nix-dotfiles/.sops.yaml

keys:
  # The PGP keys in keys/
  - &admin_alice F63832C3080D6E1AC77EECF80B4245FFE305BC82
  - &admin_dennis 8F79E6CD6434700615867480D11A514F5095BFA8
  
  # Generate AGE keys from SSH keys with:
  #   nix-shell -p ssh-to-age --run 'ssh some.ssh.wavelens.io cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age'
  - &palatine-hill age1z8q02wdp0a2ep5uuffgfeqlfam4ztl95frhw5qhnn6knn0rrmcnqk5evej
  - &photon age1rjlc6vwnz2lcrpshtd9rldlxels6l2utwmnmf3prus8drfefeywq5ljrdg

# update keys by executing: sops updatekeys secrets.yaml
creation_rules:
  - path_regex: systems/palatine-hill/secrets\.yaml$
    key_groups:
    - pgp:
      - *admin_alice
      - *admin_dennis
      age:
      - *palatine-hill

  - path_regex: systems/photon/secrets\.yaml$
    key_groups:
    - pgp:
      - *admin_alice
      - *admin_dennis
      age:
      - *photon
  
  - path_regex: users/alice/secrets\.yaml$
    key_groups:
    - pgp:
      - *admin_alice
      age:
      - *palatine-hill
      - *photon
    
  - path_regex: users/dennis/secrets\.yaml$
    key_groups: 
    - pgp:
      - *admin_dennis
      age:
      - *palatine-hill
      - *photon