Jafner.net/.sops.yaml

creation_rules:
  - path_regex: .*
    # The below key_group and shamir_threshold configuration
    #   allows any single author key to decrypt secrets,
    #   but hosts and deploy runners *must* use both keys
    #   to decrypt. This prevents a compromised host or 
    #   runner from leaking all secrets.
    shamir_threshold: 2
    key_groups:
      - age: # Author keys; to be held by contributors to the repo
        - 'age1zswcq6t5wl8spr3g2wpxhxukjklngcav0vw8py0jnfkqd2jm2ypq53ga00' # joey@dungeon-master
      - age: # Author keys (again); hacky way to give author keys a weight of 2 shares
        - 'age1zswcq6t5wl8spr3g2wpxhxukjklngcav0vw8py0jnfkqd2jm2ypq53ga00' # joey@dungeon-master
      - age: # Deploy keys; to be held by the deploy environment (e.g. Gitea Actions)
        - 'age193t908fjxl8ekl77p5xqnpj4xmw3y0khvyzlrw22hdzjduk6l53q05spq3'  # deploy@gitea.jafner.tools
      - age: # Host key; to be held by hosts to which Stacks should be deployed
        - 'age13prhyye2jy3ysa6ltnjgkrqtxrxgs0035d86jyn4ltgk3wxtqgrqgav855' # fighter
        - 'age1n20krynrj75jqfy2muvhrygvzd4ee8ngamljqavsrk033zwx0ses2tdtfe' # druid
        - 'age1m0jpnk4t7hph5tdva3y9ap7scl8vfly9ufazr0h3cuwpcytlsulqjrt58y' # wizard
#3 Set up sops at repo root 2024-08-23 00:12:20 -07:00			`creation_rules:`
#3 Remove superfluous lines from filter scripts, switch sops creation rules to apply to all 2024-08-23 18:09:27 -07:00			`- path_regex: .*`
#3 Rotate Gitea runner key, re-encrypt all keys Also removes git-crypt encryption from all remaining secrets. 2024-08-29 14:29:51 -07:00			`# The below key_group and shamir_threshold configuration`
			`# allows any single author key to decrypt secrets,`
			`# but hosts and deploy runners must use both keys`
			`# to decrypt. This prevents a compromised host or`
			`# runner from leaking all secrets.`
#3 Set up sops at repo root 2024-08-23 00:12:20 -07:00			`shamir_threshold: 2`
			`key_groups:`
#3 Rotate Gitea runner key, re-encrypt all keys Also removes git-crypt encryption from all remaining secrets. 2024-08-29 14:29:51 -07:00			`- age: # Author keys; to be held by contributors to the repo`
#3 Set up sops at repo root 2024-08-23 00:12:20 -07:00			`- 'age1zswcq6t5wl8spr3g2wpxhxukjklngcav0vw8py0jnfkqd2jm2ypq53ga00' # joey@dungeon-master`
#3 Rotate Gitea runner key, re-encrypt all keys Also removes git-crypt encryption from all remaining secrets. 2024-08-29 14:29:51 -07:00			`- age: # Author keys (again); hacky way to give author keys a weight of 2 shares`
List author keys twice as a quick-and-dirty way to weight keys in the sharing algorithm 2024-08-29 00:01:25 -07:00			`- 'age1zswcq6t5wl8spr3g2wpxhxukjklngcav0vw8py0jnfkqd2jm2ypq53ga00' # joey@dungeon-master`
#3 Rotate Gitea runner key, re-encrypt all keys Also removes git-crypt encryption from all remaining secrets. 2024-08-29 14:29:51 -07:00			`- age: # Deploy keys; to be held by the deploy environment (e.g. Gitea Actions)`
#16 Configure decrypting config.boot - Add age recipient key for wizard to .sops.yaml (also placed privatekey on wizard at /config/wizard.host.key) - Add step to install sops from specific binary release v3.9.1 - Add step to decrypt config.boot locally - Add step to push decrypted config.boot to vyos host - Trigger workflow 2024-10-25 13:27:57 -07:00			`- 'age193t908fjxl8ekl77p5xqnpj4xmw3y0khvyzlrw22hdzjduk6l53q05spq3' # deploy@gitea.jafner.tools`
#3 Rotate Gitea runner key, re-encrypt all keys Also removes git-crypt encryption from all remaining secrets. 2024-08-29 14:29:51 -07:00			`- age: # Host key; to be held by hosts to which Stacks should be deployed`
#3 Set up sops at repo root 2024-08-23 00:12:20 -07:00			`- 'age13prhyye2jy3ysa6ltnjgkrqtxrxgs0035d86jyn4ltgk3wxtqgrqgav855' # fighter`
			`- 'age1n20krynrj75jqfy2muvhrygvzd4ee8ngamljqavsrk033zwx0ses2tdtfe' # druid`
#16 Configure decrypting config.boot - Add age recipient key for wizard to .sops.yaml (also placed privatekey on wizard at /config/wizard.host.key) - Add step to install sops from specific binary release v3.9.1 - Add step to decrypt config.boot locally - Add step to push decrypted config.boot to vyos host - Trigger workflow 2024-10-25 13:27:57 -07:00			`- 'age1m0jpnk4t7hph5tdva3y9ap7scl8vfly9ufazr0h3cuwpcytlsulqjrt58y' # wizard`