Encrypting .env Files for Version Control with sops and age

Your homelab server’s disk dies. You clone your repo onto the replacement, and everything that took weeks to get right comes back in seconds: every compose file, every bind mount, every pinned image tag. Then you bring up Immich: error while interpolating services.database.environment.POSTGRES_PASSWORD: required variable DB_PASSWORD is missing a value: err The repo has everything except the one file you deliberately kept out of it. If you keep Docker Compose stacks in git, you’ve probably gitignored your .env files, because they hold passwords and API tokens. You might have committed a .env.sample with blank values so you at least know which variables exist. That keeps secrets off GitHub, but it also leaves them out of the one place everything else is backed up. The sample can tell you that DB_PASSWORD exists. It can’t tell you what it was. So a rebuild turns into resetting database passwords and regenerating API keys, one service at a time. ...

October 13, 2026 · 11 min