In a past blog post I covered using Bitwarden for home lab automation secrets (Secrets Manager for Home Lab Automation). That approach works well if you already use a password manager and want a CLI to pull credentials into environment variables. This follow-up covers SOPS as an alternative when you want encrypted secrets in the repo without relying on a password manager or paying for a subscription. The goal is the same: get secrets into environment variables for Terraform, Ansible, and cloud CLIs at runtime. The difference is where those secrets live. With SOPS you keep them versioned next to your infrastructure code as ciphertext. That means you are putting secrets in git — encrypted, but still in the repo — which is a tradeoff worth accepting for many solo home lab setups because it removes login/session/sync choreography and avoids another hosted service.

We’ve all lived through the messy evolution of digital security. A few years ago, the landscape was simple: a username, a password, and maybe basic HTTPS or SFTP protocols. Then came the era of brute-force attacks and weak passwords, forcing the industry to enforce strict policies—requiring uppercase letters, numbers, and symbols. But humans aren’t built to memorize 50 unique, complex alphanumeric strings. The predictable result? People started using one or two passwords for everything, or worse, writing them down on Post-it notes stuck to their monitors.

It all started with a simple, everyday annoyance in the kitchen. My wife would be in the middle of cooking, hands covered in flour, oil, or whatever was being prepped for dinner, and the kitchen would start filling with smoke. Our range hood works perfectly fine, but it is completely “dumb”—controlled exclusively by a small, analog infrared remote. Having to stop, wash her hands, find the little plastic remote, and press the right buttons just to clear the air was a daily friction point.

One of the problems I found when working with my home lab is that I was lacking a solution for storing secrets. Even though there are open source solutions like Hashicorp vault to manage secrets, and managing it something requires maintenance and I didn’t want to have the operational burden. I used to manage my password with a KeePass vault file. However that solution fell short when dealing with multiple devices like phones and multiple laptops. So I chose a password manager. I ended up choosing Bitwarden as a password manager, one of the reasons I chose this solution was that it is open source and if I ever want to host it myself I can migrate to the open source version and migration will bee seamless to a hosted solution. I still chose the cloud version of it. And at some point working on my labs I decided to use my password manager to store the secrets I need for my automations. Bitwarden offers a cli tool which is pretty handy for automations, it outputs secrets in json format which is pretty useful to be used in any language. I chose to keep things simple and use it on the shell and parse it with jq tool, one downside of the bitwarden CLI tool is that they don’t offer a build for linux arm64 arch, so if you are running on a raspberry pi you will have to build the tool from source. This post is opinionated to Bitwarden, but the same concepts should work for other password managers CLI tools, of course depending on outputs a few things should be adapted to other password managers outputs.

I have been working with golang projects for quite some time and I found that the usual fork and pull request on github is a bit trickier when working with golang, as golang doesn’t have dependency management tools like python has PyPI or npm for NodeJS, etc. Golang dependency management relies on pretty much git tag or commit hashed to specific repos for using golang modules in your code, in my personal opinion I have mixed feelings about the approach, however I am not going to discuss that here, I might do that in another post. However when contributing to open source projects I found myself in trouble until I understood how things worked in managing dependencies in golang.