sayanarijit/cottageA modern git based age-encrypted secrets manager for teams.
cottage is a GitOps tool for teams to manage age-encrypted secrets in git repositories.
It provides a simple workflow to encrypt/decrypt secrets, manage recipients, and keep secrets out of the repo while still allowing for easy sharing via VCS. cottage also generates redacted previews of encrypted secrets for better visibility and supports both persistent and temporary decryption workflows, while ensuring secrets are never committed in plaintext.
.gitignore to keep unencrypted secrets out of the repo.ctg diff shows diff of locally modified secrets with tracked encrypted counterparts.ctg decrypt/edit/sync keeps decrypted secrets on disk.ctg run (shortcut ctgx) decrypts secrets temporarily to run a command, then deletes them regardless of the command's success or failure.ctg env injects decrypted secrets as environment variables to run a command, without writing them to disk at all.ctg clean deletes all decrypted secrets from local repo to let you run your AI agents with a tiny bit less worry.# rust: cargo-binstall/cargo
cargo binstall --locked cottage
cargo install --locked cottage
# python: pip/uv/uvx
pip install cottage
uv pip install cottage
uvx --from cottage ctg --version
# node: yarn/pnpm/npx
yarn global add @sayanarijit/cottage
pnpm add -g @sayanarijit/cottage
npx -p @sayanarijit/cottage ctg --version
Also available as docker images:
# Docker
docker run --rm -v $PWD:/app sayanarijit/cottage --version
# Podman
podman run --rm -v $PWD:/app quay.io/sayanarijit/cottage --version
Or download the latest release from GitHub.
Use the Cottage VS Code extension to install ctg, add Copilot safety hooks, encrypt files from the Explorer, and open .cott.age files through the editor workflow.
Install it from the Visual Studio Marketplace, or build and install it locally from vscode-plugin-cottage.
All of the integrations below keep AI agents from running ctg/ctgx directly and from viewing or editing secret files: anything inside .cottage/, any *.cott.* file (encrypted *.cott.age blobs and redacted *.cott.toml previews), and any decrypted file that still has a *.cott.age counterpart on disk.
If you are using Claude Code, add .claude/settings.json and .claude/hooks/deny-secrets.py to your repos with secrets so Claude Code sessions handle secrets safely, or install the claude-plugin-cottage plugin.
If you are using GitHub Copilot in VS Code, add .github/hooks/ctg-policy.json and .github/hooks/scripts/deny_ctg_command.py to your repos with secrets so Copilot sessions clean decrypted files, block direct ctg shell commands, and block access to secret files, or install the vscode-plugin-cottage extension to set that up from VS Code.
VS Code loads .claude/settings.json hook definitions too. If you keep both Claude and Copilot hook files in the same repo, make sure you do not accidentally run the same cleanup hook twice.
If you are using Codex, add .codex/hooks.json and .codex/hooks/deny-ctg.py to your repos with secrets so Codex sessions handle secrets safely, or install the codex-plugin-cottage plugin.
Codex requires local hooks to be reviewed before they run. After adding the files, start Codex in the repo and use /hooks to review and trust the project hooks.
If you are using Antigravity (agy), add .agents/hooks.json and .agents/scripts/deny-ctg.py to your repos with secrets so Antigravity sessions handle secrets safely, or install the agy-plugin-cottage plugin.
If you are using Cursor, add .cursor/hooks.json, .cursor/hooks/deny-ctg.py, .cursor/hooks/deny-read-secrets.py, .cursor/rules/deny-ctg.mdc, and .cursorignore to your repos with secrets so Cursor sessions handle secrets safely.
Cursor requires hooks to be enabled first. Open Cursor Settings > Hooks and enable hooks, then restart the agent session so the project hooks take effect. .cursorignore additionally keeps secret files out of Cursor's indexing and the Agent's context.
Init project:
mkdir project && cd project
git init # Optional, cottage works better with git but it's not required
ctg init # Sets up the .cottage directory and necessary files
tree -a
# .
# ├ .cottage/ <- Auto-generated by `ctg init`
# │ ├ identity <- Your private key, keep it safe. Move it to `~/.config/cottage/identity` to use it globally, or replace it with a soft link to one of your existing private keys.
# │ └ recipients/ <- This is where your team keeps the public keys of all the recipients.
# │ └ sayanarijit <- Your public key. Commit it. To use an existing public key, just copy (don't softlink) that key here.
