chore: drop sops+age

README.md

@@ -86,11 +86,6 @@ models:
         gpu: "0.2" # fraction of a gpu to use
 ```
 
-### Secrets
-
-You may supply your encrypted deployment's secrets in `values.<env>.yaml`.
-This is set up to encrypt values with sops+age; if you maintain those, see [CONTRIBUTING.md](CONTRIBUTING.md#secrets).
-
 ### Manual installation steps
 
 Some steps need to be done manually the first time this is deployed, since the relevant configuration can't be set automatically.

docs/CONTRIBUTING.md

@@ -23,31 +23,9 @@ Without nix, run it manually once (it is idempotent).
 
 ## Common tasks
 
-Run `just` (or `just --list`) to see everything. Tooling recipes are in the ### Manual installation steps
-justfile (e.g. `just lint`), whereas specialized recipes (e.g. `just sops::edit <file>`) are in just modules under `tools/just`.
+Run `just` (or `just --list`) to see everything. Tooling recipes are in the justfile (e.g. `just lint`),
+whereas specialized recipes (e.g. `just helm::template`) are in just modules under `tools/just`.
 
 ## pre-commit
 
 Pre-commit hooks are set up via `prek` and run some `just` recipes.
-
-## Secrets
-
-Shared-deployment values files (`values.*.yaml`) are encrypted with
-[sops](https://github.com/getsops/sops) and [age](https://github.com/FiloSottile/age);
-`tools/config/.sops.yaml` controls which keys can decrypt them and which fields are encrypted.
-
-One-time setup:
-
-1. Create an encrypted age key file: `just sops::keygen <key-path>.age`
-2. Ask someone already listed in `tools/config/.sops.yaml` to add your public key and
-   re-encrypt (`just sops::updatekeys`).
-3. Tell `just`/sops where your key is: copy `example.env` to `.env` (gitignored,
-   auto-loaded by `just`) and set `SOPS_AGE_KEY_FILE` to your key's path.
-
-To work with encrypted files, list recipes by running `just sops`.
-
-> [!NOTE]
->
-> If you wish to run sops/age directly without using just,
-> make sure to export `SOPS_AGE_KEY_FILE` and point sops to
-> the config using `--config tools/config/..sops.yaml`.

justfile

@@ -10,9 +10,6 @@ go_modules := "scripts/init otlp-openmeter-bridge"
 # Manage nix environment.
 [group('modules')]
 mod nix "./tools/just/nix.just"
-# Manage secrets with sops+age.
-[group('modules')]
-mod sops "./tools/just/sops.just"
 # Manage the helm chart.
 [group('modules')]
 mod helm "./tools/just/helm.just"
@@ -60,8 +57,9 @@ build *args:
 
 # Clean up generated files.
 [group('general')]
+[confirm("Delete everything in:\n" + output_dir + "?\n [y/n]")]
 clean: helm::clean
-  rm -r "{{output_dir}}"/*
+    rm -fr "{{output_dir}}"/*
 
 # Test the Go modules.
 [group('general')]
@@ -74,9 +72,7 @@ test *args:
 # Deploy Helm chart.
 [group('chart')]
 deploy namespace release values_file:
-  just sops::run exec-file \
-      "{{values_file}}" \
-      'helm upgrade --install -n "{{namespace}}" "{{release}}" . --values "{}"'
+    helm upgrade --install -n "{{namespace}}" "{{release}}" . --values "{{values_file}}"
 
 # Errors if the repository contains unformatted files.
 [private]
@@ -87,4 +83,4 @@ check-format *args:
 # Check for secret leaks.
 [private]
 check-leaks *args:
-  gitleaks git --config ./tools/config/gitleaks_extend.toml {{args}}
+    gitleaks git {{args}}

tools/nix/flake.nix

@@ -67,10 +67,8 @@
             (callPackage ./packages/helmfmt.nix { helmfmt-src = inputs.helmfmt-src; })
           ];
           devTools = with pkgs; [
-            age
             gitleaks
             prek
-            sops
             zsh
           ];
           goModule = import ./modules/go.nix { inherit pkgs; };