# SOPS configuration for NixOS GitOps Migration (v2)
# See README.md for key management instructions.

keys:
  # Master Keys (Used for generic/global secrets if needed, but usually we encrypt for specific hosts)
  - &prod_master age1... # TODO: Replace with the public key of the prod-master offline USB key
  - &staging_master age1... # TODO: Replace with the public key of the staging-master key

  # Host Keys (Used by the specific VM to decrypt its own secrets at boot)
  # - &host_control_center age1...

creation_rules:
  # Staging Environment
  # All files under secrets/staging/ are encrypted purely with the staging_master key.
  # Ephemeral VMs are injected with this private key at boot via Cloud-Init.
  - path_regex: secrets/staging/.*\.ya?ml$
    key_groups:
      - age:
          - *staging_master

  # Production Environment
  # All files under secrets/prod/ are encrypted with the prod_master key AND the specific host's key.
  # Ephemeral VMs CANNOT decrypt these files.
  - path_regex: secrets/prod/.*\.ya?ml$
    key_groups:
      - age:
          - *prod_master
          # Add host keys here as they are provisioned
          # - *host_control_center