chore: initialize v2 SOPS configuration and README

README.md

@@ -0,0 +1,31 @@
+# NixOS GitOps Migration (v2)
+
+This branch contains the automated, pull-based GitOps architecture using `comin`, Terraform, and Forgejo.
+
+## Secret Management (SOPS-Nix)
+
+This repository uses `sops-nix` for secret management, adhering to a strict separation between Production and Staging environments to prevent credential leakage during CI runs.
+
+### Production Keys
+*   **`prod-master`**: This is the ultimate master key for production secrets.
+    *   **Best Practice**: The private key is **NEVER** stored on any server (including the Control Center VM). It is kept locally on a securely backed-up USB key and a paper backup.
+    *   You only import the private key to your local machine temporarily when you need to encrypt a new secret or during a disaster recovery scenario.
+*   **Host Keys**: Production VMs use their individual SSH host keys (generated during provisioning) to decrypt their specific secrets at boot time.
+
+### Staging Keys
+*   **`staging-master`**: This key is used exclusively for encrypting secrets inside the `secrets/staging/` directory.
+    *   The public key is in `.sops.yaml`.
+    *   The private key is stored securely in Forgejo Secrets.
+    *   During CI runs, the Forgejo Runner injects this private key into the ephemeral Staging VMs via Cloud-Init.
+    *   Even if this key is compromised, it cannot decrypt production data.
+
+### Generating the Master Keys
+To generate your master keys (run this on your secure local workstation):
+```bash
+# Generate the prod-master key (save the private key to your USB drive)
+age-keygen -o prod-master.txt
+
+# Generate the staging-master key (upload the private key to Forgejo Secrets)
+age-keygen -o staging-master.txt
+```
+Update `.sops.yaml` with the public keys outputted by these commands.