infra/.sops.yaml

keys:
  - &build01 age17jtyn2y4fpey6q7ers9gtnh4580xj89zdjuew9nqhxywmsaw94fs5udupc
  - &build02 age1kh6yvgxz9ys74as7aufdy8je7gmqjtguhnjuxvj79qdjswk2r3xqxf2n6d
  - &build03 age1qg7tfjwzp6dxwkw9vej6knkhdvqre3fu7ryzsdk5ggvtdx854ycqevlwnq
  - &build04 age1r464z5e2shvnh9ekzapgghevr9wy7spd4d7pt5a89ucdk6kr6yhqzv5gkj
  - &github_actions age1hdmmmv423xajuv4pjumnj35j34e4rhta3wgatjafy3dxf38yycysqzl4mn
  - &hercules_tf age1lk9prt0l75xyj4r9lvel5cdac4ll8jnywrm0fp8nackeqzmwkfqq974lst
  - &mic92 age17n64ahe3wesh8l8lj0zylf4nljdmqn28hvqns2g7hgm9mdkhlsvsjuvkxz
  - &ryantm age1d87z3zqlv6ullnzyng8l722xzxwqr677csacf3zf3l28dau7avfs6pc7ay
  - &zimbatm age1jrh8yyq3swjru09s75s4mspu0mphh7h6z54z946raa9wx3pcdegq0x8t4h
  - &zowoq age1m7xhem3qll35d539f364pm6txexvnp6k0tk34d8jxu4ry3pptv7smm0k5n
# scan new hosts with `scan-age-keys` task
creation_rules:
  - path_regex: ^secrets.yaml$
    key_groups:
    - age:
      - *mic92
      - *ryantm
      - *zimbatm
      - *zowoq
  - path_regex: terraform/secrets.yaml$
    key_groups:
    - age:
      - *github_actions
      - *hercules_tf
      - *mic92
      - *ryantm
      - *zimbatm
      - *zowoq
  - path_regex: build01/[^/]+\.yaml$
    key_groups:
    - age:
      - *build01
      - *mic92
      - *ryantm
      - *zimbatm
      - *zowoq
  - path_regex: build02/[^/]+\.yaml$
    key_groups:
    - age:
      - *build02
      - *mic92
      - *ryantm
      - *zimbatm
      - *zowoq
  - path_regex: build03/[^/]+\.yaml$
    key_groups:
    - age:
      - *build03
      - *mic92
      - *ryantm
      - *zimbatm
      - *zowoq
  - path_regex: build04/[^/]+\.yaml$
    key_groups:
    - age:
      - *build04
      - *mic92
      - *ryantm
      - *zimbatm
      - *zowoq
  - path_regex: roles/hercules-ci/.+\.yaml$
    key_groups:
    - age:
      - *build02
      - *build03
      - *build04
      - *mic92
      - *ryantm
      - *zimbatm
      - *zowoq
  - path_regex: roles/.+\.yaml$
    key_groups:
    - age:
      - *build01
      - *build02
      - *build03
      - *build04
      - *mic92
      - *ryantm
      - *zimbatm
      - *zowoq
migrate to sops-nix 2021-09-25 22:35:51 +02:00			`keys:`
			`- &build01 age17jtyn2y4fpey6q7ers9gtnh4580xj89zdjuew9nqhxywmsaw94fs5udupc`
rotate secret for build02 2021-10-24 01:02:16 +02:00			`- &build02 age1kh6yvgxz9ys74as7aufdy8je7gmqjtguhnjuxvj79qdjswk2r3xqxf2n6d`
migrate to sops-nix 2021-09-25 22:35:51 +02:00			`- &build03 age1qg7tfjwzp6dxwkw9vej6knkhdvqre3fu7ryzsdk5ggvtdx854ycqevlwnq`
build04: update age keys + ip address 2023-02-24 08:43:19 +01:00			`- &build04 age1r464z5e2shvnh9ekzapgghevr9wy7spd4d7pt5a89ucdk6kr6yhqzv5gkj`
.sops.yaml: add github_actions for terraform secrets 2022-10-28 12:07:25 +10:00			`- &github_actions age1hdmmmv423xajuv4pjumnj35j34e4rhta3wgatjafy3dxf38yycysqzl4mn`
allow hercules to access terraform secrets 2023-03-13 07:47:34 +10:00			`- &hercules_tf age1lk9prt0l75xyj4r9lvel5cdac4ll8jnywrm0fp8nackeqzmwkfqq974lst`
sops: replace my GPG key with AGE GPG is failing again. Time to get rid of it. This age key is derived from my SSH key that you can double-check from https://github.com/zimbatm.keys 2023-01-21 10:49:50 +01:00			`- &mic92 age17n64ahe3wesh8l8lj0zylf4nljdmqn28hvqns2g7hgm9mdkhlsvsjuvkxz`
