140 lines
4.0 KiB
YAML
140 lines
4.0 KiB
YAML
# sops updatekeys <fname>
|
|
keys: # https://github.com/getsops/sops/pull/1123
|
|
user_pbsds: &user_pbsds
|
|
# test -s ~/.config/sops/age/keys.txt || ( mkdir -p ~/.config/sops/age; age-keygen -o ~/.config/sops/age/keys.txt >/dev/null ); age-keygen -y ~/.config/sops/age/keys.txt
|
|
- &user_pbsds_sopp age1hmpdk4h69wxpwqk9tkud39f66hprhehxtzhgw97r6dvr7v0mx5jscsuhkn
|
|
- &user_pbsds_nord age1wrssr4z4g6vl3fd3qme5cewchmmhm0j2xe6wf2meu4r6ycn37anse98mfs
|
|
- &user_pbsds_bjarte age1zhxul786an743u0fascv4wtc5xduu7qfy803lfs539yzhgmlq5ds2lznt5
|
|
- &user_pbsds_hm_pvv age1dws633vckj6aye9y5p0nv867v2y06j6cfeys87rsy6e8nq6dsfyqg0aksk
|
|
hosts: &hosts
|
|
# ssh $(remote-host) cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age
|
|
- &host_sopp age1zvqjaanff7x3f2a7853sd9ylna99khw4x6qfpf6am4yupsc44phsr2vfy3
|
|
- &host_nox age1zh3nmy2a7s2v7g9t7zg56p8sjqwmvqv5s7dn2v22x5nxyl5wfdcsaf5tw7
|
|
- &host_bolle age14d0ahjjk02jyc25hhx9ws333r0yk5e06yf4ys8xhz2um7jp6qqaqfcdksg
|
|
- &host_garp age14qunhxz08gmw5r8ky0ez9rjf9dj3ue9hrzz580gwwj4cms46vd7ss4rutf
|
|
- &host_eple age1fha09v5edg88ys45a0u3tpjqfyl29fsy9xaz8xxfy60zjhmas5psfdxynp
|
|
- &host_nord age19xrvt0gjl4fcfjyy62mrl9uuzrq9e0wgemtkykr07ewz7nqn9cwshngel5
|
|
- &host_brumle age1czlqpfdvey2hzgr79skxvtg4stnfawq045l5sl59j0cd9hfuqvlq83v647 # brumlebasse
|
|
- &host_bjarte age13dmsned3exqn2wwwxa465vwmdtfuktk49gpshwtu0ujp94syzq5suj0a9w
|
|
|
|
# https://github.com/getsops/sops#key-groups
|
|
creation_rules:
|
|
# global
|
|
- path_regex: secrets/common.yaml$
|
|
key_groups:
|
|
- age:
|
|
- *user_pbsds_sopp
|
|
- *user_pbsds_nord
|
|
- *user_pbsds_bjarte
|
|
- *host_sopp
|
|
- *host_nox
|
|
- *host_bolle
|
|
- *host_garp
|
|
- *host_eple
|
|
- *host_nord
|
|
- *host_brumle
|
|
- *host_bjarte
|
|
# dns
|
|
- path_regex: secrets/dns.yaml$
|
|
key_groups:
|
|
- age:
|
|
- *user_pbsds_sopp
|
|
- *user_pbsds_nord
|
|
- *user_pbsds_bjarte
|
|
- *host_nox
|
|
- *host_bolle
|
|
- *host_garp
|
|
- *host_eple
|
|
- *host_brumle
|
|
- path_regex: secrets/tailscale-inner.yaml$
|
|
key_groups:
|
|
- age:
|
|
- *user_pbsds_sopp
|
|
- *user_pbsds_nord
|
|
- *user_pbsds_bjarte
|
|
- *host_sopp
|
|
- *host_nox
|
|
- *host_eple
|
|
- *host_nord
|
|
- *host_bjarte
|
|
- path_regex: secrets/tailscale-outer.yaml$
|
|
key_groups:
|
|
- age:
|
|
- *user_pbsds_sopp
|
|
- *user_pbsds_nord
|
|
- *user_pbsds_bjarte
|
|
- *host_brumle
|
|
- *host_bolle
|
|
- *host_garp
|
|
# home-manager
|
|
- path_regex: secrets/user-pbsds.yaml$
|
|
key_groups:
|
|
- age:
|
|
- *user_pbsds_sopp
|
|
- *user_pbsds_nord
|
|
- *user_pbsds_bjarte
|
|
# sopp only
|
|
- path_regex: hosts/nixos/sopp/secrets.yaml
|
|
key_groups:
|
|
- age:
|
|
- *user_pbsds_sopp
|
|
- *user_pbsds_nord
|
|
- *user_pbsds_bjarte
|
|
- *host_sopp
|
|
# nox only
|
|
- path_regex: hosts/nixos/noximilien/secrets.yaml
|
|
key_groups:
|
|
- age:
|
|
- *user_pbsds_sopp
|
|
- *user_pbsds_nord
|
|
- *user_pbsds_bjarte
|
|
- *host_nox
|
|
# bolle only
|
|
- path_regex: hosts/nixos/bolle/secrets.yaml
|
|
key_groups:
|
|
- age:
|
|
- *user_pbsds_sopp
|
|
- *user_pbsds_nord
|
|
- *user_pbsds_bjarte
|
|
- *host_bolle
|
|
# garp only
|
|
- path_regex: hosts/nixos/garp/secrets.yaml
|
|
key_groups:
|
|
- age:
|
|
- *user_pbsds_sopp
|
|
- *user_pbsds_nord
|
|
- *user_pbsds_bjarte
|
|
- *host_garp
|
|
# eple only
|
|
- path_regex: hosts/nixos/eple/secrets.yaml
|
|
key_groups:
|
|
- age:
|
|
- *user_pbsds_sopp
|
|
- *user_pbsds_nord
|
|
- *user_pbsds_bjarte
|
|
- *host_eple
|
|
# nord only
|
|
- path_regex: hosts/nixos/nord/secrets.yaml
|
|
key_groups:
|
|
- age:
|
|
- *user_pbsds_sopp
|
|
- *user_pbsds_nord
|
|
- *user_pbsds_bjarte
|
|
- *host_nord
|
|
# bjarte only
|
|
- path_regex: hosts/nixos/bjarte/secrets.yaml
|
|
key_groups:
|
|
- age:
|
|
- *user_pbsds_sopp
|
|
- *user_pbsds_nord
|
|
- *user_pbsds_bjarte
|
|
- *host_bjarte
|
|
# brumlebasse only
|
|
- path_regex: hosts/nixos/brumlebasse/secrets.yaml
|
|
key_groups:
|
|
- age:
|
|
- *user_pbsds_sopp
|
|
- *user_pbsds_nord
|
|
- *user_pbsds_bjarte
|
|
- *host_brumle
|