coulomb/railiance-infra
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Define S1 reef rollout handoff
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details

Browse source
This commit is contained in:
codex 2026-07-25 15:13:41 +02:00
parent 992e42a232
commit e176738fad
13 changed files with 256 additions and 39 deletions
Download patch file Download diff file Expand all files Collapse all files

11
docs/age-keys.md
View file

@ -107,6 +107,15 @@ If everything works, you are ready to store secrets securely in Git.
## 🔑 Secrets Handling Digest
In RailianceHosts, **age private keys never leave your workstation**. Secrets in the repo are encrypted to one or more **public keys** listed in `.sops.yaml`. To decrypt, you either load your private key into the environment (`SOPS_AGE_KEY`) or keep it in your local `~/.config/sops/age/keys.txt` (never in Git). Ansible and Terraform decrypt files only on the control machine, so plaintext is injected at runtime but never stored on servers. For teams, simply add multiple public keys as recipients; each operator decrypts with their own private key. In CI/CD, the private key is injected securely as a secret variable. This ensures encryption is repo-wide and portable, while private keys remain personal, local, and outside version control.
In `railiance-infra`, **age private keys never leave your workstation**.
Secrets in the repo are encrypted to one or more **public keys** listed in
`.sops.yaml`. To decrypt, you either load your private key into the environment
(`SOPS_AGE_KEY`) or keep it in your local `~/.config/sops/age/keys.txt` (never
in Git). Ansible and Terraform decrypt files only on the control machine, so
plaintext is injected at runtime but never stored on servers. For teams, simply
add multiple public keys as recipients; each operator decrypts with their own
private key. In CI/CD, the private key is injected securely as a secret
variable. This ensures encryption is repo-wide and portable, while private keys
remain personal, local, and outside version control.
✅ That’s it — your secrets are now protected with your own master key.