Merge pull request #202 from NixOS/update-keys

add sops key from mac and change nixos-wiki2 to ssh key
2025-06-26 20:51:56 +02:00 · 2025-04-23 08:35:10 +02:00 · 2025-04-23 08:35:10 +02:00 · 2b3166f36d
commit 2b3166f36d
parent 2c7e0d33ef 7a5ebd73e9
2 changed files with 30 additions and 22 deletions
--- a/.sops.yaml
+++ b/.sops.yaml
@ -1,16 +1,19 @@
 keys:
  - &joerg age17n64ahe3wesh8l8lj0zylf4nljdmqn28hvqns2g7hgm9mdkhlsvsjuvkxz
-  - &nixos-wiki2 age1p3dl7q5ahjdhl3g72mqk9pxy3gcptw9dqmg6syq9f9s03ppqp4rsqm93n2
+  - &joerg-mac age1nnm255ah9wa4gpsaq0v023a75lnmlcxszt9lc6az3mtwzxgrucfq45rp7h
+  - &nixos-wiki2 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPvvz9eHzae9yEih+b6OdKk1/ZSNPD1cDEzKVgAOoFuE
  - &lassulus age1eq0e6uhjj2tja8v338tkdz8ema2aw5anpuyaq2uru7rt4lq7msyqqut6m2
 creation_rules:
  - path_regex: targets/nixos-wiki\.nixos\.org/secrets/*
    key_groups:
      - age:
          - *joerg
+          - *joerg-mac
          - *lassulus
          - *nixos-wiki2
  - path_regex: targets/admins/secrets/*
    key_groups:
      - age:
          - *joerg
+          - *joerg-mac
          - *lassulus
--- a/targets/nixos-wiki.nixos.org/secrets/secrets.yaml
+++ b/targets/nixos-wiki.nixos.org/secrets/secrets.yaml
@ -3,40 +3,45 @@ nixos-wiki-github-client-secret: ENC[AES256_GCM,data:4vSC1enVDcqeS08uBXMXyEmtE55
 age-key: ENC[AES256_GCM,data:ldlaCHNf99r6zaihQHXPZ0QyY6/KGZR3oRMKo7xiKH7EVjgmKzS8knjDDqwq29D25L1jbVPAmScPEHppbM58xU7nOx4lIpl3qKE=,iv:EHKnKwdHqlKwGrBNbCaoaB8m6xgYSJecUBJgtdZn8kU=,tag:xVs3HfQ8Qip65CIGti9k0w==,type:str]
 opendkim-private-key: ENC[AES256_GCM,data:qG2OIGGv0weUD0iKy8pZ450USg8RAtNLP5ar8LKSL4hP2+uWINRhjQ73w2GZKNq2/deW9bZEM1F3uxLFmxOocTq/CPcO3LWNbaezKns/Xhq5BbX/sIU+ht9Z2AAG86ZmLw251U+xR/VyEE3kdPIhePma+0qcJBPdu8e7CGxzqBooCw9XplLYrMljVrISlIoAhKHEgSqCpyqnQeoxOxSuXvecuErYB5aCstp8W2L20CK89hLHAIONo4vbXxLfwKmt4mMNqOhQxsaoaqPaNFVNO56QhK7+CY4Erhs/GyH3DJ+YdmVwo+rwqvhtegCJcdaKSTmYoWl6xpgg8zKKLJNkO4V0ijrDhgEJ0tSWdvp95Enh1pZ0kN/OuzW/O6z0lkWrcP3i4tdkCaE5ZxoD5P3u/dwQQop5MNdospvUdN5t3ehxCsFvWemSWC4hygdNBOnKA2Zm+JQLjx8gd5fcuOeONTRU2InE/He4otv4jwzCKH9nNJui2L8se0odi/xmZFQb6cfg2xamQUkQ9PgeoSxUgnoBOKdWSZ8A7D+FznI+zAKiZFhBHm6jwGnXQ8MPxlvPRB6fLO+1pOmDBtss0wR7Pywh6e83HFeYwz9L55B1KpFCQHt