I like the fact that your script is simple, and uses a ubiquitous library! But I do have a few suggestions:
1. You may be using an older version of openssl, but with modern versions, add the `-pbkdf2` option for much saner key derivation.
2. With modern versions of openssl, the `-salt` option is on by default, so you don't need to specify it explicitly (and you almost certainly want this option on, versus not using a salt or generating one yourself).
So I would suggest this for the encryption command (instead of `openssl enc -aes-256-cbc -salt -a`):
> openssl enc -chacha20 -pbkdf2 -a
Also, instead of using openssl, you might prefer to use `age`, as it uses modern crypto best practices by default (see https://age-encryption.org/). With it, you could substitute this encryption command for the above:
Q: How would you improve that without increasing the simplicity of the approach?
Q: Is a random 'salt' required here, or does the aes-256-cbc do it for me anyway?