erik
ac05d948b6
git-mv hosts/vps->neptun, secrets/vps.yaml->neptun.yaml; update flake, .sops.yaml rules, hostName, sops paths, README/CLAUDE. Off-repo host key dir renamed too.
30 lines
1.5 KiB
YAML
30 lines
1.5 KiB
YAML
# sops-nix encryption rules.
|
|
# Secrets under secrets/ are encrypted to the age recipient(s) below.
|
|
# The matching PRIVATE key lives OFF-repo (~/.config/sops/age/keys.txt for
|
|
# editing; /var/lib/sops-nix/key.txt on the host for decryption).
|
|
#
|
|
# Add the host's own age key here later (derived from its ssh host key) so the
|
|
# machine can decrypt without shipping a separate key.
|
|
keys:
|
|
# admin key — for editing secrets on the laptop (~/.config/sops/age/keys.txt)
|
|
- &admin age1cekcqyf7073fsytcjxaa9dr9zwkmn4vjg36rv2tgxdglzfv4jvxqvcj6z2
|
|
# per-host keys — derived from each box's pre-generated SSH host key
|
|
# (ssh-to-age). The host decrypts at runtime using /etc/ssh/ssh_host_ed25519_key.
|
|
- &jupiter age1zak7glavmg4026p2389fyqe769vqm4jrryknuqckgqq4merz5f7q44rkkt
|
|
- &neptun age1hp72xyx2cnd05937e4eww95g5kdtn0wsf9j2nypw330pa69gfdxqn0lpkp
|
|
# mercury (rpi) uses a dedicated age key (SD image, no ssh-host-key delivery);
|
|
# the private key is dropped on its boot partition after flashing.
|
|
- &mercury age1cpty7zrgnn6l97upq00w5wa8zcvnkxkdt2jvhlj97jh83exure4slha43t
|
|
# Each host's secrets go to admin (edit) + that host only. Order matters:
|
|
# the first matching rule wins, so keep these specific paths.
|
|
creation_rules:
|
|
- path_regex: secrets/jupiter\.yaml$
|
|
key_groups:
|
|
- age: [ *admin, *jupiter ]
|
|
- path_regex: secrets/neptun\.yaml$
|
|
key_groups:
|
|
- age: [ *admin, *neptun ]
|
|
- path_regex: secrets/mercury\.yaml$
|
|
key_groups:
|
|
- age: [ *admin, *mercury ]
|