meta: add sops for secrets management

- secrets.dev.yaml / secrets.prod.yaml (encrypted)
- .sops-age-key.txt (git-ignored, team-shared)
- sops exec-env for automatic decryption

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <[email protected]>

Author: aster-void

.gitignore

@@ -15,6 +15,7 @@ vite.config.ts.timestamp-*
 .env.*
 !.env.sample
 !.env.test
+.sops-age-key.txt
 .DS_Store
 Thumbs.db
 *.db

.sops.yaml

@@ -0,0 +1,8 @@
+keys:
+  - &project age1gsn5pg5pkk89zsukc94gqwlu7zyrep0prm7pwc787tcegapgmvgqzeq64c
+
+creation_rules:
+  - path_regex: secrets\.(dev|prod)\.yaml$
+    key_groups:
+      - age:
+          - *project

README.md

@@ -7,6 +7,7 @@ utcode.net の CMS 駆動版フォーク (フォークではない) です。そ
 環境構築
 
 - [devenv](https://devenv.sh/) パッケージをインストールします
+- `.sops-age-key.txt` を配置します（チームメンバーから取得）
 
 ```sh
 direnv allow
@@ -42,6 +43,33 @@ process compose に接続 (F10 + enter で退出)
 bun attach
 ```
 
+## Secrets
+
+シークレットは sops で暗号化されています。
+
+```sh
+# 編集
+sops secrets.dev.yaml
+sops secrets.prod.yaml
+```
+
+### 鍵のローテーション
+
+```sh
+# 1. 新しい鍵を生成
+age-keygen
+
+# 2. .sops.yaml に新しい公開鍵を追加（古い鍵も残す）
+
+# 3. .sops-age-key.txt に新しい秘密鍵を追加（古い鍵も残す）
+
+# 4. 再暗号化（古い鍵で復号→新しい鍵で暗号化）
+sops updatekeys -y secrets.dev.yaml
+sops updatekeys -y secrets.prod.yaml
+
+# 5. 古い鍵を .sops.yaml と .sops-age-key.txt から削除
+```
+
 ## Data Access Layer
 
 データ操作は DAL `$lib/server/data/*` から import します。直接 db を触りません。

devenv.nix

@@ -1,5 +1,7 @@
 {pkgs, ...}: {
-  packages = [pkgs.postgresql];
+  packages = [pkgs.postgresql pkgs.sops pkgs.age];
+
+  env.SOPS_AGE_KEY_FILE = ".sops-age-key.txt";
 
   languages.javascript = {
     enable = true;
@@ -12,7 +14,7 @@
 
   dotenv.disableHint = true;
   processes.dev = {
-    exec = "bun dev";
+    exec = "sops exec-env secrets.dev.yaml 'vite dev'";
     process-compose.availability = {
       restart = "on_failure";
       backoff_seconds = 10;

package.json

@@ -4,8 +4,8 @@
   "version": "0.0.1",
   "type": "module",
   "scripts": {
-    "dev": "bun --env-file=.env vite dev",
-    "build": "bun --env-file=.env vite build",
+    "dev": "sops exec-env secrets.dev.yaml 'vite dev'",
+    "build": "sops exec-env secrets.prod.yaml 'vite build'",
     "preview": "vite preview",
     "prepare": "svelte-kit sync",
     "test-check": "bun test",

