Archived
beatzaplentyandClaude Sonnet 5
559c538a3d
Adds the proxmox-minimal host's age key (derived from its SSH host key via scripts/prepare-host-key.sh) as a recipient in .sops.yaml and re-encrypts secrets/common.yaml for it via sops updatekeys. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot
46 lines
1.5 KiB
YAML
46 lines
1.5 KiB
YAML
keys:
|
|
- &admin age10nd382a9klsn2mrs60emdtsxe43pht3a0m9p29phfrhy0wfyt3vsq9r667
|
|
- &docker age19gfn2yedg76dmztm4hncr7vf3r3c9j0qpt4rap7y7gersjk4m3ks2lhd0e
|
|
- &server age1ll6hj5ggruetgjwjfnplpn5xtq35uhlcdflksx3xmnjm6s3uad9sz70jkf
|
|
- &nix-cache age120le4a5l8dh3lyfgvmj3d9ksmej6ajs5mer5y7r0vfg3x9fn69dqf8xgzu
|
|
- &lxc-minimal age1qz9d4ka4xgexujyd247s7lp737sulp5fhxl5d65fj2ykvc4j4edqrsdks8
|
|
- &nix-minimal age120whqj96g26lsgy4udvgsn8dc9lumh8jeu3a564fx79rjr5lxffqmrljuu
|
|
- &lxc-nix-cache age164px2a8e48ptsf9ngtan38aa6jls4jdl26mzrgzf6sn3vcvt49hqjrgr8w
|
|
- &proxmox-minimal age10at8862478urh0eeuwh8hzln6ck78jgwtztgxatwqlzwagg77y5snm4xzg
|
|
|
|
creation_rules:
|
|
# Shared across every currently-deployed host: root/nixos password hash,
|
|
# GitHub access token. Same value on every host today, so every live host's
|
|
# key can decrypt it (matches current risk profile — narrow further in
|
|
# Milestone 4 if hosts should diverge).
|
|
- path_regex: secrets/common\.yaml$
|
|
key_groups:
|
|
- age:
|
|
- *admin
|
|
- *docker
|
|
- *server
|
|
- *nix-cache
|
|
- *lxc-minimal
|
|
- *nix-minimal
|
|
- *lxc-nix-cache
|
|
- *proxmox-minimal
|
|
|
|
- path_regex: secrets/nix-cache\.yaml$
|
|
key_groups:
|
|
- age:
|
|
- *admin
|
|
- *nix-cache
|
|
- *lxc-nix-cache
|
|
|
|
- path_regex: secrets/server\.yaml$
|
|
key_groups:
|
|
- age:
|
|
- *admin
|
|
- *server
|
|
|
|
- path_regex: secrets/docker\.yaml$
|
|
key_groups:
|
|
- age:
|
|
- *admin
|
|
- *docker
|