use flake
if has sops; then
  export TF_ENCRYPTION=$(sops --extract '["tofu"]' -d infra/secrets.yaml)
fi