From 406ec86d658835176852be9acfa62a351caa2e86 Mon Sep 17 00:00:00 2001
From: allaun <allaun@researchstack.info>
Date: Sat, 4 Jul 2026 01:39:38 -0500
Subject: [PATCH] chore(secrets): store Quandela API key encrypted with
 sops/age

- .sops.yaml: creation rules with age key age17nzzwaftrkcuerlt4vq2eh98fdfxnv3eqykdxf5c3hqa0pvc2uhq26dxeq
- secrets/quandela_api_key.enc.yaml: age-encrypted (decrypt: sops secrets/quandela_api_key.enc.yaml)
- .gitignore: ignores secrets/ plaintext, encrypted files tracked with -f
---
 .gitignore                        |  1 +
 .sops.yaml                        |  7 ++-----
 secrets/quandela_api_key.enc.yaml | 16 ++++++++++++++++
 3 files changed, 19 insertions(+), 5 deletions(-)
 create mode 100644 secrets/quandela_api_key.enc.yaml

diff --git a/.gitignore b/.gitignore
index 695c4eb7..ce21c107 100644
--- a/.gitignore
+++ b/.gitignore
@@ -34,3 +34,4 @@ rust/**/target/
 *.vos
 *.glob
 *.aux
+secrets/
diff --git a/.sops.yaml b/.sops.yaml
index bc599294..557e3df7 100644
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -1,6 +1,3 @@
 creation_rules:
-  - path_regex: \.env$
-    encrypted_regex: "^(PG_PASS|AUTHENTIK_SECRET_KEY|SECRET_ENCRYPTION_KEY|FORGEJO_API_KEY|AUTHENTIK_API_KEY|WOLFRAM_APP_ID)$"
-    age: "age17nzzwaftrkcuerlt4vq2eh98fdfxnv3eqykdxf5c3hqa0pvc2uhq26dxeq"
-  - path_regex: \.env\.gremlin$
-    age: "age17nzzwaftrkcuerlt4vq2eh98fdfxnv3eqykdxf5c3hqa0pvc2uhq26dxeq"
+  - path_regex: .*\.enc\.ya?ml
+    age: age17nzzwaftrkcuerlt4vq2eh98fdfxnv3eqykdxf5c3hqa0pvc2uhq26dxeq
diff --git a/secrets/quandela_api_key.enc.yaml b/secrets/quandela_api_key.enc.yaml
new file mode 100644
index 00000000..424708c6
--- /dev/null
+++ b/secrets/quandela_api_key.enc.yaml
@@ -0,0 +1,16 @@
+quandela_api_key: ENC[AES256_GCM,data:9tJwab+UeVs5zlsqE6GBhJ4Ouil6xAJdgMuk3E7hBB6OWracpyAL+FtwJGtelfvjypIV1GxCj2/cJ6NevAZYtQDRHZ7QJhFxYdxahkQYzha/Aabaix/E7UNr7SYxrnfSF1D4RIvaQdJwHgJyGlc1k6hjwv/ABVVkXN5f/TLq0v06leUWEtqojI9MEPtCgqa1ZLOOy4xS/f4AyQ9RRlq4+C30Q16+TpFfE6+iKCNinQ==,iv:j8u97CE1hzfKC3crONWl00I9HgTRv5tO24J2SQW336Y=,tag:QrL2vuf8IH5lmHqunXBVaw==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0dE5OQUQ4dmRBdWFrL0lF
+            UTdBbHBVODZuZ2R4SExXaS9FY3JNbmUzazNZCnR1eFYxbkwwRUdkcmJJNHQwaVNP
+            NHhsSlJidTVaY1grTXBudEF6OXZRaUEKLS0tIDFKVDlFZGhpZlJ5TFFNYjRKZHpm
+            VGFzRUQrRWpSc2FEelVOZjBlZGpjeDQKHIEvcnQ9GWbo0u6Lt9fOVkOgQtfvtV0H
+            SbeZA/pFamtlAGIhkl4XFYHed7dW6ag1x8xBdfVo+WR5mzVT4HLmqw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age17nzzwaftrkcuerlt4vq2eh98fdfxnv3eqykdxf5c3hqa0pvc2uhq26dxeq
+    lastmodified: "2026-07-04T06:39:14Z"
+    mac: ENC[AES256_GCM,data:x3yng2kbG2TGMDFgFeccpRKOpEGood99toJgnNzwWbNEd7wh1j1WvM+bDPiyElxX8u5MeiuodBKNDDWSmEkIxtqI34wyOX7bunXYZM/xCEMl1H/j9MsYcLIZfeVDGaPXt5UXKcISt5TUuuoM1URNgXn73DTTaaHeoiI0cqPR+K8=,iv:NoE4VPyTmtsn57R7jMDgfrKdmOuNePp2/CxjMRqVye8=,tag:1hfWrzMIrw/WhKtWWvh/5g==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.2