diff --git a/lua/crentist/sops/init.lua b/lua/crentist/sops/init.lua
new file mode 100644
index 0000000..ba69f11
--- /dev/null
+++ b/lua/crentist/sops/init.lua
@@ -0,0 +1,93 @@
+local M = {}
+
+--- @class SopsRunner
+--- @field config SopsConfig
+--- @field run fun(self: SopsRunner, args: table, envs: table): string|nil, string|nil a simple run, accepts a list of arguments
+--- @field to_table fun(self: SopsRunner, file: string): table|nil, string|nil convert structured file to lua table
+--- @field decrypt fun(self: SopsRunner, file: string, args: table?): string|nil, string|nil decrypt encrypted file
+--- @field debug fun(self: SopsRunner): nil
+
+--- @class SopsConfig
+--- @field sops_bin? string
+--- @field extra_args? table
+
+--- @param opts SopsConfig
+--- @return SopsRunner
+M.create_runner = function (opts)
+    opts = opts or {}
+    opts.sops_bin = opts.sops_bin or 'sops'
+    opts.extra_args = opts.extra_args or {}
+
+    local runner = {
+        config = {
+            sops_bin = opts.sops_bin or 'sops',
+            extra_args = opts.extra_args or {}
+        } --[[@as SopsConfig]]
+    }
+
+    --- Generic runner
+    --- @param self SopsRunner
+    --- @param args table
+    --- @param envs table|nil
+    --- @return string|nil, string|nil
+    function runner:run(args, envs)
+        envs = envs or {}
+        local command = {self.config.sops_bin}
+        vim.list_extend(command, self.config.extra_args)
+        vim.list_extend(command, args)
+
+        local result = vim.system(command, {text = true, env = envs}):wait()
+        if result.code ~= 0 then
+            return nil, "Command returned non-zero exit code: " .. result.stderr
+        end
+
+        return result.stdout, nil
+    end
+
+    function runner:decrypt(file, extra_args)
+        extra_args = extra_args or {}
+
+        local run_args = {}
+        vim.list_extend(run_args, extra_args)
+
+        table.insert(run_args, '-d')
+        table.insert(run_args, file) -- a separate call to ensure that file is always passed the last
+
+        return self:run(run_args)
+    end
+    function runner:debug()
+        local edit_script = vim.fn.fnamemodify('scripts/editor.sh', ':p')
+        vim.print(edit_script)
+    end
+
+    function runner:edit(file, extra_args)
+        extra_args = extra_args or {}
+
+        local edit_script = vim.fn.fnamemodify('scripts/editor.sh', ':p')
+        vim.print(edit_script)
+
+        local edit_args = {}
+
+        vim.list_extend(edit_args, extra_args)
+
+        table.insert(edit_args, 'edit')
+        table.insert(edit_args, file)
+
+        return self:run(edit_args, {EDITOR="./scripts/editor.sh"})
+    end
+
+    function runner:to_table(file)
+        local expanded_file = vim.fn.fnamemodify(file, ':p')
+        local result, err = self:decrypt(expanded_file, {'--output-type', 'json'})
+        if err then
+            return nil, 'Failed converting to json: ' .. err
+        end
+
+        return vim.fn.json_decode(result), nil
+    end
+    return runner --[[@as SopsRunner]]
+
+end
+
+return M
+