# sops-nix encryption rules.
# Secrets under secrets/ are encrypted to the age recipient(s) below.
# The matching PRIVATE key lives OFF-repo (~/.config/sops/age/keys.txt for
# editing; /var/lib/sops-nix/key.txt on the host for decryption).
#
# Add the host's own age key here later (derived from its ssh host key) so the
# machine can decrypt without shipping a separate key.
keys:
  # admin key — for editing secrets on the laptop (~/.config/sops/age/keys.txt)
  - &admin age1cekcqyf7073fsytcjxaa9dr9zwkmn4vjg36rv2tgxdglzfv4jvxqvcj6z2
  # per-host keys — derived from each box's pre-generated SSH host key
  # (ssh-to-age). The host decrypts at runtime using /etc/ssh/ssh_host_ed25519_key.
  - &jupiter age1zak7glavmg4026p2389fyqe769vqm4jrryknuqckgqq4merz5f7q44rkkt
  - &neptun age1hp72xyx2cnd05937e4eww95g5kdtn0wsf9j2nypw330pa69gfdxqn0lpkp
  - &terra age1rfcmu6zh40v4260l9hnf8ajs9vly0s06rx3ey76eu78dp9t7getqyhmkut
  - &mars age1eapjg6tdrr0fuvmgs3q3nlvnjkaxez298qynqqqxt0lpcv0lrsyq7ayxjk
  # mercury (rpi) uses a dedicated age key (SD image, no ssh-host-key delivery);
  # the private key is dropped on its boot partition after flashing.
  - &mercury age1cpty7zrgnn6l97upq00w5wa8zcvnkxkdt2jvhlj97jh83exure4slha43t
# Each host's secrets go to admin (edit) + that host only. Order matters:
# the first matching rule wins, so keep these specific paths.
creation_rules:
  - path_regex: secrets/jupiter\.yaml$
    key_groups:
      - age: [ *admin, *jupiter ]
  - path_regex: secrets/neptun\.yaml$
    key_groups:
      - age: [ *admin, *neptun ]
  - path_regex: secrets/terra\.yaml$
    key_groups:
      - age: [ *admin, *terra ]
  - path_regex: secrets/mars\.yaml$
    key_groups:
      - age: [ *admin, *mars ]
  - path_regex: secrets/mercury\.yaml$
    key_groups:
      - age: [ *admin, *mercury ]