keys:
  - &admin age1njap586hc0q43kr03g6c8eqhdsmk8zcafkl3f83xwlc2gqhlmfgs4tmwad
  - &docker age19gfn2yedg76dmztm4hncr7vf3r3c9j0qpt4rap7y7gersjk4m3ks2lhd0e
  - &server age1ll6hj5ggruetgjwjfnplpn5xtq35uhlcdflksx3xmnjm6s3uad9sz70jkf
  - &nix-cache age120le4a5l8dh3lyfgvmj3d9ksmej6ajs5mer5y7r0vfg3x9fn69dqf8xgzu
  - &lxc-minimal age1qz9d4ka4xgexujyd247s7lp737sulp5fhxl5d65fj2ykvc4j4edqrsdks8
  - &nix-minimal age120whqj96g26lsgy4udvgsn8dc9lumh8jeu3a564fx79rjr5lxffqmrljuu
  - &lxc-nix-cache age164px2a8e48ptsf9ngtan38aa6jls4jdl26mzrgzf6sn3vcvt49hqjrgr8w
  - &proxmox-minimal age10at8862478urh0eeuwh8hzln6ck78jgwtztgxatwqlzwagg77y5snm4xzg

creation_rules:
  # Shared across every currently-deployed host: root/nixos password hash,
  # GitHub access token. Same value on every host today, so every live host's
  # key can decrypt it (matches current risk profile — narrow further in
  # Milestone 4 if hosts should diverge).
  - path_regex: secrets/common\.yaml$
    key_groups:
      - age:
          - *admin
          - *docker
          - *server
          - *nix-cache
          - *lxc-minimal
          - *nix-minimal
          - *lxc-nix-cache
          - *proxmox-minimal

  - path_regex: secrets/nix-cache\.yaml$
    key_groups:
      - age:
          - *admin
          - *nix-cache
          - *lxc-nix-cache

  - path_regex: secrets/server\.yaml$
    key_groups:
      - age:
          - *admin
          - *server

  - path_regex: secrets/docker\.yaml$
    key_groups:
      - age:
          - *admin
          - *docker