.sops.yaml

# Configuration file for SOPS
# REF; https://github.com/getsops/sops

stores:
    json:
        indent: 2
    json_binary:
        indent: 2
    yaml:
        indent: 2

# This example uses YAML anchors which allows reuse of multiple keys without having to repeat yourself.
# REF;https://github.com/nix-community/infra/blob/428dc48b4b08c7b02a9512b0c60b84d30c6acce0/.sops.yaml
keys:
  # ERROR; Age's extension for Yubikey derived age-keys is not yet merged into sops!
  # REF; https://github.com/getsops/sops/pull/1465
  #- &yubikey_bert_proesmans age1yubikey1...
  - &development_key age13s286le0puqz79e96zkpxw9pwuv9jqvgptd4k2j0n257jvgpp5qs75nejw
  # HOST KEYS
  - &buddy_decryptor age1c27gckzuezcu4cqf7ksakksnxm4k694kjslysysas80jctjuwevsgd0ew3
  - &development_decryptor age1rwl0helkcqtlx6fevquwzlw354tu87fg3tmv4gzlwsraz2ttpu0q0h2dqt
  - &fart_decryptor age1qw7ur23g0q8f36yj5sffghq28u7atx0d9m3wkjfurdyjhlhwxglqv48vus

# NOTE; These rules are in effect when using the SOPS CLI.
# Both creation of- and running the command updatekeys will modify the key material of files with sensitive content.
#
# WARN; Creation rules are interpreted sequentially, and a first match is used to calculate/provide key material
# to the file argument.
creation_rules:
  - path_regex: keys\.encrypted\.yaml$
    key_groups:
      - age:
          - *development_key
  
  - path_regex: hosts/buddy/[^/]+\.encrypted\.yaml$
    key_groups:
      - age:
          - *buddy_decryptor
          - *development_key

  - path_regex: hosts/development/[^/]+\.encrypted\.yaml$
    key_groups:
      - age:
          - *development_decryptor
          - *development_key

  - path_regex: hosts/fart/[^/]+\.encrypted\.yaml$
    key_groups:
      - age:
          - *fart_decryptor
          - *development_key
  
  # NOTE; No path_regex as fallback option
  #
  # WARN; Use `invoke update-sops-files` after updating key assignment to secret files!
  - key_groups:
      - age:
        #- *yubikey_bert_proesmans
          - *development_key