There’s a moment in too many infrastructure projects where your deploy is blocked on one question: where do the secrets live? This post covers SOPS + age: encrypting secrets directly in git without needing a secrets manager. No servers, no cloud KMS accounts, no chicken-and-egg problem.