.sops.yaml


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

# sops-nix key configuration
#
# Recipients are derived from your SSH ed25519 keys via ssh-to-age.
# To get your age public keys, run on each machine:
#   ssh-to-age < ~/.ssh/id_ed25519.pub
#   (or: cat ~/.ssh/id_ed25519.pub | ssh-to-age)
#
# After first deploy, also add the server's host key as a recipient:
#   ssh-keyscan <server-ip> | grep ed25519 | ssh-to-age
#   Then re-encrypt: sops updatekeys secrets/secrets.yaml

keys:
  - &einstein age1sv5yc279d8j66fx36awxhdnsqjp3pv8x9yc0ak6xa9qy9egg6e8qegccg4
  - &galileo  age10ettp7gaw00cdhf5256382m7qwknsahru60pz3m627tq7yunf5ys54mvrv
  # Add the server host key age recipient after first deploy:
  # - &eurovm  age1REPLACE_WITH_SERVER_HOST_KEY_AGE

creation_rules:
  - path_regex: secrets/.*\.yaml$
    key_groups:
      - age:
          - *einstein
          - *galileo
          # - *eurovm  # uncomment after first deploy