SopsCommand

Encrypts a key/value yaml payload to one or more age recipients via the sops CLI. Used by ProvisionNixosVm to emit the per-VM secrets.yaml: the always-present LUKS password (flat) plus any template-supplied nested/multiline secrets (e.g. IPFS ipfs/swarm_key + ipfs/cluster_secret). The YAML is rendered by SecretsYamlBuilder.

public sealed class SopsCommand

1. Properties

1.1. Entries

Secret entries rendered into the yaml payload (flat or nested, single- or multi-line).

public IReadOnlyList<NixSecretEntry> Entries { get; }

1.2. OutputPath

Where to write the encrypted yaml.

public AbsolutePath OutputPath { get; }

1.3. Recipients

Age public keys (recipients) the payload encrypts to.

public IReadOnlyList<string> Recipients { get; }

1.4. RenderedYamlInput

Rendered yaml input (unencrypted) - flat for single-segment keys, nested for a/b keys.

public string RenderedYamlInput { get; }

2. Methods

2.1. Execute(TimeSpan, ILogger)

Runs sops cross-platform: writes the yaml payload to a temp file, then invokes sops --encrypt --age <recipients> --output <OutputPath> <tempInput> via PowershellCommand on Windows / BashCommand on Linux. Temp file is always cleaned up.

public SopsResult Execute(TimeSpan timeout, ILogger logger)

Table 1. Parameters
Name	Type	Description
timeout	TimeSpan
logger	ILogger

Returns: SopsResult

2.2. RenderedShellCommandFor(string, AbsolutePath, AbsolutePath)

Rendered shell command (test seam). Reads from a temp file because /dev/stdin doesn’t exist on Windows. sops --output writes encrypted yaml directly to disk - no shell-redirect ambiguity (PowerShell > would inject a UTF-16 BOM).

public static string RenderedShellCommandFor(string ageArgs, AbsolutePath inputPath, AbsolutePath outputPath)

Table 2. Parameters
Name	Type	Description
ageArgs	string
inputPath	AbsolutePath
outputPath	AbsolutePath

Returns: string