Sops over Ansible Vault keeps YAML keys diffable; age key fetched from 1Password at decrypt time.

Assisted-by: Claude Opus 4.7 (1M context) via Claude Code

diff --git a/.sops.yaml b/.sops.yaml
new file mode 100644
index 0000000..04bd984
--- /dev/null
+++ b/.sops.yaml
@@ -0,0 +1,3 @@
+creation_rules:
+  - path_regex: host_vars/.*\.sops\.ya?ml$
+    age: age15ars55ulrp9hz6r0utvluayrglt40wv0t997njez0y9l3e43cersn6kgh7
diff --git a/ansible.cfg b/ansible.cfg
index b723a25..7cc52d7 100644
--- a/ansible.cfg
+++ b/ansible.cfg
@@ -1,5 +1,6 @@
 [defaults]
 inventory = hosts.yml
+vars_plugins_enabled = host_group_vars,community.sops.sops
 
 # [privilege_escalation]
 # become_ask_pass = True
diff --git a/requirements.yml b/requirements.yml
new file mode 100644
index 0000000..0a39656
--- /dev/null
+++ b/requirements.yml
@@ -0,0 +1,2 @@
+collections:
+  - name: community.sops