# ├ .git/...
# ├ .gitattributes <- Added `*.cott.age binary export-ignore filter=cottage-encrypted -diff` to avoid polluting git diff
# └ .gitignore <- Added `/.cottage/identity` for obvious reasons
# You can run `ctg clean --all` anytime to clean up everything cottage ever did.
Create or edit a secret.
ctg edit secret.yml --clean # Opens secret.yml in $EDITOR
ctg encrypt secret.yml --clean # Another way to encrypt secrets
# encrypt secret.yml
# into secret.yml.cott.age
# edit secret.yml.cott.toml
# edit .gitignore
# delete secret.yml
Run a command with temporary decrypted secrets:
cat secret.yml
# cat: secret.yml: No such file or directory
ctg run kubectl apply -f secret.yml # decrypts secret.yml.cott.age to secret.yml and runs the command
ctg run kubectl apply -f secret.yml.cott.age # also replaces the path argument with the decrypted file path
ctg run kubectl apply -f . # decrypts all .cott.age files in . and runs the command
ctg run ./deploy.sh # decrypts all .cott.age files in repo and runs the command
cat secret.yml
# cat: secret.yml: No such file or directory
Or use the shortcut:
ctgx ./deploy.sh # same as ctg run -- ./deploy.sh
Run a command with secrets injected as environment variables, without writing to disk at all:
ctg env -- ./deploy.sh # Export secrets from .env.cott.age (default) without writing them to disk, then run deploy.sh
ctg env -F .env.prod.cott.age -- ./deploy.sh # exports from .env.prod.cott.age instead of .env.cott.age
ctg env -F secrets.json.cott.age -- printenv COTTAGE_SECRET # Also supports non-dotenv files.
To share your secrets with team members, just push to the git repo.
git add .
git commit -m "Add secret.yml"
git push origin main
Ask your teammates to add their public keys to .cottage/recipients and push the
changes. Then you can pull and re-encrypt the secrets for them.
git pull origin main
ctg decrypt --skip-verify-recipients # Decrypt missing secrets for re-encryption
ctg encrypt # Re-encrypt all secrets
# encrypt secret.yml
# into secret.yml.cott.age
# edit secret.yml.cott.toml
ctg clean # optional
# delete secret.yml
# review changes, commit and push
git add .
git commit -m "Add new recipient to secrets"
git push origin main
Now your teammates can pull the latest changes and decrypt secrets for themselves.
You can use prek or pre-commit to set up git hooks to automatically check/encrypt secrets before commit and decrypt them after checkout.
See the example prek configuration here.
After adding the prek.toml file, run:
prek install
prek install --hook-type post-checkout
prek install --hook-type post-merge
prek install --hook-type post-rewrite
In the metadata file, you can annotate which recipients the secret should be encrypted for. This allows you to have different secrets for different environments (e.g. staging vs production) and only encrypt them for the relevant recipients.
# secret.yml.cott.toml
[secret]
allow = ["sayanarijit"] # Only encrypt for sayanarijit
# secret.yml.cott.toml
[secret]
deny = ["sayanarijit"] # Encrypt for everyone except sayanarijit
# secret.yml.cott.toml
[secret]
allow = ["env/staging/*"] # Supports glob patterns, only encrypt for recipients in env/staging
deny = ["env/staging/badservice"] # Encrypt for everyone in env/staging except badservice
Deny rules take precedence over allow rules.
See metadata specification for more details.
You can run ctg verify in CI to verify that the encrypted secrets and recipient lists match the metadata rules, to prevent tampering.
# .github/workflows/cottage-verify.yml
name: Cottage Verify
on: [push, pull_request]
permissions:
contents: read
jobs:
verify-secrets:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Verify secrets
run: docker run --rm -v "${{ github.workspace }}:/app" ghcr.io/sayanarijit/cottage verify
With cottage, you can sync secrets with any provider that has an API, not just git.
For that, create a file named cottage.toml in the project root and configure the upstream settings.
See the example cottage.toml here and the secret specific upstream configuration here.
See an example plugin implementation here.
The workflow is similar to git, but instead of git pull and git push, you run ctg pull and ctg push to sync secrets with the configured upstream.
Example:
# Pull latest changes into local encrypted secrets
# Similar to `git pull origin`
ctg pull myvault
# Compare diff with local decrypted secrets
ctg diff
# Sync local decrypted secrets with local encrypted secrets
ctg sync
# Push changes from local encrypted secrets to upstream
# Similar to `git push origin main`
ctg push myvault
See upstream configuration specification for more details.
Cottage supports various plugin providers to sync your secrets. Ready-to-use plugin scripts are available in the examples/plugins directory:
Use Cottage Sync to sync your secrets across your devices and browse without needing the CLI.
See examples directory for more usage examples.
# See debug logs with -v, -vv or -vvv
ctg run -vvv -- ./deploy.sh
age uses a modern, simple algorithm optimized for secure file encryption, with a focus on usability and minimal attack surface. It also supports SSH RSA and Ed25519 keys, though it's recommended to use different keys for separate purposes and scopes.
While SOPS and cottage have many overlapping features, cottage has the following advantages:
cottage borrows the ctg env API from dotenvx.
agebox is very similar to cottage in core philosophy but lacks many features.
ctg init turns any directory into a secret store.ctg pull/diff/push like git pull/diff/push.