Age

Encrypted .env files committed beside the compose files that use them: per-machine keys, per-file recipient rules, the one backup that cannot live inside the lab, and the git-diff habit that catches every near-miss.