29 lines
1.1 KiB
YAML
29 lines
1.1 KiB
YAML
# SOPS configuration for NixOS GitOps Migration (v2)
|
|
# See README.md for key management instructions.
|
|
|
|
keys:
|
|
# Master Keys (Used for generic/global secrets if needed, but usually we encrypt for specific hosts)
|
|
- &prod_master age1... # TODO: Replace with the public key of the prod-master offline USB key
|
|
- &staging_master age1... # TODO: Replace with the public key of the staging-master key
|
|
|
|
# Host Keys (Used by the specific VM to decrypt its own secrets at boot)
|
|
# - &host_control_center age1...
|
|
|
|
creation_rules:
|
|
# Staging Environment
|
|
# All files under secrets/staging/ are encrypted purely with the staging_master key.
|
|
# Ephemeral VMs are injected with this private key at boot via Cloud-Init.
|
|
- path_regex: secrets/staging/.*\.ya?ml$
|
|
key_groups:
|
|
- age:
|
|
- *staging_master
|
|
|
|
# Production Environment
|
|
# All files under secrets/prod/ are encrypted with the prod_master key AND the specific host's key.
|
|
# Ephemeral VMs CANNOT decrypt these files.
|
|
- path_regex: secrets/prod/.*\.ya?ml$
|
|
key_groups:
|
|
- age:
|
|
- *prod_master
|
|
# Add host keys here as they are provisioned
|
|
# - *host_control_center
|