chore: initialize v2 SOPS configuration and README

.sops.yaml

@@ -0,0 +1,29 @@
+# SOPS configuration for NixOS GitOps Migration (v2)
+# See README.md for key management instructions.
+
+keys:
+  # Master Keys (Used for generic/global secrets if needed, but usually we encrypt for specific hosts)
+  - &prod_master age1... # TODO: Replace with the public key of the prod-master offline USB key
+  - &staging_master age1... # TODO: Replace with the public key of the staging-master key
+
+  # Host Keys (Used by the specific VM to decrypt its own secrets at boot)
+  # - &host_control_center age1...
+
+creation_rules:
+  # Staging Environment
+  # All files under secrets/staging/ are encrypted purely with the staging_master key.
+  # Ephemeral VMs are injected with this private key at boot via Cloud-Init.
+  - path_regex: secrets/staging/.*\.ya?ml$
+    key_groups:
+      - age:
+          - *staging_master
+
+  # Production Environment
+  # All files under secrets/prod/ are encrypted with the prod_master key AND the specific host's key.
+  # Ephemeral VMs CANNOT decrypt these files.
+  - path_regex: secrets/prod/.*\.ya?ml$
+    key_groups:
+      - age:
+          - *prod_master
+          # Add host keys here as they are provisioned
+          # - *host_control_center