2pNr8iXjE2c7EEGuH5I1e5svA656yd7p5UiuiKYz7/8P9CgmEyoZ/Zljmk3Z7laCzwlXVpEVPy+R0nu2uiCDN4RIoayf0al/2wPtHZlGLXsECXh1eRjXicM8I2eOyVauBMns14brMdlBVB7eHRZVq96fUxpgwUhnC00unGSqICPBNRk0aCs62aRbbPjs9VC9N/CjqnzIKohi4CNSZHNCkFCFtxVmhO9P0zIsZn6ukUohNpde+PY4X4uuq3PkGEHfRE0zYfB4AgaoIvK/IISEo/Fv+eCIynfCYGq1W/VA8bZ8Kwubz2ixYseo2hHbpCiwysyF71Xcv5RH6OF0j15fpH7Jb4ELx+PL/AMcC4MF+erBWphHTu0Vw61OqeBGYFqXZemGCkNNw4xkIH+8QqipV5XRw7zDFeUYfqjz/VEmCf12TCiXhWjafkSH4H7W9F0fdWeHSPvI4PAIY+MGF/A0wxmN/jrYq+QRSpFb6StxTC9sBU6lUuLwzVOcvOZr5r5s3jMOFpTufVU7wD1FYsZI1ZfAGAeW99vq6i9PWSnmqtq8xaKbZwfhoWm1lJ1ogs4DGI0yAxQeX4blCdazQOYrg3Q==,iv:oNcXuUpfKyKMqHcLAUwFVEjo7BIIOiErbNQ4+LvXHJM=,tag:6jLuPC+cv6yh/he1I6Hurw==,type:str]
 sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
    age:
        - recipient: age17n64ahe3wesh8l8lj0zylf4nljdmqn28hvqns2g7hgm9mdkhlsvsjuvkxz
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJaXBJT0VHb2p2YmlZUi9n
-            NGJJZ2E2V1Q0bGdSVVFCOGlWSFpUblR1RDM4CmRiMTdFSXh5YW9PRDVuY2VVKzg3
-            czArTnRvaVNLRFBxcXVMdVlCT1h1ckkKLS0tIDBQNVhBdm1DVFZZK3EvVTlSYXNP
-            RWdtU2c5VzZMRDBYMWtQSkxaVjR1dFUKfmXTFZANe01r9DYuzDxFBE5cUG5G+FDO
-            QLhMAQ1gRo0Aqa+YD7fhk73uFQo7jysED2QMRvKkpk57wrbdE/SpRA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUeVlXS0dqVVovd1VibG9L
+            WkQvZ3J4QnRXaWpSbXRzaVZBMDc4ZWFmUFZzClBUYnJhS2FScHprS21DVnB1azhG
+            amZ0TFdocVlvU0R5SWg4WFgyZ09YS00KLS0tIE5oa2RJT1ppQWdIcFlXNWRWbEpL
+            U2x1T2JSeitqZ3BmeUcvUmVicHdsRFUKQFkO7l8tA10SQAH5CwpXpbuNCxSiymGA
+            xoTI4kokQTHQzYXLVtXhQPShKHb9eknXo50dcpSZGrwIO+7IR39C/w==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1nnm255ah9wa4gpsaq0v023a75lnmlcxszt9lc6az3mtwzxgrucfq45rp7h
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxamNISnVuZHNQT1VKM1Bp
+            SjVkNUczb3czSzh2WWw1Z0UvR0NwR1M0TzBJCmNldGpqK1QraUJTSTVBeVh1OFI4
+            TlNjUWxwQUNkdE1QQlJwWXpnak5OZUEKLS0tIFB1MVJsYUhvUFF5cmkrb0k3b3lO
+            d1VhTDJSRGx6cmc2M1JReVd2MXpzWGsKM+Y2eqiU+S3oPtQ/ypo/Q/nfLrrXX2O9
+            xhjkhxDiMI2GXYhoXYbiBBQx1lmqSBlny7Z8liut9oKqJU91PUsPpg==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age1eq0e6uhjj2tja8v338tkdz8ema2aw5anpuyaq2uru7rt4lq7msyqqut6m2