			`- &ryantm age1d87z3zqlv6ullnzyng8l722xzxwqr677csacf3zf3l28dau7avfs6pc7ay`
			`- &zimbatm age1jrh8yyq3swjru09s75s4mspu0mphh7h6z54z946raa9wx3pcdegq0x8t4h`
			`- &zowoq age1m7xhem3qll35d539f364pm6txexvnp6k0tk34d8jxu4ry3pptv7smm0k5n`
tasks.py: add ssh-to-age to shell and update comments 2023-02-07 11:01:07 +10:00			# scan new hosts with `scan-age-keys` task
migrate to sops-nix 2021-09-25 22:35:51 +02:00			`creation_rules:`
build{01,02}: add aarch64 builder 2022-08-13 18:02:08 +02:00			`- path_regex: ^secrets.yaml$`
move remaining git-crypt secrets to sops 2022-05-15 17:12:19 +02:00			`key_groups:`
			`- age:`
			`- *mic92`
			`- *ryantm`
			`- *zimbatm`
sops: replace my GPG key with AGE GPG is failing again. Time to get rid of it. This age key is derived from my SSH key that you can double-check from https://github.com/zimbatm.keys 2023-01-21 10:49:50 +01:00			`- *zowoq`
move more secrets to sops and closer to terraform 2022-05-15 16:49:04 +02:00			`- path_regex: terraform/secrets.yaml$`
			`key_groups:`
			`- age:`
sops: replace my GPG key with AGE GPG is failing again. Time to get rid of it. This age key is derived from my SSH key that you can double-check from https://github.com/zimbatm.keys 2023-01-21 10:49:50 +01:00			`- *github_actions`
allow hercules to access terraform secrets 2023-03-13 07:47:34 +10:00			`- *hercules_tf`
move more secrets to sops and closer to terraform 2022-05-15 16:49:04 +02:00			`- *mic92`
			`- *ryantm`
			`- *zimbatm`
sops: replace my GPG key with AGE GPG is failing again. Time to get rid of it. This age key is derived from my SSH key that you can double-check from https://github.com/zimbatm.keys 2023-01-21 10:49:50 +01:00			`- *zowoq`
migrate to sops-nix 2021-09-25 22:35:51 +02:00			`- path_regex: build01/[^/]+\.yaml$`
			`key_groups:`
			`- age:`
sops: replace my GPG key with AGE GPG is failing again. Time to get rid of it. This age key is derived from my SSH key that you can double-check from https://github.com/zimbatm.keys 2023-01-21 10:49:50 +01:00			`- *build01`
migrate to sops-nix 2021-09-25 22:35:51 +02:00			`- *mic92`
sops-nix: add ryantm 2021-09-26 16:13:37 -07:00			`- *ryantm`
add zimbatm's key and rencrypt all files 2021-09-29 19:03:27 +02:00			`- *zimbatm`
sops: replace my GPG key with AGE GPG is failing again. Time to get rid of it. This age key is derived from my SSH key that you can double-check from https://github.com/zimbatm.keys 2023-01-21 10:49:50 +01:00			`- *zowoq`
migrate to sops-nix 2021-09-25 22:35:51 +02:00			`- path_regex: build02/[^/]+\.yaml$`
			`key_groups:`
			`- age:`
sops: replace my GPG key with AGE GPG is failing again. Time to get rid of it. This age key is derived from my SSH key that you can double-check from https://github.com/zimbatm.keys 2023-01-21 10:49:50 +01:00			`- *build02`
migrate to sops-nix 2021-09-25 22:35:51 +02:00			`- *mic92`
sops-nix: add ryantm 2021-09-26 16:13:37 -07:00			`- *ryantm`
add zimbatm's key and rencrypt all files 2021-09-29 19:03:27 +02:00			`- *zimbatm`
sops: replace my GPG key with AGE GPG is failing again. Time to get rid of it. This age key is derived from my SSH key that you can double-check from https://github.com/zimbatm.keys 2023-01-21 10:49:50 +01:00			`- *zowoq`
