sops: add yuvomi-api-token + hermes-house-users secrets (house + workstations)

2026-06-28 16:02:13 +02:00
parent 335498d069
commit cef1b836c2
3 changed files with 113 additions and 0 deletions
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -92,4 +92,21 @@ creation_rules:
      age1vf8h7s8mqsn2q5eadgpdupsj4mwn8zguc77d85ws3xj40sl9rgksx2rxw6,
      age1z62ff2ak9zj5ctcvaxwyyhedwjvlwgm2dkn9nk3wrwk8fkavcpmsqwc2vs,
      age1s07zs83ehtlg8jtwvr75ltc3c4cdlemfwjuxrwjtwkqxkl9tpggsyrzn2h
+
+  - path_regex: ^secrets/yuvomi-api-token\.yaml$
+    # Named Bearer token for the Yuvomi REST API, consumed by yuvomi-mcp on
+    # LXC 129 (house).
+    age: >-
+      age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6,
+      age1vf8h7s8mqsn2q5eadgpdupsj4mwn8zguc77d85ws3xj40sl9rgksx2rxw6,
+      age1z62ff2ak9zj5ctcvaxwyyhedwjvlwgm2dkn9nk3wrwk8fkavcpmsqwc2vs,
+      age1s07zs83ehtlg8jtwvr75ltc3c4cdlemfwjuxrwjtwkqxkl9tpggsyrzn2h
+
+  - path_regex: ^secrets/hermes-house-users\.yaml$
+    # Signal number → Yuvomi user_id mapping (PII). Consumed by hermesd on LXC 129.
+    age: >-
+      age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6,
+      age1vf8h7s8mqsn2q5eadgpdupsj4mwn8zguc77d85ws3xj40sl9rgksx2rxw6,
+      age1z62ff2ak9zj5ctcvaxwyyhedwjvlwgm2dkn9nk3wrwk8fkavcpmsqwc2vs,
+      age1s07zs83ehtlg8jtwvr75ltc3c4cdlemfwjuxrwjtwkqxkl9tpggsyrzn2h
 # webhook noop 2026-05-20T18:16:57+02:00
--- a/secrets/hermes-house-users.yaml
+++ b/secrets/hermes-house-users.yaml
@@ -0,0 +1,48 @@
+members: {}
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRV2RRYVNaVE5STW5xaEF6
+            Q1IwWkM5MlUycWRPenFRdGluSDM2a29HQzNZCkFyQnducEhIUFFMZW5EZTRObitV
+            bnFNMUdLc0VIckM0NGRSTm1nNWRucFkKLS0tIEdSb2tMUFR0QlB0RnRtNkJ0QUp0
+            YmV6dVZqdFNQQXdOZVZweHhXUWpvOVkKzRHoxbJjNjEzIas8JmPhLZWO9RmELPF/
+            lQS0INH0DJjwqH29R0cbNcZa79j/TCC5iwmJkoV0B1E5K/4Pc2UJMw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1vf8h7s8mqsn2q5eadgpdupsj4mwn8zguc77d85ws3xj40sl9rgksx2rxw6
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzZi9ISjR4MC9PcFNYL0o5
+            akJCODNRMFdFZFhiMXUrWFFTZGw1eGJkc3hBCi9uVkR3UU5CUzQvSGVKWGJLRjhI
+            SHVkVWVHVkpCMHlzanZaelVnOU9qOW8KLS0tIDVuSGlLdS95L2NXTGlnMldwWWR5
+            S1lvZEVRVEhnc1FIMnlvbTNzRlk5QVkK0l2APy0HAvmcy+gVrWt1LfO/z8+7bGbq
+            OxWYM8fAtE7f/uPhZITZjNv4U/SjhDDrGzbWz5sbsUaIUcQ6dKdV+g==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1z62ff2ak9zj5ctcvaxwyyhedwjvlwgm2dkn9nk3wrwk8fkavcpmsqwc2vs
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrdlFSMFRsak81Q3hQWER6
+            SnRtVEFncGRpYk9mUklSYjlUWUYrQVdncUF3CjZPOWZKbHZuK1VOL0dCWklaZjV1
+            cW45bUo2ZFNmY0RTWEE5NmZNTlRmVjQKLS0tIHdsUVkvRjRHZ3ZhSWNVUCtOTzdX
+            eEprOGpOYUQ5YVcrVGJTQzZlQ09VUjQKyyi0NWf2ojG1VlIcyLd2vzIhSg6aiHJT
+            37zWLpIIRjCMBZSTvfzYNDp4YtfUSoQX3k+Er/bUSN7XD3B7Jjnj4Q==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1s07zs83ehtlg8jtwvr75ltc3c4cdlemfwjuxrwjtwkqxkl9tpggsyrzn2h
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmaUtwbkZMeDh5TjdZWS9i
+            WFVKTFczRVhUamE5U0lpa1ZvZEtSaGkrSEZVCmFmK29ZbE5lWnhDcTFPVk5ZUUxG