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIbG9oZ3E2VE9PaHQyemZO
-            bTdwdkp1dDJXZWpNK3VOd1U4b2IzOUlHZVNNCnBBdk9FRWtIcXRSQzl0dDZZbnRD
-            dVl1dDI4ZXVYT3JBVWtTOE9vYVBlRVUKLS0tIEFUWWFaU3BKb2tCeHYxc1IzSEhM
-            U1g0ZnYzWU1pUXNvVWp2UkRnU2xISkkKrnk4x8fpHeRGhCh2VzG9Se6Ka6+/iBrW
-            BdPVtT97nWIW7viVO7zioYXdnWp3m2JUbu9BF9bc9AdP6Lxz4mEMGA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhVzVHSlJ6ai9CMmxUTFl2
+            THRJZkx6TWdUbkJHYzNmeHVGNHBBZjlwNHhnCkp6WEhucDZodlVjUm55Y29nRFRB
+            Vm5zRkFMRDNpaTcvNVpCNUJoL3lXYTgKLS0tIElWc1kyYTBPVGNWdXlZcjc0K3Yy
+            Ri9zS0lrcHNja29TbWFXRTdEenFUbGMKGytqruuBXETPgJOQm/Q/P0bjKNXETv6i
+            Q6vsBZiUUkqY2Sv2sRrKc+yu7dPfxFiG67iEnY7GTm43JCOu+YCurw==
            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1p3dl7q5ahjdhl3g72mqk9pxy3gcptw9dqmg6syq9f9s03ppqp4rsqm93n2
+        - recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPvvz9eHzae9yEih+b6OdKk1/ZSNPD1cDEzKVgAOoFuE
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmV05Tdndqcnc3bk8wbSt0
-            M09nTFpLN05QMGhGSW5YU0o3Y2xIV3p4SkdrCk90VUFHK2x3bXk5ZGFFdCtCR1Z1
-            YnZwTndOck5HTmpWcTlqYm5yTU9wVjQKLS0tIGM3UUFtek5TTkI1bFdNbzMrYUxi
-            N3daQU9HZXNpblpRYW43TmNXN3RFMVUKudJWBDpnk2ImA5f1VtuupUJU7bFTm8P/
-            kkQItnpA1nPGzVUUpHuN/31YqKTnKs/tW1V+IArR/Dl/4eo9tATmLg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDZzVHJtdyBtMUZs
+            Mm4zRVFSZVFUWDk0S3YzUTNmaCs2T2tyVlRyUFQ5UHJac2ZLUXpvCldFbFh6VGxL
+            VVFCdTREU1RyYlc2dThoS3ZydmhFNndVYkwreGdDeCtqblUKLS0tIFdsYk8yRjFN
+            Q003WFF3cGcxZVByRDd3bUJ1YUFkRkdIZlI3WDlWNG1CVDAKjnBaZSpqjElwuOCY
+            jukWAlTj2X2Hd5MHTLvL66ensoDYWNm6dsfLANupM85l7/rQfpA/hI6lxFdFm2ws
+            MN/gLg==
            -----END AGE ENCRYPTED FILE-----
    lastmodified: "2024-03-06T19:07:50Z"
    mac: ENC[AES256_GCM,data:I8eH+R1DREziItvmEO+/vNM0NdR7Aq9Ob6AeyJ47JDabfkDM0ihwO8uz/WMHVyQ0FSwVDXj29VzcQZyYCEi6YIz6LV0sMbuOOC8Na26/O4GQ5rHIPD1J2li+qsKDNOgLfkyNZFUJXqXkrbX8hwiytM+Hda+xAYqfQGN/2S3jipM=,iv:wGP41trqYl9nYHYOKu4bPANnA+lsuDsxq78Qq8io70M=,tag:3f9sH171Dxys5fNphTgjbg==,type:str]
-    pgp: []
    unencrypted_suffix: _unencrypted
    version: 3.8.1