nixcfg/.sops.yaml at main · timblaktu/nixcfg · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
# This file specifies which SOPS keys are used for encrypting/decrypting secrets
# See https://github.com/Mic92/sops-nix for more information

keys:
  # Users (replace with your own public key)
  - &user_tim age1s3w0vh40qtjzx677xdda7lv5sqnhrxg9ae306zrkx4deurcvx90sajtlsk

  # Hosts (these will be generated for each host)
  - &host_mbp age1xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx  # TODO: Generate when setting up mbp
  - &host_potato age1xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx  # TODO: Generate when setting up potato
  - &host_thinky age1rz0k6055dsat660rs3y8jdypmjxdjwaya2w4v0x6q7646m6n8atszz0vzx

creation_rules:
  # Shared secrets accessible by all hosts and users
  - path_regex: secrets/common/[^/]+\.(yaml|json|env)$
    key_groups:
    - age:
      - *user_tim
      - *host_thinky
      # Add other hosts here when they have real keys

  # MacBook Pro specific secrets
  - path_regex: secrets/mbp/[^/]+\.(yaml|json|env)$
    key_groups:
    - age:
      - *user_tim
      - *host_mbp

  # Potato specific secrets
  - path_regex: secrets/potato/[^/]+\.(yaml|json|env)$
    key_groups:
    - age:
      - *user_tim
      - *host_potato

  # WSL specific secrets
  - path_regex: secrets/thinky-nixos/[^/]+\.(yaml|json|env)$
    key_groups:
    - age:
      - *user_tim
      - *host_thinky