Initial commit

1 files changed, 24 insertions, 0 deletions

diff --git a/.sops.yaml b/.sops.yaml
new file mode 100644
index 0000000..e8d07b3
--- /dev/null
+++ b/.sops.yaml
@@ -0,0 +1,24 @@
+# sops-nix key configuration
+#
+# Recipients are derived from your SSH ed25519 keys via ssh-to-age.
+# To get your age public keys, run on each machine:
+#   ssh-to-age < ~/.ssh/id_ed25519.pub
+#   (or: cat ~/.ssh/id_ed25519.pub | ssh-to-age)
+#
+# After first deploy, also add the server's host key as a recipient:
+#   ssh-keyscan <server-ip> | grep ed25519 | ssh-to-age
+#   Then re-encrypt: sops updatekeys secrets/secrets.yaml
+
+keys:
+  - &einstein age1REPLACE_WITH_OUTPUT_OF_ssh-to-age_FOR_EINSTEIN_KEY
+  - &galileo  age1REPLACE_WITH_OUTPUT_OF_ssh-to-age_FOR_GALILEO_KEY
+  # Add the server host key age recipient after first deploy:
+  # - &eurovm  age1REPLACE_WITH_SERVER_HOST_KEY_AGE
+
+creation_rules:
+  - path_regex: secrets/.*\.yaml$
+    key_groups:
+      - age:
+          - *einstein
+          - *galileo
+          # - *eurovm  # uncomment after first deploy