# SOPS recipient rules.
#
# Each rule pins one or more age public keys as recipients for files matching
# the path_regex. The build_host_files.py generator doesn't read this file;
# `sops` does — to encrypt a new secret, run `sops -e secrets/<name>.yaml`
# from the repo root and SOPS will pick the matching rule below.
#
# To grant a secret to a new client: add their age public key (from
# inventory.yaml `hosts.<name>.age_pubkey`) to the relevant rule below, then
# run `sops updatekeys secrets/<name>.yaml` to re-encrypt without rotating
# the ciphertext payload.
#
# To revoke: remove the recipient from the relevant rule and run
# `sops updatekeys` (this is what `homelab client remove` calls). Past
# ciphertext the client already decrypted is not affected — rotate the
# underlying credential if compromise is suspected.

creation_rules:
  - path_regex: ^secrets/hello\.yaml$
    # The "hello" secret is encrypted to every enrolled client so the bootstrap
    # decrypt test works for everyone. Add each new client's age_pubkey when
    # they enrol; re-key with `sops updatekeys -y secrets/hello.yaml`.
    age: >-
      age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6,
      age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0,
      age1vf8h7s8mqsn2q5eadgpdupsj4mwn8zguc77d85ws3xj40sl9rgksx2rxw6

  - path_regex: ^secrets/gitea-pat\.yaml$
    # Write-scoped Gitea PAT (dtoro user). Same recipient list as hello.yaml
    # since every enrolled client should be able to push (homelab client
    # add/remove, wiki edits, etc.).
    age: >-
      age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6,
      age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0,
      age1vf8h7s8mqsn2q5eadgpdupsj4mwn8zguc77d85ws3xj40sl9rgksx2rxw6

  - path_regex: ^secrets/gitea-tokens\.yaml$
    # Workstations only.
    age: >-
      # placeholder — fill with age_pubkey of: republic-laptop, mac-mini, ludo-mini, hubris

  - path_regex: ^secrets/webhook-hmacs\.yaml$
    # LXCs that run a webhook receiver.
    age: >-
      # placeholder — fill with age_pubkey of: apps, caddy, claudio-bot, claudio-monitor host
# webhook noop 2026-05-20T18:16:57+02:00