+            TXlzL2NNeUM5TUJHSWh4eSt3Y0N1d1kKLS0tIGRLSCtKVnlOTkllbnNmMnlVZ21p
+            bUVCYmdra3JhSnJGZWZ5SzlzUFhhanMKyJSRr/PchwUStZFuCvxTO+CkzpJsxRWl
+            ucA1X6M8g/wQjkTuHGwXFIS+S20KfISRne827/I1xQTBuDgVR25Gcw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-06-28T14:02:13Z"
+    mac: ENC[AES256_GCM,data:cHzbtonuPFxq15erfvnR9U8IOH7GBk2SH3vP60hWdAUrs3284EQVnqLPRxX2NL6WGfk18BimOwERRdsjoZizgDBgbfO3vWGkY3ybluGn1QGyR2SGLC+YdO7tVurbvVloia/8hkhHxpoXVkXQl0enR20yGdnlOXSiEjtL2MaDln8=,iv:x71D1K13cfL/WZzfSQBY5XyfylDtwRF5t4dnJTv3NT8=,tag:XpTaGrAK4y+jiG+VD+MRUQ==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.4
--- a/secrets/yuvomi-api-token.yaml
+++ b/secrets/yuvomi-api-token.yaml
@@ -0,0 +1,48 @@
+token: ENC[AES256_GCM,data:LgiLFEsli412rVxSo9YU69wx9Lh7eDGBw6nmROh6Qbw7bYN8lylNjSDWkjNJ/UJvDg==,iv:vNmiV/D+SQaMtgwTK/mFDQIwSQ/L0JRatmoj5AWfBiw=,tag:W5P98TlmevQ0j051044LPQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQYVBwS250T0ZFa2VGbGow
+            R0MwMzNsY0t2N1ZBVnlnbkF6UEIyUStaUEhJCnBuNWNZT1VxRFlKNFBjOTZHNEd0
+            cCtxN1p3TjkzWUZNZkdZeXRJVEhaQzgKLS0tIFVSWUpVQ2k3VE83eHU4VmR4SnVH
+            RVgxdDNnKzMwM2c2bm1YS1ZSRDdsMVkK8PVncSpesaxIEz7a39rVBzB0V3RphmAA
+            ANV8fY4W4tLuxo+EhB90ciy2dnAHaKEbxHBWMMjN4u22yZRT4lPWQw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1vf8h7s8mqsn2q5eadgpdupsj4mwn8zguc77d85ws3xj40sl9rgksx2rxw6
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4Sk1hdENFQWIvZXhIK0U0
+            TmhCWkw5TWhSVXdIbDN5SmVNdHkwYm1aOGxvCmlnQmZYWitxUmdURzNYRDBFUUVM
+            TjdIN2FEd2ptWG5UVlFCb1IyVzFjMmsKLS0tIDJMZHlXVHFNUlY2bnhlS3hFT3FY
+            U2szdVB4MGxxUnpJN1BBaUhKVE5WQkEKz7BkFIfs2RSyAww73dH5+PyDNjo4Ocor
+            mX5pLhSRGGf13bfA5lMQiGvqtd3jw1c4zKVZD9BcthIk5H/oqallNQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1z62ff2ak9zj5ctcvaxwyyhedwjvlwgm2dkn9nk3wrwk8fkavcpmsqwc2vs
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmVWI2L05GbjdLR1k3a280
+            N2RRWmZsZWZPeWdmd3I3aThrV1ppOEw4VTJRCit6aXgwTVIwQldkSmpRNkM4UTh4
+            UEcyQjkrMFk2UGVBL1JZdGg2WDI3c0EKLS0tIGV5VkRWYWpXZXZGN1FXNmhTSmR5
+            cjQ0TWg0TkFmMnIyMDNBNVZXa1l0REUKVHdvbXFwLgMECi2JLg8aoYIkOWHwYyZh
+            v3mVVaaki5KceuyUhcGsdthNadrM0RDi89uUw8O2cfADdDgLlha/iQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1s07zs83ehtlg8jtwvr75ltc3c4cdlemfwjuxrwjtwkqxkl9tpggsyrzn2h
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnemkvTUxHZDNxYmJ4eGRK
+            Y09laWNnN0pXN1VHQzUzSWlJZGFqcmkwTWdJCjkxZG9pVVVzWXBTU0lpL0JFR2w3
+            TWhPTDNFSXhPTkVMVUpOY0xHMlN6RkkKLS0tIDB3d0ZyRVpGT3YzSXIrM1pPQ1Uz
+            QkpQYXRWaGtabnU5c1RpeE9vb0MwMWcKVRnpepDJ8a2ECD5uaK6O3fMKwWcLJP8a
+            uFWds5rvwDfrM1aNLXYbPIfXtqLx4fbxkoRZvHcuZ2/lYLDBFBrFlQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-06-28T14:02:13Z"
+    mac: ENC[AES256_GCM,data:NDjBNtSzGdm0+SqAvaUlltljXcyXzLQx3b9RUWZIlS/D3ox1BTO6t3t4WT8szbSnKcT51mJGJ8EIqppNWkmOpEaMNGdMw70DmGnf/IJAzScTpRyvhfsGlohCVaekMBjF+wg1uoB91vSKcTFq/wfUW79KICmxMF6woavRQ94yfQs=,iv:1f9sGKyTITSslqDXB3Khk/OGiPaJM2BreSEG6aTbZDs=,tag:UulDl/JQamg/p/q4esvtIA==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.4