migrate to sops-nix 2021-09-25 22:35:51 +02:00			`- path_regex: build03/[^/]+\.yaml$`
			`key_groups:`
			`- age:`
sops: replace my GPG key with AGE GPG is failing again. Time to get rid of it. This age key is derived from my SSH key that you can double-check from https://github.com/zimbatm.keys 2023-01-21 10:49:50 +01:00			`- *build03`
migrate to sops-nix 2021-09-25 22:35:51 +02:00			`- *mic92`
sops-nix: add ryantm 2021-09-26 16:13:37 -07:00			`- *ryantm`
add zimbatm's key and rencrypt all files 2021-09-29 19:03:27 +02:00			`- *zimbatm`
sops: replace my GPG key with AGE GPG is failing again. Time to get rid of it. This age key is derived from my SSH key that you can double-check from https://github.com/zimbatm.keys 2023-01-21 10:49:50 +01:00			`- *zowoq`
migrate to sops-nix 2021-09-25 22:35:51 +02:00			`- path_regex: build04/[^/]+\.yaml$`
			`key_groups:`
			`- age:`
sops: replace my GPG key with AGE GPG is failing again. Time to get rid of it. This age key is derived from my SSH key that you can double-check from https://github.com/zimbatm.keys 2023-01-21 10:49:50 +01:00			`- *build04`
migrate to sops-nix 2021-09-25 22:35:51 +02:00			`- *mic92`
sops-nix: add ryantm 2021-09-26 16:13:37 -07:00			`- *ryantm`
add zimbatm's key and rencrypt all files 2021-09-29 19:03:27 +02:00			`- *zimbatm`
sops: replace my GPG key with AGE GPG is failing again. Time to get rid of it. This age key is derived from my SSH key that you can double-check from https://github.com/zimbatm.keys 2023-01-21 10:49:50 +01:00			`- *zowoq`
hercules: add cachix deploy agent secrets 2021-12-24 07:42:09 +01:00			`- path_regex: roles/hercules-ci/.+\.yaml$`
			`key_groups:`
			`- age:`
hercules: also encrypt for build02 2021-12-26 08:58:06 +01:00			`- *build02`
hercules: add cachix deploy agent secrets 2021-12-24 07:42:09 +01:00			`- *build03`
			`- *build04`
sops: replace my GPG key with AGE GPG is failing again. Time to get rid of it. This age key is derived from my SSH key that you can double-check from https://github.com/zimbatm.keys 2023-01-21 10:49:50 +01:00			`- *mic92`
			`- *ryantm`
hercules: add cachix deploy agent secrets 2021-12-24 07:42:09 +01:00			`- *zimbatm`
sops: replace my GPG key with AGE GPG is failing again. Time to get rid of it. This age key is derived from my SSH key that you can double-check from https://github.com/zimbatm.keys 2023-01-21 10:49:50 +01:00			`- *zowoq`
add cachix deploy 2021-12-23 20:39:49 +01:00			`- path_regex: roles/.+\.yaml$`
migrate to sops-nix 2021-09-25 22:35:51 +02:00			`key_groups:`
			`- age:`
			`- *build01`
			`- *build02`
			`- *build03`
			`- *build04`
sops: replace my GPG key with AGE GPG is failing again. Time to get rid of it. This age key is derived from my SSH key that you can double-check from https://github.com/zimbatm.keys 2023-01-21 10:49:50 +01:00			`- *mic92`
			`- *ryantm`
add zimbatm's key and rencrypt all files 2021-09-29 19:03:27 +02:00			`- *zimbatm`
sops: replace my GPG key with AGE GPG is failing again. Time to get rid of it. This age key is derived from my SSH key that you can double-check from https://github.com/zimbatm.keys 2023-01-21 10:49:50 +01:00			`- *zowoq`
No results found.