.tfstate.age

The encrypted state replaces the plaintext file. Decryption writes to a temporary file with 0o600 permissions.