secrets.dev.yaml

@@ -0,0 +1,26 @@
+DATABASE_URL: ENC[AES256_GCM,data:DT1kdctK4pK5GF/Ysn3ULxVOK3Vu+7cb7sA=,iv:rqxTwZ31IwSJ4IcrKxdiTQLP7KNAmkf8NBTU5sOZpA0=,tag:KqrGB6S1dgKniSbA+z5pmA==,type:str]
+BETTER_AUTH_URL: ENC[AES256_GCM,data:HTm98h7WLoXX92kkFAB3SF8DQE3s,iv:/yFx+YaJHkGi5+mMIDc2dW7bWXEPrLfl4udJAbfx75c=,tag:GxJutrvSDayFdIam7DBWsA==,type:str]
+BETTER_AUTH_SECRET: ENC[AES256_GCM,data:iWFfgHGgQhqxHQPS0MrhOQuCaHFi5Y474Ret+WMkjoeVjo5wGQzGmQaaRcE=,iv:CWOE30RroxpvX9Mm9D/1M9jFhEaILwAqAVxcNhpxGKc=,tag:UXWoHgK39mrc+x9LMSCYiA==,type:str]
+GITHUB_CLIENT_ID: ""
+GITHUB_CLIENT_SECRET: ""
+S3_ENDPOINT: ENC[AES256_GCM,data:8DKqTQi0rLcxlbtQZOYaQOtstRlv,iv:ipAyykxrhdicmfT3l1oI4MSjIN6lVs5EiPVKrke8cJQ=,tag:SCRhvHIkQKJdz0UzhJ6rjQ==,type:str]
+S3_ACCESS_KEY: ENC[AES256_GCM,data:iZkREoP5BhiHvw==,iv:Urs+Ux5JDVsfJleuFAKrFxHF9Xg3/m7uEph0kln5Hv0=,tag:l5tXx04AVGfdAiRJJHb3nw==,type:str]
+S3_SECRET_KEY: ENC[AES256_GCM,data:53MOStu3RyL3CA==,iv:5nzXZ3BV5gYgTj0Kt4YJEDhidLXRqQiq4YyCe4fiXCo=,tag:RkJ+WKqylheG5azXkhRlnw==,type:str]
+S3_BUCKET: ENC[AES256_GCM,data:NOun,iv:UhkU0jiq8pee9jboSLDZT3XK+fG9NrLozhWaEAKxqRM=,tag:omC3c8OYgS2KbbpwIwMWvA==,type:str]
+S3_PUBLIC_URL: ENC[AES256_GCM,data:o/JRmwxFNqjrMHZJ/eoynCIMcjNIC7G3nw==,iv:8Ut2k/uuhobj7i37J3P3Vb/AUhFLofSoWB6X+Y3g39o=,tag:j1XOf1meTwI0ZoqoYeEvjg==,type:str]
+UNSAFE_DISABLE_AUTH: ENC[AES256_GCM,data:qQfxNQ==,iv:j250CMhk9ZPKEXrVjh+Ls99gEpqhAzQSdCtBhbyDRkA=,tag:9R7/YtAI+VgJUKAPcTHpQg==,type:str]
+sops:
+  age:
+    - recipient: age1gsn5pg5pkk89zsukc94gqwlu7zyrep0prm7pwc787tcegapgmvgqzeq64c
+      enc: |
+        -----BEGIN AGE ENCRYPTED FILE-----
+        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaZ0NjbVpFbVJ5TS8xSlNW
+        a0hmOXRrQ2xpYkVJWHhVRm9lODRTUldxeTE0CnRGemp4dEZKV29JbjhPL2RVa3lG
+        WGNTdE9RYmZ0L1BQRjQyQ1dwU0x3dlkKLS0tIFc4NXE4ZFRhYmFtWlR2M3lpWVV1
+        Y2M0Q3NYeFBVTjZKOFNIS0x6dnRPUEEKCt8q9U5HaLS0Mm2JNmODlECAYjN8nn+1
+        zlbwhcAUqbhFd8HteSbp8jTgp14PUuig/c2c3JDOmgQfiITZaxLayQ==
+        -----END AGE ENCRYPTED FILE-----
+  lastmodified: "2025-12-23T06:23:33Z"
+  mac: ENC[AES256_GCM,data:lyuVzf2Zm8UTIMQNFCeg1BIKR9pfHOorS08alTMKJRHwdqKsziDu9lm86/6iOmUFpyasoG1J2sZN95ltq0IPOooV9sm28QvlNon8HBaNGkgvVRfCeU9vuKQrcp7OOSGI2Vqe38ZIveyBbhTPtqjoLuJfnXkoFiV2s1kPgySxFLM=,iv:OsDm31BPcCveHRqPpn8IpO3GvwKJ/DfCx/eYbWHGceY=,tag:xvVJ2K6xE12HykR8CIpcGA==,type:str]
+  unencrypted_suffix: _unencrypted
+  version: 3.11.0

