tegwick
681c5b0ea1
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a12d13-27f2-7163-b8c0-f682af02772c
18 lines
893 B
YAML
18 lines
893 B
YAML
# SOPS encryption rules for net-kingdom
|
|
# Any file under a secrets/ directory (at any depth) is encrypted with the operator age key.
|
|
# Same age keypair as railiance-infra — one key per operator across all repos.
|
|
#
|
|
# Key fingerprint: age1aq8twfd78wvpra0had8cezcnj96tj4q0068edrz5jez8d6xwmflqdepsh4
|
|
# Public key stored in: keys/age.pub
|
|
#
|
|
# To edit an encrypted file: sops secrets/<file>
|
|
# To encrypt a new file: sops --encrypt --in-place secrets/<file>
|
|
# Attended private recovery: make sops-decrypt FILE=secrets/<file>.yaml OUTPUT=<private-directory>/<new-file>
|
|
# Run through the custody unlock helper; never decrypt into a transcript.
|
|
# To add a recipient: update .sops.yaml + sops --rotate --in-place secrets/<file>
|
|
|
|
creation_rules:
|
|
- path_regex: secrets/.*$
|
|
key_groups:
|
|
- age:
|
|
- age1aq8twfd78wvpra0had8cezcnj96tj4q0068edrz5jez8d6xwmflqdepsh4
|