Build Doppler

KINDAreplaces $21/mosaves $252/yrback to the verdict

0%0 of 16 items done

Saved on this device only. Tick prerequisites first, then work the phases in order · do not start one until the checks above it pass.

Secrets management without a secrets server: sops and age encrypt env files you commit, a wrapper decrypts them into a process and never to disk, environments have different recipients so a laptop key cannot read production, CI holds one key, rotation removes a leaver, and a push command feeds one platform.

estimated effort one sittingthe files for this build are in the project pack

Encryptionsops with ageWrapperA small shell or Node script

Before step 1

Everything below is assumed from the first step. Tick each one when you actually have it, not when you plan to.

installfree
Why Every step below is a command you type or a file you edit.
Get it VS Code (code.visualstudio.com), Cursor or Zed. Open a folder for the project and use the editor's built-in terminal. open ↗
Verify You can open a folder and run a command in its terminal
installfree
Why History for your code, and the way most hosts deploy.
Get it Install from git-scm.com or with your package manager, then run git init in the project folder once it exists. open ↗
Verify git --version prints a version
installfree
Why The whole mechanism.
Get it brew install sops age, or the releases pages. age-keygen -o key.txt creates a key pair. open ↗
Verify sops --version and age --version print
decidefree
Why Recipients define who can decrypt each environment.
Get it Each person runs age-keygen; the private key goes in their password manager, the public key into .sops.yaml.
accountfree
Why Phase 5 pushes secrets into one platform via its CLI.
Get it Vercel, Railway or Fly CLI logged in.
accountfree
Why CI holds only the age private key.
Get it GitHub Actions: Settings > Secrets and variables > Actions.

Environment variables

These go in a .env file the app reads at startup. The pack's .env.example is this table as a file · copy it, never commit the filled-in version.

Variable	Needed	Example	Where the value comes from
`SOPS_AGE_KEY_FILE`	required	`~/.config/sops/age/keys.txt`	Where sops finds your private key locally.
`SOPS_AGE_KEY`secret	optional	`AGE-SECRET-KEY-...`	The CI private key, set only in the CI secret store.

The build, in order

1
Keys and one file
An encrypted dev.env committed; plaintext never can be.
1. Files .sops.yamlsecrets/dev.env
  terminal
  age-keygen -o ~/.config/sops/age/keys.txt sops --encrypt --in-place secrets/dev.env
done when · tick each as it passes
next phase
2
Runtime
secrets run --env dev -- npm start, nothing decrypted to disk.
1. terminal
  sops exec-env secrets/dev.env 'npm start'
done when · tick each as it passes
next phase
3
Environments and CI
Prod excludes laptops; CI decrypts with its own key.
done when · tick each as it passes
next phase
4
Rotation and audit
Remove a leaver; see who changed what.
1. terminal
  sops updatekeys secrets/*.env
done when · tick each as it passes
next phase
5
Sync where needed
One platform fed from the encrypted file.
2. Files README.md
done when · tick each as it passes
next phase
6
Team hygieneproduct builder
Onboarding and offboarding as procedures.
done when · tick each as it passes

what this build does not replace

Dynamic secrets, sync to every platform, per-person access in a UI.
one-click sync into Vercel, AWS, GitHub Actions and the rest
the audit log and access control per person
automatic rotation and dynamic secrets
the dashboard

after v1, if you want it

Infisical self-hosted when the team outgrows files

Need the files? The project pack on the verdict page hands your agent the whole brief · more security.