From 62a927c5528803272f88a153499e2128e1d32ad8 Mon Sep 17 00:00:00 2001
From: autonomic-bot <mfowler.email@protonmail.com>
Date: Mon, 7 Sep 2026 21:30:49 +0000
Subject: [PATCH] sops: the combined cc-ci host's ssh host key is a recipient
 (secrets submodule bumped)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

cc-ci-secrets now encrypts to the new host (195.201.88.249) via its own
ssh-host-key-derived age identity, like the canonical cc-ci did, so the
off-box master recovery key no longer has to live on that box —
/var/lib/sops-nix/key.txt there holds the host-derived identity instead.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz
---
 .sops.yaml | 2 ++
 secrets    | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/.sops.yaml b/.sops.yaml
index e7ba0d8..34b8e9e 100644
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -5,10 +5,12 @@
 #            /srv/cc-ci/.sops/master-age.txt (never in this repo). Lets us re-key if cc-ci is lost.
 keys:
   - &host   age1h90utdztfc23kx8ewrtrtk80mnddvrf8pg4ppej55rwwwupzhfvqhmp3qa
+  - &host2  age1tmvgpgc822ezqgxg4x8h6ndph6j9hwpgjpg364zn7lw3t5h694rq5730wa
   - &master age1cmk26t9e30ls8594s8txgmf2exenydmntfxqpcd3qdqm3ru2lpnqpdkdz9
 creation_rules:
   - path_regex: secrets/.*\.(yaml|json|env)$
     key_groups:
       - age:
           - *host
+          - *host2
           - *master
diff --git a/secrets b/secrets
index 2ce5f86..638c28d 160000
--- a/secrets
+++ b/secrets
@@ -1 +1 @@
-Subproject commit 2ce5f86c0216cc0e4fdb5b2ec1248b34165066cd
+Subproject commit 638c28dae8f01f0549209a4b7a4f1c4e5963ac1f