.sops.yaml

keys:
  - &admin 20D22783FF50D18568CF617303615DC092ECCE99
  - &kilimanjaro age16jy52qzvaw7clfg8lvfz47xq3alg8h59xxfrm8uq9d40w8xz8arqys2fvh
  - &serengeti age1zcwtypme4ytx3mugstqfp7d4pe00hpjxk6f40u0pq4ftnvppuyxs48cskm
  - &manyara age1k49t7ycus0gyw37fl69y3nl3ny7vsy44p5583qs8rx6asdeeqvjqr8jlh4
  - &mikumi age1de8fxy635636r8ylvj3uh8c7l4elkh4z056ekedd6tcvs0e53u4q0hzgm7
creation_rules:
  - path_regex: secrets/[^/]+\.yaml$
    key_groups:
      - pgp:
          - *admin
        age:
          - *kilimanjaro
          - *serengeti
          - *manyara
          - *mikumi
  - path_regex: infra/[^/]+\.yaml$
    key_groups:
      - pgp:
          - *admin
  - path_regex: systems/nixos/services/hydra/secrets.yaml$
    key_groups:
      - pgp:
          - *admin
        age:
          - *kilimanjaro
  - path_regex: systems/nixos/services/calibre-web/secrets.yaml$
    key_groups:
      - pgp:
          - *admin
        age:
          - *manyara
  - path_regex: systems/nixos/services/forgejo/secrets.yaml$
    key_groups:
      - pgp:
          - *admin
        age:
          - *manyara
  - path_regex: systems/nixos/services/gitea-actions-runner/secrets.yaml$
    key_groups:
      - pgp:
          - *admin
        age:
          - *kilimanjaro
          - *serengeti
  - path_regex: systems/nixos/serengeti/secrets.yaml$
    key_groups:
      - pgp:
          - *admin
        age:
          - *serengeti
  - path_regex: systems/nixos/services/attic/secrets.yaml$
    key_groups:
      - pgp:
          - *admin
        age:
          - *serengeti
  - path_regex: systems/darwin/mikumi/secrets.yaml$
    key_groups:
      - pgp:
          - *admin
        age:
          - *mikumi
  - path_regex: systems/shared/hercules-ci/[^/]+\.(yaml|json)$
    key_groups:
      - pgp:
          - *admin
        age:
          - *kilimanjaro
          - *mikumi
          - *serengeti