Add secrets and cleanup

modules/secrets/locker.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+AGE_PRIVATE_KEY="$HOME/.ssh/id_ed25519"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+RECIPIENTS_FILE="$SCRIPT_DIR/recipients.txt"
+ENCRYPTED_FILE="$SCRIPT_DIR/secrets.age"
+
+TMP_FILE=$(mktemp)
+
+cleanup() {
+  rm -f "$TMP_FILE"
+}
+trap cleanup EXIT
+
+if [[ -f "$ENCRYPTED_FILE" ]]; then
+  age -d -i "$AGE_PRIVATE_KEY" -o "$TMP_FILE" "$ENCRYPTED_FILE"
+fi
+
+"${EDITOR:-vi}" "$TMP_FILE"
+
+age -R "$RECIPIENTS_FILE" -o "$ENCRYPTED_FILE" "$TMP_FILE"
+
+echo "Updated $ENCRYPTED_FILE"