.sops.yaml, secrets: add mac key

2025-08-23 15:33:26 -07:00
parent ddb3427175
commit 32b161b29d
4 changed files with 73 additions and 42 deletions
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -1,7 +1,8 @@
 # .sops.yaml

 keys:
-  - &primary age1jmsrfddctahhznfv7jv77tgw5crmhjhe0e0kzc967hvax4sulv3s6hp2su
+  - &xenon age1jmsrfddctahhznfv7jv77tgw5crmhjhe0e0kzc967hvax4sulv3s6hp2su
+  - &mac age1g0vx0dgpzy3et6kuejf4xn4n0acr3666p8j4ygaulefh5mq3vyxs7mgjat
  - &db-pg17 age1mqetcwrdkwsettnf5mydzmhpyjydj8xy4ezth0ckpjc5r0na6cwqlatm5f
  - &db-mdb11 age16hzcrlm978x5g2frhgr8sm9hjf8f9l9ez5g8adkw2uj4m3h89d5qmzggk2
  - &fs-01 age1e9s4v2k3tfyc0lvz84wkg8uacv6283va58al2yy8dt6jgswf99vs9z4ujt
@@ -10,17 +11,20 @@ creation_rules:
  - path_regex: db-mdb11.yml
    key_groups:
      - age:
-          - *primary
+          - *xenon
+          - *mac
          - *db-mdb11

  - path_regex: db-pg17.yml
    key_groups:
      - age:
-          - *primary
+          - *xenon
+          - *mac
          - *db-pg17

  - path_regex: fs-01.yml
    key_groups:
      - age:
-          - *primary
+          - *xenon
+          - *mac
          - *fs-01
--- a/secrets/db-mdb11.yml
+++ b/secrets/db-mdb11.yml
@@ -9,20 +9,29 @@ sops:
        - recipient: age1jmsrfddctahhznfv7jv77tgw5crmhjhe0e0kzc967hvax4sulv3s6hp2su
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVcW5MMFBUdEZuZXNkeXN6
-            M0NrMUh1Qm1RREhvcFBXRG1DbHUzdFpnclhFCkk4cGtUNitqaXZJMkx0bWRyWFls
-            NVpENE5mT2hTVXh2UXpKR2h5MDIxSW8KLS0tIGhUelh6eS9XZ1dPOWZpNStOYkxJ
-            YWpjbmEvZ0o0a1JocjNoM0ZzdWErSDQKALuDZ6+ZoZvoAQ+EpboC7SLCou43XkYn
-            pofyokV8hufYUKYJgE1QinH3fYZGWI023bzBd0uSaZ95Oy7CqNSZRA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUMlZPQk9jaFI3eitYL2Rk
+            YVUzN244WHQ5SmFTZGFOK2NkREkycWQxNVMwCjgybGFYUGkvVTRHL3JRcXVVVytz
+            dEVPM2JpUEw5QXdoeGl4akRETjJ6YzgKLS0tIHR2VnBqU0gyNndhaVpqTTZCb0U3
+            QXFNOStSWnNwdlliT1Nxa2c2dTFvdzQKQYHi3z4TAt2QBqEm1jI4CFuddRHOv7+P
+            RoGwfNNqa6TUfNQUxOL4migsuFDbgDZpPMEry2GMNCLCvSzolyeH1Q==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1g0vx0dgpzy3et6kuejf4xn4n0acr3666p8j4ygaulefh5mq3vyxs7mgjat
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmRGJNWjIxRnpWS1ZKVUhL
+            SWQrc29sZytJYUlBVGZ2QlJ6SGNQazJuNXljCnJhb2lSZGNXTlE2eUlkRjB3a1h4
+            c3hzODA1U2tXeFBZMzVFNldYWmV6aVkKLS0tIGd6cVhMSmFBMHZCQUM3ZVc0ZWFR
