blob: e8d07b33a31b8b7f27c271abe09e9d17b36838be (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
|
# sops-nix key configuration
#
# Recipients are derived from your SSH ed25519 keys via ssh-to-age.
# To get your age public keys, run on each machine:
# ssh-to-age < ~/.ssh/id_ed25519.pub
# (or: cat ~/.ssh/id_ed25519.pub | ssh-to-age)
#
# After first deploy, also add the server's host key as a recipient:
# ssh-keyscan <server-ip> | grep ed25519 | ssh-to-age
# Then re-encrypt: sops updatekeys secrets/secrets.yaml
keys:
- &einstein age1REPLACE_WITH_OUTPUT_OF_ssh-to-age_FOR_EINSTEIN_KEY
- &galileo age1REPLACE_WITH_OUTPUT_OF_ssh-to-age_FOR_GALILEO_KEY
# Add the server host key age recipient after first deploy:
# - &eurovm age1REPLACE_WITH_SERVER_HOST_KEY_AGE
creation_rules:
- path_regex: secrets/.*\.yaml$
key_groups:
- age:
- *einstein
- *galileo
# - *eurovm # uncomment after first deploy
|
