# sops-nix encryption rules.
# Secrets under secrets/ are encrypted to the age recipient(s) below.
# The matching PRIVATE key lives OFF-repo (~/.config/sops/age/keys.txt for
# editing; /var/lib/sops-nix/key.txt on the host for decryption).
#
# Add the host's own age key here later (derived from its ssh host key) so the
# machine can decrypt without shipping a separate key.
keys:
  - &admin age1cekcqyf7073fsytcjxaa9dr9zwkmn4vjg36rv2tgxdglzfv4jvxqvcj6z2
creation_rules:
  - path_regex: secrets/.*\.yaml$
    key_groups:
      - age:
          - *admin