# SOPS encryption rules for net-kingdom
# Any file under a secrets/ directory (at any depth) is encrypted with the operator age key.
# Same age keypair as railiance-infra — one key per operator across all repos.
#
# Public key stored in: keys/age.pub
#
# To replace encrypted content: make sops-edit FILE=secrets/<file>.yaml INPUT=<private-directory>/<replacement>.yaml
# To encrypt a private untracked file: make sops-encrypt FILE=secrets/<file>.yaml
# Attended private recovery: make sops-decrypt FILE=secrets/<file>.yaml OUTPUT=<private-directory>/<new-file>
# Run through the custody unlock helper; never decrypt into a transcript.
# To rotate the data key only: make sops-rotate FILE=secrets/<file>.yaml
# Recipient changes require a separately reviewed custody migration; rotate does not apply this config.

creation_rules:
  - path_regex: secrets/.*$
    key_groups:
      - age:
          - age1aq8twfd78wvpra0had8cezcnj96tj4q0068edrz5jez8d6xwmflqdepsh4