finn.markwitz
3ab8bfbb91
Wires sops-nix into every machine via machines/core/sops.nix so hosts decrypt with their existing SSH host key. Adds a devShell exposing sops/age/ssh-to-age for the operator workflow, which also fixes .envrc's previously no-op `use flake`.
18 lines
628 B
YAML
18 lines
628 B
YAML
keys:
|
|
- &admin_finn age1a0v442ct2qfjcdhyktn25spw02yq4fl08plrrvuradwwxzsle4mq8thln4
|
|
- &host_mibook age1n3uqtee5ymykrls6k04dznq50cwmj99hw7ny83yxjndt4y2ncf5qhjwa2p
|
|
# - &host_jupiter age1... # TODO: Phase 9, see docs/secrets.md
|
|
|
|
creation_rules:
|
|
- path_regex: ^secrets/mibook\.yaml$
|
|
key_groups:
|
|
- age:
|
|
- *admin_finn
|
|
- *host_mibook
|
|
# - path_regex: ^secrets/jupiter\.yaml$ # TODO: Phase 9
|
|
# key_groups:
|
|
# - age: [ *admin_finn, *host_jupiter ]
|
|
# - path_regex: ^secrets/common\.yaml$ # TODO: Phase 9
|
|
# key_groups:
|
|
# - age: [ *admin_finn, *host_mibook, *host_jupiter ]
|