ansible-infra/.sops.yaml

keys:
  admins: &admin_keys
    pgp: &admin_pgp_keys
      - &admin_pgp_djerun EF643F59E008414882232C78FFA8331EEB7D6B70
      - &admin_pgp_stb 21C9579E6503CA815A68ABD8541F9408A813C8B7
      - &admin_pgp_fi 9633412309CCB83BFA39BA5F2FEF746201D7FCFE
      - &admin_pgp_june 057870A2C72CD82566A3EC983695F4FCBCAE4912
      - &admin_pgp_haegar F38C9D4228FC6F674E322D9C3326D914EB9B8F55
      # - &admin_pgp_dario 5DA93D5C9D7320E1BD3522C79C78172B3551C9FD # expired
      - &admin_pgp_echtnurich 8996B62CBD159DCADD3B6DC08BB33A8ABCF7BC4A
      - &admin_pgp_c6ristian B71138A6A8964A3C3B8899857B4F70C356765BAB
      - &admin_pgp_lilly D2E9C0807BF681F5E164DAFC5EE1B61CD90954CD
      - &admin_pgp_langoor 878FEA3CB6A6F6E7CD80ECBE28506E3585F9F533
      - &admin_pgp_bitwhisker 41FFAF3D519CF5C039FBD8414BCC213729AF0E49
    age: &admin_age_keys
      - &admin_age_jtbx ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIBQgnQAq6FUSDK8bxtYPjx3oRCAKG+xy9J3Gas2ztJk
  hosts:
    chaosknoten:
      age: &host_chaosknoten_age_keys
        - &host_netbox_ansible_pull_age_key age1ss82zwqkj438re78355p886r89csqrrfmkfp8lrrf8v23nza492qza4ey3
        - &host_cloud_ansible_pull_age_key age1gdfhx5hy829uqkw4nwjwlpvl7zqvljguzsnjv0dpwz5q5u7dtf6s90wndt
        - &host_eh22_wiki_ansible_pull_age_key age13nm6hfz66ce4wpn89fye05mag3l3h04etvz6wj7szm3vzrdlfupqhrp3fa
        - &host_grafana_ansible_pull_age_key age1jtusr294t8mzar2qy857v6s329ret9s353y4kuulxwnlyy4dvpjsvyl67m
        - &host_onlyoffice_ansible_pull_age_key age1a27euccw8j23wec76ls8vmzp7mntfcn4v8tkyegmg8alzfhk3suqwm6vgv
        - &host_pretalx_ansible_pull_age_key age133wy6sxhgx3kkwxecra6xf9ey2uhnvtjpgwawwfmpvz0jpd0s5dqe385u3
        - &host_sunders_ansible_pull_age_key age1na0nh9ndnr9cxpnlvstrxskr4fxf4spnkw48ufl7m43f98y40y7shhnvgd
        - &host_wiki_ansible_pull_age_key age1sqs05anv4acculyap35e6vehdxw3g6ycwnvh6hsuv8u33re984zsnqfvqv
        - &host_renovate_ansible_pull_age_key age18qam683rva3ee3wgue7r0ey4ws4jttz4a4dpe3q8kq8lmrp97ezq2cns8d
        - &host_ccchoir_ansible_pull_age_key age19rg2cuj9smv8nzxmr03azfqe69edhep53dep6kvh83paf08zv58sntm0fg
        - &host_tickets_ansible_pull_age_key age16znyzvquuy8467gg27mdwdt8k6kcu3fjrvfm6gnl4nmqp8tuvqaspqgcet
        - &host_jitsi_ansible_pull_age_key age187zdk64205lx7r83a4m26pfa8hq6khc8sf83k266jasngeq08v3sfqswfg
        - &host_keycloak_ansible_pull_age_key age1azkgwrcwqhc6flj7gturptpl2uvay6pd94cam4t6yuk2n4wlnsqsj38hca
        - &host_lists_ansible_pull_age_key age17x20h3m6wgfhereusc224u95ac8aj68fzlkkj5ptvs9c5vlz3usqdu7crq
        - &host_mumble_ansible_pull_age_key age1wnympe3x8ce8hk87cymmt6wvccs4aes5rhhs44hq0s529v5z4g5sfyphwx
        - &host_pad_ansible_pull_age_key age172pk7lyc6p4ewy0f2h6pau5d5sz6z8cq66hm4u4tpzx3an496a2sljx7x5
        - &host_public_reverse_proxy_ansible_pull_age_key age1p7pxgq5kwcpdkhkh3qq4pvnltrdk4gwf60hdhv8ka0mdxmgnjepqyleyen
