generated from coulomb/repo-seed
Bernd Worsch
c10d7d2f8a
- .sops.yaml + keys/age.pub: SOPS age encryption for all secrets/ paths - .gitignore: broad secrets/ catch-all (any depth) - .githooks/pre-commit: blocks unencrypted secrets/, *.env outside bootstrap/, and known plaintext patterns (PI_SECRET_KEY=, LLDAP_JWT_SECRET=, etc.) - Makefile: full credential lifecycle (creds-init/generate/bundle/apply/verify/ status/rotate) + SOPS helpers (sops-setup/edit/encrypt/decrypt/rotate/check-secrets) + hooks/hooks-test - creds-apply.sh: runs create-secrets.sh in dependency order (postgresql → lldap → authelia → privacyidea), skips keycape with printed instructions, updates state - creds-verify.sh: checks all K8s secrets exist, updates creds-state.yaml - creds-status.sh: human-readable state table from creds-state.yaml - creds-rotate.sh: guided rotation for all 9 secret types with impact descriptions and atomic multi-component update sequences - creds-state.yaml: committable state file tracking generation, bundle, KeePassXC confirmation, per-component apply status, enckey and pi-admin bootstrap flags NK-WP-0003-T01 unblocked. /creds-bootstrap skill registered separately. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
18 lines
766 B
YAML
18 lines
766 B
YAML
# SOPS encryption rules for net-kingdom
|
|
# Any file under a secrets/ directory (at any depth) is encrypted with the operator age key.
|
|
# Same age keypair as railiance-infra — one key per operator across all repos.
|
|
#
|
|
# Key fingerprint: age1aq8twfd78wvpra0had8cezcnj96tj4q0068edrz5jez8d6xwmflqdepsh4
|
|
# Public key stored in: keys/age.pub
|
|
#
|
|
# To edit an encrypted file: sops secrets/<file>
|
|
# To encrypt a new file: sops --encrypt --in-place secrets/<file>
|
|
# To decrypt to stdout (inspect): sops -d secrets/<file>
|
|
# To add a recipient: update .sops.yaml + sops --rotate --in-place secrets/<file>
|
|
|
|
creation_rules:
|
|
- path_regex: secrets/.*$
|
|
key_groups:
|
|
- age:
|
|
- age1aq8twfd78wvpra0had8cezcnj96tj4q0068edrz5jez8d6xwmflqdepsh4
|