+            emJtaUl2VEY1MHQ4TlVZNDBaSm95bGMKDwoMvOrBG1Afo1XrzfnmPM0izZrOSYBR
+            Yt2uaUztRgPdWEMMRIeXyJVLj4lYZL1epK54PIDzuax3wUnPcq6xng==
            -----END AGE ENCRYPTED FILE-----
        - recipient: age16hzcrlm978x5g2frhgr8sm9hjf8f9l9ez5g8adkw2uj4m3h89d5qmzggk2
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhT2NwcFZXVWpOSWwyZjVT
-            MU1qWUxoRHNRRWMzZ3l3YXNqZUJoOWZkb1VZCnJmNUtsdnU2Nk8wTk1RSVp1MmtM
-            WG5Jek5OQjZBUXpCQjduVWgwWURqMmcKLS0tIHpNa2tvQnVkVTFtOW9BVnlDY09C
-            aFVkSllqSnBIUTdqWVFiNVZZQ0YvYmsK/YUl0rzbkswH5ihvraeWNurgbRrl6jKG
-            ys+AWr9FsgRJCXL/qTnUDbt73IUpcqmudWq1FbP1ZMSNL0G+hSothA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoVUtKYXVobER5bTUrUjBT
+            Ynk0Q1pvSXBKdWxySjE1cnJBQUNORkwxbGxzCkgvNkl4eXBBTC83bC9Bd3NHOEFK
+            ZU9vWllDSmdCVFNGY1lGd3IvU3dkck0KLS0tIHZyZzZ0SFp6K0JOeFNhSE4zcWdn
+            NkVoaEtBMHdGbDlKV2ZZeDV0ZmFURmcKCBAciuWWm/0/aOmDvd36wpxeHvKMP5Cq
+            Sh2sIswKFQVKcwc5cK1/h4hCkMAAFlcVELO+S9vmPFDKByzwkITUsw==
            -----END AGE ENCRYPTED FILE-----
    lastmodified: "2025-08-23T21:27:51Z"
    mac: ENC[AES256_GCM,data:62j2QM9NQsk8BzQfK8ddVurGJvyUIFK4mVAvY6PzxMgiVoi9QWe7Zpcu705svI5Kk9IeWnESCW/FbDjrLBdGwe9BUjjsRKEd+IJpQDZ4jemkoQdtlwLg23vcelwYFgQ/b6YLrT6F4PHP45qjSzGLFnYgep7f04hjlCWaDbebS1I=,iv:rfJ1z8O6N3rdvHDLqC8c6bNhjM9ZPfEsXxhIslZNut8=,tag:sJtSU3o2LW80PUu0roK5wQ==,type:str]
--- a/secrets/db-pg17.yml
+++ b/secrets/db-pg17.yml
@@ -14,23 +14,32 @@ postgres_databases:
    vikunja: ENC[AES256_GCM,data:nSKVqTrFpopctdJlIi8lCjYEaDc=,iv:EwY/bxCm8ix01PG2/ltHsk56Q/a0j+OV6kjFwo/kr+g=,tag:1fIuipY05d8e1Mtc0e689Q==,type:str]
 sops:
    age:
-        - recipient: age1mqetcwrdkwsettnf5mydzmhpyjydj8xy4ezth0ckpjc5r0na6cwqlatm5f
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEV2k3L0pGWXBOOTl6M1J2
-            YThyYUhxTEJSbU9mT1dTR3V0ZGZMdzluSFNnCkVYdmsxNTY3SmtBNTRTUXpVM0xT
-            eGpFWkpyd2taNDZQeFJpUDlCNTJ4cUkKLS0tIElIY2EvNk9HNkZnVkJoMnZzSlVv
-            TDNJZmJWMGs4ejZJeDlGS0VEejJ3T3cKoXg9sAyl0zQojSZrSd8Pwq2CwI3et3ei
-            trHnXKo3u01Ge7KfhW2tqN8LqT9EBoM+tGQDxpycZggEFjcu0hMeGg==
-            -----END AGE ENCRYPTED FILE-----
        - recipient: age1jmsrfddctahhznfv7jv77tgw5crmhjhe0e0kzc967hvax4sulv3s6hp2su
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDNCtxNGJnSEJhK1FUWERu
-            cGVoYU9xN3RNZG1peEVFME9BODFqOUVVVlhJCkFNRk1KMi9sd055SlpqMnRVYlVl
-            bTZLVFZWZ1k2bHlyQy9OL1JKcHNnd28KLS0tIGJPNFA4cHlqT1krRHE4TE1XcWdZ