        - &host_zammad_ansible_pull_age_key age1sv7uhpnk9d3u3je9zzvlux0kd83f627aclpamnz2h3ksg599838qjgrvqs
        - &host_ntfy_ansible_pull_age_key age1dkecypmfuj0tcm2cz8vnvq5drpu2ddhgnfkzxvscs7m4e79gpseqyhr9pg
        - &host_spaceapiccc_ansible_pull_age_key age1mdtnk78aeqnwqadjqje5pfha04wu92d3ecchyqajjmy434kwq98qksq2wa
        - &host_acmedns_ansible_pull_age_key age16pxqxdj25xz6w200sf8duc62vyk0xkhzc7y63nyhg29sm077vp8qy4sywv
        - &host_draupnir_ansible_pull_age_key age1hv7m3xypesdfm0dfzwgctde8v307g9xaunnfu2687y0lagcs5q7s3eg0kj
        - &host_diday_staging_runner_ansible_pull_age_key age1522f3qzddm82w63j7ajdkr0khvced6ht7tzp3grvp0j3hewtvesssr5kpf
        - &host_auth_dns_ansible_pull_age_key age18zgt4y2sd75hxnpe333zz39048ctxpr0q8a3uqh3jajjkyawsdrq8yg5ve
        - &host_forgejo_runner_ansible_pull_age_key age1az0k6cadssk6r8qcqxfr8cyu5mndy59pwt8yqq6w065ew6au4ezsmg2vkf
        - &host_forgejo_runner_external_ansible_pull_age_key age1pq1jqrcp3te50xugmv5wst3s9ahj0d38rfktxt43wlcqz7vnwyn3y2h7kyfr6rckrvmuk9m7yvp4efjnfsuxx6d8r9gn222r2eal5593arywrjwrgeypf745wyuvf3z2xk9tm5fgnwckftuvdggk66fph59rw69nt5dpjeewuww4vzt9gs4xelre952s7zjz56qv8tvesg2c89sp8rmy9dvhwfd6tucjhs6sjr6yp2njjra2u6w7c7f0sch3rwkw3wf2dc9su9aaa9q2f22sh5yf0fqejxa2qqpq4pg752589st5xsa5g8tpkjglj4tn35gd4hjj0xet9cjwhydmkmmkffy3nr8zdtctqu6pqsyf7aphvktryez39ru3qe7m6nvr465ffxr0ltvr85nddzxvcwpwpac64nu5tdfrxgjfqzc99vr3zxv8carpsw5evmruqlvrq6v6a4m2cwsz5gqw7nyk3jlj75kp5cnafzjn5dyrf8ppfhp5g5s34zsl7pejmmx2uuudjt7ru2y7as9mtagykrgqgt80fvp3eeh4gsmmd3ujgtp0ranq28aq9x0xdekqh49pfhhprjj6zqdfac5gxtjj736kh5jktc4ls4mjs3p33rzt6ze54uqsfept3qhua2pmugypup6hm6j2ek5sgxjnwvqyfj2l8vz4yfgkaxf699v7jqlwf7g68ang5kzqrjsu78lyardm4zen8zhrr24j334qdgs4zr8dhsfsnmvx9cdvu0swx27tcz8txs46zds9kekgmua7w7fnw3l2lf6zla956ssycac4zjy87rawr4thusxtcqgfzfzh2za9np0s34e5dwkp2l2k06cq09myxqfe7ze6a53d8sl5j43qcekh6kfvl9k0t7903q99pc35630zwm3hwxgnw354du5gngnz56skq9zx3pcnkr5eyh8r8t0dqudmvrrwmxreu6tgrklxw7yvu3zkjgt3gyjhc8kqcrevlukay45sz4k9zqxx9yrs88hzt4h52r2g74alf3cedes3atufy06q4lfq3nxdlnve0kqcwstzr6z6u7fqpqvacezdrr62ycteju6dqawkpthu0drtlxj547htfjcsnrmhgvhskwtuhk6yp7wp30p7qc5vkk8fegg6qx5kc9xs4trx7hj9xgydu7vd30hkceuxsczywjs9v2fl3svkwfypg62882yq6ltv7gfj4ajuy8ezd76g0z7juwspe7q6zs5ceshd6038tvvh2nlpjty6rg6a9qfzhgmjx9s6hynyk7xnq9zra6hxstg8p58x75hapd2mk6rapfunlnnkz5dsxjf4ud4dsvgjfjpzxcdy7sp8dzxtengrsdyu4824mqlw8p63d7m2z4mcyme4tm2qkugtdgrkyphe7akk2geukf6xkfkzd2pkdq5s3qm9fkvfkgrv6yw5kdgjak8xcgesg6tumans4fs8yrxtqlvv2z3emdvwchrjfq4xpzsj27yt4gdg8pknwz9tqpjkjxq6lysutrvwkvt2fwyj8wvv8wtmdl6fk6rsd9kq9a6wkhuq7vvrgwgj3xg2s229sprj4g2vzhy2dfesrp403gs64jqkrjuezwm4zd6uw2x4e2qkj8xqcf7c0zprdzu959x23u878vqqetgpjwt0z3kedt8l6dgpm0rf5dmrya5h3wgzfa0jjvgjphyxgxrwlrzpv4czgal933zs64tn90ks66ejjdaw4t67sch8r3q0kljeqnpdgmw0cpj6arc6k46wcqaccygczy76zt9362vslakvzqqv33tv3sjldp6qxprharmpm9uykgpx66343wuur5xj2aw0rgutpm4ztjzycn3a8d2jq2zpdzwmevezm7mkp9dmndkc3qz0kklgkxq9yehrk5ayfly97umhws0jll8qqg0r7gzxgw5vv76
