secrets(ha-docker): add IPA keytabs for ha-docker-1 and ha-docker-2

.sops.yaml

@@ -21,6 +21,8 @@ keys:
   - &proxmox-tailscale-router age1zhfyuzlq40reuqlr34gf77852nhs3t6mqfzrqmas8z6sxk7tcfhsungrm0
   - &proxmox-ha-server-1 age1k73g8x47hs93wcv7qh92n3htz8pl295g49hyvlrf3570mts0hgys5g04d6
   - &proxmox-ha-server-2 age1fefy6dk8zn5c3edwmrs9vwx79quftnt784m628t9e34q3ft3cehqz8u72r
+  - &proxmox-ha-docker-1 age16y0vfts5v2k20e2rj23qa5lc5gm96gm64uwsqsr0y688xl0ne46qcfr0sm
+  - &proxmox-ha-docker-2 age1tm3zj5lp3elw2j832az4nj9xxmhqd66ag3cqcv3vskvmd7qdmqmsdpdcn0
 
 creation_rules:
   # Shared across every currently-deployed host: root/nixos password hash,
@@ -52,6 +54,8 @@ creation_rules:
           - *proxmox-tailscale-router
           - *proxmox-ha-server-1
           - *proxmox-ha-server-2
+          - *proxmox-ha-docker-1
+          - *proxmox-ha-docker-2
 
   - path_regex: secrets/nix-cache\.yaml$
     key_groups:
@@ -199,3 +203,19 @@ creation_rules:
           - *admin
           - *proxmox-ha-server-2
           # proxmox-ha-server-2 added by sync-host-keys.sh
+
+  # Host keytab for ha-docker-1 FreeIPA enrollment (binary sops file).
+  # Generated by scripts/ipa/create-nixos-ipa-host-account.sh.
+  - path_regex: secrets/ha-docker-1\.keytab$
+    key_groups:
+      - age:
+          - *admin
+          - *proxmox-ha-docker-1
+
+  # Host keytab for ha-docker-2 FreeIPA enrollment (binary sops file).
+  # Generated by scripts/ipa/create-nixos-ipa-host-account.sh.
+  - path_regex: secrets/ha-docker-2\.keytab$
+    key_groups:
+      - age:
+          - *admin
+          - *proxmox-ha-docker-2