commit 647ccfd6e23cb16cd17877ac1d613ec56fb7e58a
Author: Tibo De Peuter <tibo.depeuter@ugent.be>
Date:   Fri Jul 17 22:02:42 2026 +0200

    chore: initialize v2 SOPS configuration and README

diff --git a/.sops.yaml b/.sops.yaml
new file mode 100644
index 0000000..5cba236
--- /dev/null
+++ b/.sops.yaml
@@ -0,0 +1,29 @@
+# SOPS configuration for NixOS GitOps Migration (v2)
+# See README.md for key management instructions.
+
+keys:
+  # Master Keys (Used for generic/global secrets if needed, but usually we encrypt for specific hosts)
+  - &prod_master age1... # TODO: Replace with the public key of the prod-master offline USB key
+  - &staging_master age1... # TODO: Replace with the public key of the staging-master key
+
+  # Host Keys (Used by the specific VM to decrypt its own secrets at boot)
+  # - &host_control_center age1...
+
+creation_rules:
+  # Staging Environment
+  # All files under secrets/staging/ are encrypted purely with the staging_master key.
+  # Ephemeral VMs are injected with this private key at boot via Cloud-Init.
+  - path_regex: secrets/staging/.*\.ya?ml$
+    key_groups:
+      - age:
+          - *staging_master
+
+  # Production Environment
+  # All files under secrets/prod/ are encrypted with the prod_master key AND the specific host's key.
+  # Ephemeral VMs CANNOT decrypt these files.
+  - path_regex: secrets/prod/.*\.ya?ml$
+    key_groups:
+      - age:
+          - *prod_master
+          # Add host keys here as they are provisioned
+          # - *host_control_center
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..cdc03ab
--- /dev/null
+++ b/README.md
@@ -0,0 +1,31 @@
+# NixOS GitOps Migration (v2)
+
+This branch contains the automated, pull-based GitOps architecture using `comin`, Terraform, and Forgejo.
+
+## Secret Management (SOPS-Nix)
+
+This repository uses `sops-nix` for secret management, adhering to a strict separation between Production and Staging environments to prevent credential leakage during CI runs.
+
+### Production Keys
+*   **`prod-master`**: This is the ultimate master key for production secrets.
+    *   **Best Practice**: The private key is **NEVER** stored on any server (including the Control Center VM). It is kept locally on a securely backed-up USB key and a paper backup.
+    *   You only import the private key to your local machine temporarily when you need to encrypt a new secret or during a disaster recovery scenario.
+*   **Host Keys**: Production VMs use their individual SSH host keys (generated during provisioning) to decrypt their specific secrets at boot time.
+
+### Staging Keys
+*   **`staging-master`**: This key is used exclusively for encrypting secrets inside the `secrets/staging/` directory.
+    *   The public key is in `.sops.yaml`.
+    *   The private key is stored securely in Forgejo Secrets.
+    *   During CI runs, the Forgejo Runner injects this private key into the ephemeral Staging VMs via Cloud-Init.
+    *   Even if this key is compromised, it cannot decrypt production data.
+
+### Generating the Master Keys
+To generate your master keys (run this on your secure local workstation):
+```bash
+# Generate the prod-master key (save the private key to your USB drive)
+age-keygen -o prod-master.txt
+
+# Generate the staging-master key (upload the private key to Forgejo Secrets)
+age-keygen -o staging-master.txt
+```
+Update `.sops.yaml` with the public keys outputted by these commands.