# sops-nix key configuration
#
# Recipients are derived from your SSH ed25519 keys via ssh-to-age.
# To get your age public keys, run on each machine:
#   ssh-to-age < ~/.ssh/id_ed25519.pub
#   (or: cat ~/.ssh/id_ed25519.pub | ssh-to-age)
#
# After first deploy, also add the server's host key as a recipient:
#   ssh-keyscan <server-ip> | grep ed25519 | ssh-to-age
#   Then re-encrypt: sops updatekeys secrets/secrets.yaml

keys:
  - &einstein age1REPLACE_WITH_OUTPUT_OF_ssh-to-age_FOR_EINSTEIN_KEY
  - &galileo  age1REPLACE_WITH_OUTPUT_OF_ssh-to-age_FOR_GALILEO_KEY
  # Add the server host key age recipient after first deploy:
  # - &eurovm  age1REPLACE_WITH_SERVER_HOST_KEY_AGE

creation_rules:
  - path_regex: secrets/.*\.yaml$
    key_groups:
      - age:
          - *einstein
          - *galileo
          # - *eurovm  # uncomment after first deploy