use flake

# Load project-local secrets (sops-encrypted, gitignored). Decrypt on the fly
# with this machine's age key so plaintext never touches disk. Requires the
# age key at ~/.config/sops/age/keys.txt.
if [[ -f .secrets.env ]]; then
  set -a
  eval "$(sops -d --output-type dotenv .secrets.env)"
  set +a
fi