# sops updatekeys <fname>
keys: # https://github.com/getsops/sops/pull/1123
  user_pbsds: &user_pbsds
  # test -s ~/.config/sops/age/keys.txt || ( mkdir -p ~/.config/sops/age; age-keygen -o ~/.config/sops/age/keys.txt >/dev/null ); age-keygen -y ~/.config/sops/age/keys.txt
  - &user_pbsds_sopp   age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
  - &user_pbsds_nord   age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
  - &user_pbsds_bjarte age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
  - &user_pbsds_hm_pvv age1dws633vckj6aye9y5p0nv867v2y06j6cfeys87rsy6e8nq6dsfyqg0aksk
  hosts: &hosts
  # ssh $(remote-host) cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age
  - &host_sopp   age1zvqjaanff7x3f2a7853sd9ylna99khw4x6qfpf6am4yupsc44phsr2vfy3
  - &host_nox    age1zh3nmy2a7s2v7g9t7zg56p8sjqwmvqv5s7dn2v22x5nxyl5wfdcsaf5tw7
  - &host_bolle  age14d0ahjjk02jyc25hhx9ws333r0yk5e06yf4ys8xhz2um7jp6qqaqfcdksg
  - &host_garp   age14qunhxz08gmw5r8ky0ez9rjf9dj3ue9hrzz580gwwj4cms46vd7ss4rutf
  - &host_eple   age1fha09v5edg88ys45a0u3tpjqfyl29fsy9xaz8xxfy60zjhmas5psfdxynp
  - &host_nord   age19xrvt0gjl4fcfjyy62mrl9uuzrq9e0wgemtkykr07ewz7nqn9cwshngel5
  - &host_brumle age1czlqpfdvey2hzgr79skxvtg4stnfawq045l5sl59j0cd9hfuqvlq83v647 # brumlebasse
  - &host_bjarte age13dmsned3exqn2wwwxa465vwmdtfuktk49gpshwtu0ujp94syzq5suj0a9w

# https://github.com/getsops/sops#key-groups
creation_rules:
  # global
  - path_regex: secrets/default.yaml$
    key_groups:
    - age:
      - *user_pbsds_sopp
      - *user_pbsds_nord
      - *user_pbsds_bjarte
      - *host_sopp
      - *host_nox
      - *host_bolle
      - *host_garp
      - *host_eple
      - *host_nord
      - *host_brumle
      - *host_bjarte
  # dns
  - path_regex: secrets/dns.yaml$
    key_groups:
    - age:
      - *user_pbsds_sopp
      - *user_pbsds_nord
      - *user_pbsds_bjarte
      - *host_nox
      - *host_bolle
      - *host_garp
      - *host_eple
      - *host_brumle
  # home-manager
  - path_regex: secrets/user-pbsds.yaml$
    key_groups:
    - age:
      - *user_pbsds_sopp
      - *user_pbsds_nord
      - *user_pbsds_bjarte
  # sopp only
  - path_regex: secrets/sopp(/[^/]+)?\.yaml$
    key_groups:
    - age:
      - *user_pbsds_sopp
      - *user_pbsds_nord
      - *user_pbsds_bjarte
      - *host_sopp
  # nox only
  - path_regex: secrets/noximilien(/[^/]+)?\.yaml$
    key_groups:
    - age:
      - *user_pbsds_sopp
      - *user_pbsds_nord
      - *user_pbsds_bjarte
      - *host_nox
  # bolle only
  - path_regex: secrets/bolle(/[^/]+)?\.yaml$
    key_groups:
    - age:
      - *user_pbsds_sopp
      - *user_pbsds_nord
      - *user_pbsds_bjarte
      - *host_bolle
  # garp only
  - path_regex: secrets/garp(/[^/]+)?\.yaml$
    key_groups:
    - age:
      - *user_pbsds_sopp
      - *user_pbsds_nord
      - *user_pbsds_bjarte
      - *host_garp
  # eple only
  - path_regex: secrets/eple(/[^/]+)?\.yaml$
    key_groups:
    - age:
      - *user_pbsds_sopp
      - *user_pbsds_nord
      - *user_pbsds_bjarte
      - *host_eple
  # nord only
  - path_regex: secrets/nord(/[^/]+)?\.yaml$
    key_groups:
    - age:
      - *user_pbsds_sopp
      - *user_pbsds_nord
      - *user_pbsds_bjarte
      - *host_nord
  # bjarte only
  - path_regex: secrets/bjarte(/[^/]+)?\.yaml$
    key_groups:
    - age:
      - *user_pbsds_sopp
      - *user_pbsds_nord
      - *user_pbsds_bjarte
      - *host_bjarte
  # brumlebasse only
  - path_regex: secrets/brumle(basse)?(/[^/]+)?\.yaml$
    key_groups:
    - age:
      - *user_pbsds_sopp
      - *user_pbsds_nord
      - *user_pbsds_bjarte
      - *host_brumle