# SOPS encryption policy: encrypt files matching *.sops.yaml
creation_rules:
  - path_regex: '.*\.sops\.ya?ml$'
    encrypted_regex: '^(data|secrets|ops)$|(_secret|_password|_key)$'
    # Replace with your age public key string (from keys/age.pub)
    age:
      - 'age1replace_with_your_public_key_here'