feat: initial import of RailianceHosts starter

.sops.yaml

@@ -0,0 +1,7 @@
+# SOPS encryption policy: encrypt files matching *.sops.yaml
+creation_rules:
+  - path_regex: '.*\.sops\.ya?ml$'
+    encrypted_regex: '^(data|secrets|ops)$|(_secret|_password|_key)$'
+    # Replace with your age public key string (from keys/age.pub)
+    age:
+      - 'age1replace_with_your_public_key_here'