-            aTVRcEtyVlNUWkpMM3dXeURDeEJLSnMKDaFPvuyze4dK7h9ivtWaRQPrsGf+LJd2
-            5mNza+f2ei8QjLi93hJMCZjExT/Gf1jbSJlHk2VobNsKFomCM4S49w==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkclRsL3V5cWcrWGNUNWwy
+            V29pNEdadGNycTBtL2o4RFNEbUFQL211dzFvCnBMVmRHNkV1Z1QySmJDV3F6QnRI
+            V3NOSFhjZU90MUF5bzJXSnhPTGJ5WVkKLS0tIEsrbU9STkkvSHlUV2l4WnNxUTgy
+            Z0hPZSt4UVY0U1kvUVpSVWZwMkgzaFUKzP89G+MNxfUhIdHU1MHCXNHifrmpocrE
+            l+yOt6LO+ue9gj3DGO/ankLiAkQYZQlglw/7vgsYy5SQWEKc6/s1Qw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1g0vx0dgpzy3et6kuejf4xn4n0acr3666p8j4ygaulefh5mq3vyxs7mgjat
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMWGZHTno0a3NydUNWR1BM
+            czJmUXRzaUlvR2VwdktHSzJ6dnpZcWx3WUF3CmhHT2pseXBkT3NYUEgvOWlPdDR4
+            bFhHMFBiOFhyR01WMmZwZkFKRGlPdWcKLS0tIEpuTXF2VFkzV1JhcSs1Tlc3ZVV4
+            ZFp2cDJadmNFbEhZUksvUEJsWGlHc3MKS8lb7vhUlM5k0keDQbOvjLxM8SzBuF0O
+            pQHocRNL6Ig0HdTRAGPvWK7xliWrAsMst9QML9T+XFEYXanT3zqKZQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1mqetcwrdkwsettnf5mydzmhpyjydj8xy4ezth0ckpjc5r0na6cwqlatm5f
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpbzY0UUxPNTJoWWxXSXY0
+            d0o4R1VaUmpINWQ4MXJtSzBzZkc2Rk8rRUJzClRieWR0S21xWSs4NFJQWTY5THhN
+            SDBROE5wY0Y0RWczVVJmWTArMHFJY2cKLS0tIGJ3V005U3R4MDJWeUdvWFc3NSta
+            bXM4alJsUU9jaXhKdW5BY1NtZHVzcVEKqyhbTW8ijs8564q1Xj+ciplegdtXx606
+            I8odZkP4WKYief2N6C2F6+kTnvxeh2RIZyPEf/rBO73BiByN1GEjtw==
            -----END AGE ENCRYPTED FILE-----
    lastmodified: "2025-08-23T20:50:58Z"
    mac: ENC[AES256_GCM,data:2wOoTrwxB9lHPh53zsHLy3VchAADJUTAF5m+DLoMS3JTe+vM8D0pb7eIZ1OKkFQ+hh+/+uQyYY86PQBDn7L4ivqK9d++hGCf4E0MwicbNQoegG9VOwzm8+pYuTeNWxgtkcDETPdwjMdFhJb/r9pknkgpw9H+rVCm/0Q6yMxETm0=,iv:zh0CWhmAEvMBeLjyhkqmICpXFEq3fDDHZ7BkRqrCtsQ=,tag:kUspGxxOcoQyBuldgPcYCw==,type:str]
--- a/secrets/fs-01.yml
+++ b/secrets/fs-01.yml
@@ -6,23 +6,32 @@ borgmatic_pass:
    remote: ENC[AES256_GCM,data:zzelomQZuPEmMiuhTcdnX3Jtu8E=,iv:uYDvwlcy29nn0XUkr4waQcdnvimDhNTNR4HGQ/w10gU=,tag:Knx3nQxJ5L4IlwtdFOm8+w==,type:str]
 sops:
    age:
-        - recipient: age1e9s4v2k3tfyc0lvz84wkg8uacv6283va58al2yy8dt6jgswf99vs9z4ujt
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtYTFuR1FEV1RHRVhBd2xj
-            bnR2K1B2T3JlZzVoV2xHYWZSVVN4YXlLZEJRCjJhZEpQV29WY2hLUlRhSXVTM043
