.sops.yaml

# SOPS configuration file
# See: https://github.com/mozilla/sops#using-sops-yaml-conf-to-select-kdfpem-and-keys-for-new-documents
# Reference: https://github.com/Mic92/sops-nix
# YAML anchors allow reuse of multiple keys without repetition
keys:
# Add your age public keys here (get with: age-keygen -y ~/.config/sops/age/keys.txt)
# - &admin_kaizen age1...your-public-key-here...
# Add SSH host keys converted to age format (for automatic decryption on target machine)
# Get with: ssh-keyscan <hostname> | ssh-to-age
# - &host_default age1...host-key-here...
creation_rules:
  - path_regex: secrets/.*\.(yaml|json|env|ini)$
    key_groups:
      - age:
          # - *admin_kaizen
          # - *host_default
          # Add your age public key here (temporary until you set up YAML anchors above)
          - age1... # Replace with your actual age public key

# Alternative: GPG key configuration
# keys:
#   - &admin_kaizen FINGERPRINT1
# creation_rules:
#   - path_regex: secrets/.*\.(yaml|json|env|ini)$
#     key_groups:
#     - pgp:
#       - *admin_kaizen