Add gpg signing

modules/secrets/locker.sh

@@ -4,8 +4,21 @@ set -euo pipefail
 
 AGE_PRIVATE_KEY="$HOME/.ssh/id_ed25519"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+case "${1:-}" in
+  env)
+    ENCRYPTED_FILE="$SCRIPT_DIR/secrets.age"
+    ;;
+  gpg)
+    ENCRYPTED_FILE="$SCRIPT_DIR/gpg.age"
+    ;;
+  *)
+    echo "Usage: $0 {env|gpg}"
+    exit 1
+    ;;
+esac
+
 RECIPIENTS_FILE="$SCRIPT_DIR/recipients.txt"
-ENCRYPTED_FILE="$SCRIPT_DIR/secrets.age"
 
 TMP_FILE=$(mktemp)