mirror of
https://github.com/allaunthefox/Research-Stack.git
synced 2026-07-30 18:56:16 +00:00
allaun
475f6319ea
This squashes all local history (768 commits) onto the scrubbed PR #90 baseline. Individual commits were lost during filter-repo corruption; the working tree content is preserved intact. Build: N/A (working tree state only)
65 lines
1.7 KiB
YAML
65 lines
1.7 KiB
YAML
# SOPS configuration for Research Stack
|
|
# Uses age for encryption (DEFAULT for all secrets).
|
|
# Post-quantum: standard age (X25519 + ChaCha20-Poly1305) is NOT post-quantum.
|
|
# PQC adoption tracked in 4-Infrastructure/docs/pqc-posture.md
|
|
#
|
|
# Usage:
|
|
# sops --encrypt --in-place <file>
|
|
# sops <file> # decrypt, edit, re-encrypt
|
|
# sops --decrypt <file> # decrypt to stdout
|
|
#
|
|
# DEFAULT: All files matching the patterns below are encrypted with age.
|
|
# If you create a new secret file, it will be encrypted automatically when
|
|
# you run `sops --encrypt --in-place <file>`.
|
|
|
|
keys:
|
|
- &primary age1tp4vr565zkmvnyulatpyaj6z8zrz7q9mpaypz85yz8rty99crdasualxyr
|
|
|
|
creation_rules:
|
|
# k3s-flake secrets (age-encrypted)
|
|
- path_regex: 4-Infrastructure/k3s-flake/secrets/.*
|
|
key_groups:
|
|
- age:
|
|
- *primary
|
|
|
|
# Infrastructure secrets
|
|
- path_regex: 4-Infrastructure/infra/secrets/.*
|
|
key_groups:
|
|
- age:
|
|
- *primary
|
|
|
|
# Deploy environment files
|
|
- path_regex: 4-Infrastructure/deploy/.*/.*\.env$
|
|
key_groups:
|
|
- age:
|
|
- *primary
|
|
|
|
# Storage/restic environment files
|
|
- path_regex: 4-Infrastructure/storage/restic/.*\.env$
|
|
key_groups:
|
|
- age:
|
|
- *primary
|
|
|
|
# API keys directory
|
|
- path_regex: API KEYS/.*
|
|
key_groups:
|
|
- age:
|
|
- *primary
|
|
|
|
# Any .env file (catch-all for environment secrets)
|
|
- path_regex: \.env$
|
|
key_groups:
|
|
- age:
|
|
- *primary
|
|
|
|
# Any file with "secret" in the name (catch-all)
|
|
- path_regex: .*secret.*
|
|
key_groups:
|
|
- age:
|
|
- *primary
|
|
|
|
# Any .age file (explicit age-encrypted files)
|
|
- path_regex: .*\.age$
|
|
key_groups:
|
|
- age:
|
|
- *primary
|