diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..ecc619d
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+sops/age/keys.txt
diff --git a/.sops.yaml b/.sops.yaml
new file mode 100644
index 0000000..1e1a9c2
--- /dev/null
+++ b/.sops.yaml
@@ -0,0 +1,18 @@
+keys:
+  - &primary age1z7h49dlulj2lut20dk9h0wqmkf5l3m30fzcf0yq7mqhhhlnnjf3q5jwd2a
+creation_rules:
+  - path_regex: secrets/secrets.yaml$
+    key_groups:
+    - age:
+      - *primary
+      - age17dyle4u3ltd0fj0g8e443tyyevydr6gv0s2vrfvdm94n0glx0ffq3tz0n6
+  - path_regex: secrets/nebula-sync.env$
+    key_groups:
+    - age:
+      - *primary
+      - age17dyle4u3ltd0fj0g8e443tyyevydr6gv0s2vrfvdm94n0glx0ffq3tz0n6
+  - path_regex: secrets/hermes-env.env$
+    key_groups:
+    - age:
+      - *primary
+      - age1d8y8p8vmljeapvfpfve50c63nkgyraml78akukpk6lghpndply2qemp8uq
diff --git a/sops/age/keys.txt b/sops/age/keys.txt
deleted file mode 100644
index 6a28866..0000000
--- a/sops/age/keys.txt
+++ /dev/null
@@ -1 +0,0 @@
-AGE-SECRET-KEY-1NKMLAGCA0JDEXQQZEC2V8DURYEYF2F2VETZPG0T9JM6EA5J4D0DSPQZ2QD