---
id: w1/m7/t003
title: Secrets at rest (sealed-secrets / SOPS)
worker: worker1
status: done
estimate: 30m
depends_on: []
---

## Objective

Move the `hetzner` / Argo repo / GHCR creds off imperative `kubectl`/Actions secrets into encrypted-at-rest GitOps (sealed-secrets or SOPS).

## Context

- Today these are applied imperatively; they should be declarative + encrypted in the repo.

## Files

- `deploy/gitops/` (sealed-secrets controller or SOPS + encrypted secret manifests)

## Acceptance criteria

- [ ] The creds are stored encrypted in git and decrypted only in-cluster; no plaintext secret in the repo.

## Out of scope

- Rotating the creds themselves.
