notplantsandClaude Fable 5.1
62a927c552
continuous-integration/drone/push Build is failing
cc-ci-secrets now encrypts to the new host (195.201.88.249) via its own ssh-host-key-derived age identity, like the canonical cc-ci did, so the off-box master recovery key no longer has to live on that box — /var/lib/sops-nix/key.txt there holds the host-derived identity instead. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz
17 lines
775 B
YAML
17 lines
775 B
YAML
# sops creation rules. Recipients:
|
|
# host — cc-ci's age key, derived from its ed25519 SSH host key (ssh-to-age).
|
|
# Used at activation to decrypt into /run/secrets (sops-nix, age.sshKeyPaths).
|
|
# master — off-box recovery/admin key; private half lives ONLY on the build host at
|
|
# /srv/cc-ci/.sops/master-age.txt (never in this repo). Lets us re-key if cc-ci is lost.
|
|
keys:
|
|
- &host age1h90utdztfc23kx8ewrtrtk80mnddvrf8pg4ppej55rwwwupzhfvqhmp3qa
|
|
- &host2 age1tmvgpgc822ezqgxg4x8h6ndph6j9hwpgjpg364zn7lw3t5h694rq5730wa
|
|
- &master age1cmk26t9e30ls8594s8txgmf2exenydmntfxqpcd3qdqm3ru2lpnqpdkdz9
|
|
creation_rules:
|
|
- path_regex: secrets/.*\.(yaml|json|env)$
|
|
key_groups:
|
|
- age:
|
|
- *host
|
|
- *host2
|
|
- *master
|