# sops-nix encryption rules.
# Secrets under secrets/ are encrypted to the age recipient(s) below.
# The matching PRIVATE key lives OFF-repo (~/.config/sops/age/keys.txt for
# editing; /var/lib/sops-nix/key.txt on the host for decryption).
#
# Add the host's own age key here later (derived from its ssh host key) so the
# machine can decrypt without shipping a separate key.
keys:
  # admin key — for editing secrets on the laptop (~/.config/sops/age/keys.txt)
  - &admin age1cekcqyf7073fsytcjxaa9dr9zwkmn4vjg36rv2tgxdglzfv4jvxqvcj6z2
  # jupiter host key — derived from its pre-generated SSH host key with
  # ssh-to-age. The host decrypts at runtime using /etc/ssh/ssh_host_ed25519_key.
  - &jupiter age1zak7glavmg4026p2389fyqe769vqm4jrryknuqckgqq4merz5f7q44rkkt
creation_rules:
  - path_regex: secrets/.*\.yaml$
    key_groups:
      - age:
          - *admin
          - *jupiter