-            VXZwb005b3RvUEUxdUdhVmpjMzQ5aVUKLS0tIDdqMFVkckgwdGNzYmR6Z1V3Qjlv
-            SmpOUlJxcldFK1J4cnVHM1VSK0w3Vk0KB6czUgwAdl2jgdfFzt5NNejBJgbQ84ZO
-            fuFnE9euUVV2ADWJ6gGC3uh4Gz6VjEHlMERNM8OZlhfPKEXdYPiNRg==
-            -----END AGE ENCRYPTED FILE-----
        - recipient: age1jmsrfddctahhznfv7jv77tgw5crmhjhe0e0kzc967hvax4sulv3s6hp2su
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhcXZoTU9HRDRwUWdlK0tk
-            cEMrbTFNcVZTbStteFpiTWkrajRxdEhRdVN3CmhYbHVnS2l2RHIyQXdnS3ByTnB1
-            ZjFGVGtWK2IrRVdTclVzV1dJdUlyVXcKLS0tIE9rbUN0eFV1d3ZqNUFrM0t3YTZY
-            N0pKTGZYREpOQWtDeGZDUzliUkJveUUKPjKTAqXlql31rxO+wpy3X6+1GcWTkFT/
-            vnO7DupykrMAPc1iDoN64DaORP6m2Kjx2nHhzheXMlGaQp8sIptv8w==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1WkJJS3hLalgxL1VtOHJK
+            VDFWRHV2K0liUE45bTlBNHM4THA1R2IzeXcwCk9abVpkakx2aWdIVmZXTE14V1gr
+            eGJsR0txL253VDNmRzRBYTQrTjZuWWMKLS0tIEdGcFRlSGlTUXZ6WXVWN3kzNnI0
+            cG9VcTJFb2RVRFZaWUh6OTVwQjQzSDQKYGRTtA4WhPRF05ouWGDfdWddR3OAO3NI
+            B03h61hSbbGzrjkCmcBu3/pG+5q/L9vm2kcDoHK9Wr0OaYC2roQRzw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1g0vx0dgpzy3et6kuejf4xn4n0acr3666p8j4ygaulefh5mq3vyxs7mgjat
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHQzBhQlI1d0REMkdpeEtw
+            RDJDc3dYdjN2VFZqOTNtQ2hhQkxBdVBlcTBJCkpFbFhVaE96Q1EvUU5PVGtsR1dp
+            U0pHSk9kOHhNenY3cEUwSk5NUlAwV1kKLS0tIHorYWhMYmpGQ2drY1NSbldXK1Fq
+            YTFmd1UydHByMjJicXE5Y2lkM2VSd1UKSN5QPWj7ZgIE32+T1C2QWuNWVWwBVmIM
+            xxkGrdRTEEfLSoovsY1BBc/LmXfDvjBCJ/shVHuEgZ/K8THSF5wcAg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1e9s4v2k3tfyc0lvz84wkg8uacv6283va58al2yy8dt6jgswf99vs9z4ujt
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0ZUxJZ2lRS2hIU2ZrSXYv
+            d21aaGh2aXE2NXIyVTIycHRQZkxXQkFTWUU0CkRxWi9wZzBvclJxZnMvbmZyS3dr
+            U25CakNpeklpVkR5c2xmUUZvNWZlTlEKLS0tIGYzc0gwOVgvdEZpcmRNQnBLd2Zh
+            TVZ0TDRSUG55aThrWEtFaEk1V3ZzR0kK2aj5mVpDPXUHQkaJ5MVqH279iJZZON4H
+            sFzaiRqnknP7vujJlxeKSEQilVB2wsslMVMCUcH+bd7FdBimQcAi8Q==
            -----END AGE ENCRYPTED FILE-----
    lastmodified: "2025-08-23T13:35:09Z"
    mac: ENC[AES256_GCM,data:viebtr11luCNL2VWA0I8i8QZhXZcevSomGWgF0giPxAwGN5E0gQsLD74xoqLeXHY5Z07aGoVt69V1uDJaNzwIJFHeDEgt+EgF357w9SV9psib9z18s+p2xt23ZFnEFE/jJIlrSRNINoP2UJ/rshF6nzDLUI76dA3lf7MnwAi2+o=,iv:9uJWjf/nFy+Qwv3KUKnMBVXLNqzHaEOIOLuNHRTzNY0=,tag:cfWIbcqog08xId+kcTM7BA==,type:str]