diff --git a/.gitignore b/.gitignore
index 2f1273a..dd26263 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,4 +2,6 @@
 .fact-cache
 /victoria-metrics-*.tar.gz
 /victoria-metrics-*/
+__pycache__/
 /tmp/
+/age.key
diff --git a/filter_plugins/age.py b/filter_plugins/age.py
new file mode 100644
index 0000000..413e389
--- /dev/null
+++ b/filter_plugins/age.py
@@ -0,0 +1,37 @@
+import os
+import subprocess
+from typing import Callable, Optional
+
+from ansible.errors import AnsibleError
+
+
+class AgeError(AnsibleError):
+    pass
+
+
+class FilterModule:
+    def filters(self) -> dict[str, Callable[..., str]]:
+        return {
+            'decrypt': age_filter,
+        }
+
+
+def age_filter(data: str, key: Optional[str] = None) -> str:
+    if key is None:
+        key = 'age.key'
+    key = os.path.expanduser(key)
+    p = subprocess.Popen(
+        ['age', '-d', '-i', key],
+        stdin=subprocess.PIPE,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+    )
+    stdout, stderr = p.communicate(data.encode('utf-8'))
+    if p.returncode != 0:
+        error = ' '.join(
+            l
+            for l in stderr.decode('utf-8', errors='replace').splitlines()
+            if not l.startswith('age: report unexpected')
+        )
+        raise AgeError(error)
+    return stdout.decode('utf-8')
diff --git a/pyproject.toml b/pyproject.toml
new file mode 100644
index 0000000..82fbb1b
--- /dev/null
+++ b/pyproject.toml
@@ -0,0 +1,6 @@
+[tool.black]
+line-length = 79
+skip-string-normalization = true
+
+[tool.isort]
+lines_after_imports = 2