secrets.prod.yaml

@@ -0,0 +1,25 @@
+DATABASE_URL: ENC[AES256_GCM,data:yeNu+S3M0VnuH7hvK3kGRF2go8EbS2MotGCw+6Jlc3y+nyS8GOP+RzhCy7NnXZ+5zN+CBN4fKrg1qpTOenINluWhwD5AQbjYaCgtm+oIdL7Cg+raoEwNhRsbd1t1xe+svybfnhzgOzsyOyif3NlF9+vL4NLgb8qDT8AB,iv:x+YcNSMnPlPqr2e2gTh7NBq70A+YDKZyy3VvvKvyRjY=,tag:3CD7DaCUiAzVRrsKiO4qcg==,type:str]
+BETTER_AUTH_URL: ENC[AES256_GCM,data:mMEpPLOUsbmHwyUvdJwv4/jflivYHg==,iv:nGCNOmoWa30ysfcnWY3gubhFgPxx3RopmM/tIjr+EMA=,tag:977UziyM+GqVX7SK3Cs+3g==,type:str]
+BETTER_AUTH_SECRET: ENC[AES256_GCM,data:Rgh5ya4IBiS+ZKQk+8lpLxVjzXV6sDK7U6TGrHHi3V/uuMg55HDjbkmLwONbm7PuQOqTpV+3pISlG/dRInlh/wmJcl2Mr3nGcqTEFaA2rRmxdIVJfNqidxNC7KoBdSFcO2NY8ZCpICrjrxl9494wXEXXCHYQscltopfNQAFGlvI=,iv:l69cgwj8+uTj0xw+L9F+UDLXCg0wYs7gwb8SXQKW858=,tag:zQwqgfBMFrGUWJs47ISfBA==,type:str]
+GITHUB_CLIENT_ID: ENC[AES256_GCM,data:SKLeGCEiy8BP3UmtebbiZICqw+k=,iv:n50b+6abyQBFNkOSBKuPBcMqlLUOR39wlktL4nJGaRw=,tag:vDZv+aOeNcpXQ+A4SJ0ciw==,type:str]
+GITHUB_CLIENT_SECRET: ENC[AES256_GCM,data:18cBqoMAL7IiR4dl3n1GhvOmmFyZhVe8hqR+qY8fXrK+qdegdKWqng==,iv:3l45zSgfHFhCnVpZ2R7n5CQg4tgxKuhlZfRN08dqU8M=,tag:QB328THI7oAi0yq+0Ek6Cg==,type:str]
+S3_ENDPOINT: ENC[AES256_GCM,data:rVTUiIUOPfTeDsi/3RzIa3LhkqwYstDV8vUv3506+kLPL8DICEct0csfsHSaBa6fgQ87e8go0m3IF7+50YpGSn8=,iv:m1btfdrLSQTrtuBjBMRmextX0RCZgsLsCkI2J1knr04=,tag:Xxbx2qTqAefATucxBD7SOQ==,type:str]
+S3_ACCESS_KEY: ENC[AES256_GCM,data:JH70m0+9+KlfjXlDzVqJGYLFy8xRN3fxIV0YwmB9aRE=,iv:dOeu3KHCRrUIUiraFgMf2/tXlTxZioh1+aR5wqshP94=,tag:hTdWpkb8Im3ypxZ1Ijsf+Q==,type:str]
+S3_SECRET_KEY: ENC[AES256_GCM,data:QEc9T5yC+iZoV403CqqBTJCsDCdzH2FV0vQoRlEU6vM0oK5PrHiTOXUwe4WMSFCiz3ioBvgQOKHoan963U0gZA==,iv:0qZE002nF25N91pvITA65qBSyi2mDzRXNP/2pcBnI0o=,tag:gFQU5CJDr0FDWiWcFl05Ng==,type:str]
+S3_BUCKET: ENC[AES256_GCM,data:kKVmATCe2JYggI5bXjch9kiCbqVb,iv:WBVmx8TWKbJ3xWHiGy3/Os4xlPfcuDMz3xoWnzsTato=,tag:BqnD6HXBC4A9qqeREcB6Sw==,type:str]
+S3_PUBLIC_URL: ENC[AES256_GCM,data:yF9V11xmPsO9fAyozCVUWwC+z16+guLMNA==,iv:n8mEi0E8bvxK68hHZ6yd8dBlfi10sETNNXQBMt1ygrw=,tag:7ZK8/MM2xVTi8N65q0+v5g==,type:str]
+sops:
+    age:
+        - recipient: age1gsn5pg5pkk89zsukc94gqwlu7zyrep0prm7pwc787tcegapgmvgqzeq64c
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwRWovR2lYZjk5UzQ0Y2Ri
+            QXAxam5LaEY2S3hFREVEUHJzdDNQbCs2T3hnCkprMDNlamZPQmhvTXh1SUdOUHNX
+            OEhTYWlLMVdsaVRuUDdPRVZvRmc3VkEKLS0tIGlOK1JScmJtQVJPWXErZkc2VVNR
+            NHZSdEp1WGc4S2ppK1ZKcDZnU0JRQmMKJj4n6DBAozt2DTlYFIhd1jWWLGMYalAM
+            +Txthl+D2hQNSITfK7jzVXIhk4z3g2ahNXscRmgrU9u4V0Jj6Gzz/g==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-12-23T06:48:31Z"
+    mac: ENC[AES256_GCM,data:51C/AiU7T7aqHxqvhl/+sc82nigPHlKzLDXqXDyfR5PGfNKsnP7/u/X3xsp6VhNv+itnRCp/29rG3qjKnbjm04uS28bIRmSzaUrDK6/b3ASnJIexhsuAeZFsjqPaJ0IpECdrmn7D2ZXrJQw7qx1LpKlFsHBK8awlE1JDcmdAFXY=,iv:hF63GDjwaKZ5t+/oN5heoFSLHuIJ9tgvqyHNoaDxmjA=,tag:L9gvHacn2UAi693OkVydGA==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0