{ config, ... }:

# sops-nix wiring for the VPS. Encrypted values live in ../../secrets/vps.yaml,
# decrypted with the VPS's own SSH host key (recipient in ../../.sops.yaml).
# The host key is pre-generated on the laptop and shipped at install
# (nixos-anywhere --extra-files -> /etc/ssh/ssh_host_ed25519_key).
{
  sops.defaultSopsFile = ../../secrets/vps.yaml;
  sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];

  sops.secrets.tailscale_authkey = { };
}