use opentofu encrypted state feature https://opentofu.org/docs/language/state/encryption/#new-project
teutat3s