From bc578df39b6e32ee465e96a40c02187a9bebcab2 Mon Sep 17 00:00:00 2001
From: root <root@hubris.local>
Date: Wed, 20 May 2026 16:39:33 +0200
Subject: [PATCH] secrets: add encrypted hello.yaml (bootstrap verification)

Encrypted to hubris + apps; expand recipients as new clients enrol via
'sops updatekeys -y secrets/hello.yaml'. Tests the full sops + age path.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .sops.yaml         |  9 ++++-----
 secrets/hello.yaml | 31 +++++++++++++++++++++++++++++++
 2 files changed, 35 insertions(+), 5 deletions(-)
 create mode 100644 secrets/hello.yaml

diff --git a/.sops.yaml b/.sops.yaml
index c84f3e0..7ee95ff 100644
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -18,12 +18,11 @@
 creation_rules:
   - path_regex: ^secrets/hello\.yaml$
     # The "hello" secret is encrypted to every enrolled client so the bootstrap
-    # decrypt test works for everyone. Populated by the operator with the
-    # age_pubkey from each hosts/<name>.yaml after Phase 3a generates keys.
+    # decrypt test works for everyone. Add each new client's age_pubkey when
+    # they enrol; re-key with `sops updatekeys -y secrets/hello.yaml`.
     age: >-
-      # placeholder — operator fills in after first issuance run.
-      # comma-separated age public keys, e.g.:
-      #   age1xxx,age1yyy,age1zzz
+      age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6,
+      age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0
 
   - path_regex: ^secrets/gitea-tokens\.yaml$
     # Workstations only.
diff --git a/secrets/hello.yaml b/secrets/hello.yaml
new file mode 100644
index 0000000..1877a7b
--- /dev/null
+++ b/secrets/hello.yaml
@@ -0,0 +1,31 @@
+greeting: ENC[AES256_GCM,data:eNMtZcpv04PHl/lGBZGBp7xAcO/5Sw==,iv:A4jtwePX0p/eDTP5+ztfV6gege9RwdPfLBY2N+DPfx0=,tag:MU8HpvLt/PUrNMw7BNUVIg==,type:str]
+phase: ENC[AES256_GCM,data:oIeo+kmkwaMDQrf10iY2PqOXJnq+hCIwOROQ86xgpkU7EJEeJKFssrNgbvQPHhIRZUZblQg9ZPamiZixQbYSTOXQSTWWu2FOnu6XFb24wCay,iv:TYKqoHcN+V324/roNopYhkwRpmv3cPrTFcmni5TajYQ=,tag:g8DXqEyORbQZ9B7PaFWgOQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKQjZrSWpEbCsvNlB0NTdh
+            MU9hN3pSU1lkVXM0OUFqNUsrWUVlR3ExU2lVCjF2U3BCc0xlMHRPcEY2ZkdKZW41
+            TTlRNVBRbzlHVTh2T0krRTAzaFFMUnMKLS0tIG8vTTAyNlc5RXNOdkR4cWVKTGtk
+            NE9xeXRKR0c5Q1k3OVhzQmtYeHpjamsKdSfpAKgJaas7AhlUTplzcnMsAI/1NBJ4
+            uWD0IlJsIR3B2l/3h5LgrhkyQj/hLI5pFMptNwLXQUjN+Kleq5v/QQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxaWFOOWI3cFMrWGt1RGow
+            RE5icW1rVEIraGExWWlqSmQ2aGh6aVNoS2hjCjZyRzBCZGpyczRySmErYkNPWHBM
+            N0RweWVmeUlQK1lNTnFQN1VqMVZlalUKLS0tIGpnNzRlaUJSVkE0RDVSRXBqV2t0
+            b09sVU9neWRPYkdVSmhRd3pZelkzTmsKEEvuq8cVtX/zVji3V+SqX/4cZitBD20U
+            w5NUMIT8gXHBVE5uTXqRmFPXGD9PgnCy0CZbE9CguZwav8a4KGYOPw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-05-20T14:39:14Z"
+    mac: ENC[AES256_GCM,data:CAoIW1sJkIbNoXMaVlXwfHdREzATNqDKpSN5ecaSiRARThB0/tcLNbkazXKyV1Rx5b+b3s+yCpBzwmNnH6ytaCzG5pKPcnfd6YJq7C5rm/EQHyaVGrPdBsSfqiz4yBXKClej//v3+qkD5Ls2PMppv5KmqigOKNQC/ot3ht2c7lM=,iv:eOmDDclksr9f9CDu6dJprSFwlWuoggzVFjyfqWf5Uhg=,tag:IU3sMlIi92ohM86zOIJdAg==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.4