# sops-nix key configuration
#
# Recipients are derived from your SSH ed25519 keys via ssh-to-age.
# To get your age public keys, run on each machine:
#   ssh-to-age < ~/.ssh/id_ed25519.pub
#   (or: cat ~/.ssh/id_ed25519.pub | ssh-to-age)
#
# After first deploy, also add the server's host key as a recipient:
#   ssh-keyscan <server-ip> | grep ed25519 | ssh-to-age
#   Then re-encrypt: sops updatekeys secrets/secrets.yaml

keys:
  - &einstein age1sv5yc279d8j66fx36awxhdnsqjp3pv8x9yc0ak6xa9qy9egg6e8qegccg4
  - &galileo  age10ettp7gaw00cdhf5256382m7qwknsahru60pz3m627tq7yunf5ys54mvrv
  - &eurovm  age1rudk653pqzcly6dvemsc5wvq005cfjg4esgrk46zm963tlhs6cjqcrad7t

creation_rules:
  - path_regex: secrets/.*\.yaml$
    key_groups:
      - age:
          - *einstein
          - *galileo
          - *eurovm