My secrets have slowly turned into a mess. There are .env files on a few different hosts, some passwords pasted straight into compose files, tokens sitting in CI variables, and a password manager note I'm not proud of. Every time I rotate something I forget at least one place.

I've looked at the usual options. SOPS with age seems nice but key distribution and CI feel fiddly. Vault or OpenBao feel like a lot to run at home, especially the unseal part after a reboot. Infisical looks good but it's another app plus a database to keep updated.

What I actually want is pretty simple: one place per environment, some history so I can undo a bad change, tokens for CI that expire on their own, and something that doesn't need babysitting.

What are you all using, and has it held up? Also curious where you keep the very first secret, the one that unlocks everything else.