Hook up SOPS with Git

Why use a Git hook?

Git hooks are scripts that run automatically at certain points in the Git workflow. By using a Git hook, you can ensure that sensitive files are encrypted before they are committed to the repository. This adds an extra layer of security and helps prevent accidental exposure of sensitive data. To set up a Git hook for SOPS, we will use pre-commit, a framework for managing and maintaining multi-language pre-commit hooks.

Install pre-commit

To use pre-commit, you need to install it on your system. You can install it using pip or Homebrew, depending on your operating system.

Pip
Homebrew

pip install pre-commit

brew install pre-commit

Add a pre-commit configuration

This configuration uses a custom script to encrypt files with SOPS before committing. The script will look for any files that match the pattern *.tfvars or *.tfstate and encrypt them using SOPS.

Create a .pre-commit-config.yaml file in the root of your repository with the following content:

1
repos:
2
  - repo: local
3
    hooks:
4
      - id: sops-encrypt
5
        name: Encrypt secrets to .enc files
6
        entry: .pre-commit-sops.sh
7
        language: script
8
        pass_filenames: false # prevents empty list from breaking things
9
        always_run: true # force it to run even if no files match
10
        exclude: "" # override exclusions so it runs every time

Create the custom pre-commit script

Create a script named .pre-commit-sops.sh in the root of your repository with the following content:

1
#!/bin/bash
2
set -euo pipefail
3

4
# Array of file extensions to check
5
FILE_EXTENTIONS=(
6
  "*.tfvars"
7
  "*.tfvars.json"
8
  "*.tfstate"
9
  "*.tfstate.backup"
10
  ".env"
11
)
12

13
# Find all secret files (even if ignored), excluding already encrypted
14
secret_files=$(find . \
15
  -type f \
16
  \( -name "${FILE_EXTENTIONS[0]}" \
17
  -o -name "${FILE_EXTENTIONS[1]}" \
18
  -o -name "${FILE_EXTENTIONS[2]}" \
19
  -o -name "${FILE_EXTENTIONS[3]}" \
20
  -o -name "${FILE_EXTENTIONS[4]}" \) \
21
  ! -name "*.enc")
22

23
# Track encrypted files to add after loop
24
enc_files_to_add=()
25

26
for filename in $secret_files; do
27
    enc_file="${filename}.enc"
28

29
    # Skip if already encrypted version exists
30
    [[ -f "$enc_file" ]] && continue
31

32
    # Skip if file already contains SOPS metadata
33
    grep -q 'sops:' "$filename" && continue
34

35
    # Encrypt and store output
36
    sops --encrypt "$filename" > "$enc_file"
37
    enc_files_to_add+=("$enc_file")
38
done
39

40
# Stage the new encrypted files
41
if [ ${#enc_files_to_add[@]} -gt 0 ]; then
42
    git add "${enc_files_to_add[@]}"
43
fi

Create the sops configuration file

Create a .sops.yaml file in the root of your repository with the following content:

1
creation_rules:
2
  # Encrypt .tfvars files (macOS only, used for provisioning)
3
  - path_regex: \.tfvars(\.json)?$
4
    encrypted_regex: "^(.*)$"
5
    age: "age1xxxx..." # macOS
6

7
  # Encrypt Terraform state and backups (macOS only)
8
  - path_regex: \.tfstate(\.backup)?$
9
    encrypted_regex: "^(.*)$"
10
    age: "age1xxxx..." # macOS
11

12
  # Encrypt .env files for Docker (used by NixOS)
13
  - path_regex: \.env$
14
    encrypted_regex: "^(.*)$"
15
    age: age1xxxx...,age1yyyy...

Install the git hook scripts

Run the following command in the root of your repository to install the pre-commit hooks:

pre-commit install

This command will set up the pre-commit hooks in your .git/hooks directory. Now pre-commit will run automatically before each commit and encrypt any files that match the specified patterns.

Test the setup

Create a new file with the .tfvars.json extension, for example test.tfvars.json, and add some sensitive data to it.
test.tfvars.json
```
1
{
2
  "pm_api_url": "https://ip:port/api2/json",
3
  "pm_api_token_id": "token",
4
  "pm_api_token_secret": "secret"
5
}
```
Run the following to stage the file:
Terminal window
```
git add test.tfvars.json
```

Commit the changes:

git commit -m "Test commit"

Example output:

Encrypt secrets to .enc files.......................Passed
[main 18ea29c] Test commit
 2 files changed, 22 insertions(+)
 create mode 100644 test.tfvars.json
 create mode 100644 test.tfvars.json.enc

Check the repository to see if the test.tfvars.json.enc file was created.

Verify that the encrypted file contains encrypted data. It should look something like:

1
{
2
  "pm_api_url": "ENC[AES256_GCM,data:...]",
3
  "pm_api_token_id": "ENC[AES256_GCM,data:...]",
4
  "pm_api_token_secret": "ENC[AES256_GCM,data:...]",
5
  "sops": {
6
    "age": [
7
      {
8
        "recipient": "age1w6th0yr0gp5...",
9
        "enc": "-----BEGIN AGE ENCRYPTED FILE-----\n..."
10
      }
11
    ],
12
    "lastmodified": "2025-05-17T20:53:08Z",
13
    "mac": "ENC[AES256_GCM,data:...]",
14
    "encrypted_regex": "^(.*)$",
15
    "version": "3.10.2"
16
  }
17
}

Test the decryption process by running:

sops decrypt --input-type json --output-type json test.tfvars.json.enc

Output:

1
{
2
  "pm_api_url": "https://ip:port/api2/json",
3
  "pm_api_token_id": "token",
4
  "pm_api_token_secret": "secret"
5
}

If everything works as expected, you can now use this setup to automatically encrypt sensitive files before committing them to the repository.

References