    external:
      age: &host_external_age_keys
        - &host_status_ansible_pull_age_key age1p546j6whqsyfkjuf674lawrnk2ex653fuvwhcwt46gkrspkq59sqzm5y87
    z9:
      age: &host_z9_age_keys
        - &host_dooris_ansible_pull_age_key age1j0876shgsn7f2thxh9kx9x5uwnh45z6sy2jlk2qz5jhgedm26g5srn9kax
        - &host_light_ansible_pull_age_key age1llkxtfx4dgnezmukj4ganx4ql9k4ga4ca9zuanf5r568jfp8peeqal490q
        - &host_waybackproxy_ansible_pull_age_key age197tmckjll9999v5apqh5h70dktdxzxn92uyzce5j7jmesvnneecs9p7m5j
        - &host_yate_ansible_pull_age_key age1yc9s8r7zt6tc7scfyxc3345khdwqrx0lwj4z6yp56h6rmauev50s5yqr22
        - &host_z9_router_ansible_pull_age_key age1tx03yh67f052jzehvtvzmhe5ja6ca0rlugw8pr9v7q67z38w2ahs2a4alp

creation_rules:
  ## group vars
  - path_regex: "inventories/chaosknoten/group_vars/.+\\.sops\\..+"
    key_groups:
      - age:
          *host_chaosknoten_age_keys
        merge:
          - *admin_keys
  - path_regex: "inventories/external/group_vars/.+\\.sops\\..+"
    key_groups:
      - age:
          *host_external_age_keys
        merge:
          - *admin_keys
  - path_regex: "inventories/z9/group_vars/.+\\.sops\\..+"
    key_groups:
      - age:
          *host_z9_age_keys
        merge:
          - *admin_keys
  ## host vars
  # chaosknoten hosts
  - path_regex: "inventories/chaosknoten/host_vars/acmedns\\.sops\\..+"
    key_groups:
      - age:
          - *host_acmedns_ansible_pull_age_key
        merge:
          - *admin_keys
  - path_regex: "inventories/chaosknoten/host_vars/cloud\\.sops\\..+"
    key_groups:
      - age:
          - *host_cloud_ansible_pull_age_key
        merge:
          - *admin_keys
  - path_regex: "inventories/chaosknoten/host_vars/jitsi\\.sops\\..+"
    key_groups:
      - age:
          - *host_jitsi_ansible_pull_age_key
        merge:
          - *admin_keys
  - path_regex: "inventories/chaosknoten/host_vars/keycloak\\.sops\\..+"
    key_groups:
      - age:
          - *host_keycloak_ansible_pull_age_key
        merge:
          - *admin_keys
  - path_regex: "inventories/chaosknoten/host_vars/grafana\\.sops\\..+"
    key_groups:
      - age:
          - *host_grafana_ansible_pull_age_key
        merge:
          - *admin_keys
  - path_regex: "inventories/chaosknoten/host_vars/pad\\.sops\\..+"
    key_groups:
      - age:
          - *host_pad_ansible_pull_age_key
        merge:
          - *admin_keys
  - path_regex: "inventories/chaosknoten/host_vars/ccchoir\\.sops\\..+"
    key_groups:
      - age:
          - *host_ccchoir_ansible_pull_age_key
        merge:
          - *admin_keys
  - path_regex: "inventories/chaosknoten/host_vars/pretalx\\.sops\\..+"
    key_groups:
      - age:
          - *host_pretalx_ansible_pull_age_key
        merge:
          - *admin_keys
  - path_regex: "inventories/chaosknoten/host_vars/netbox\\.sops\\..+"
    key_groups:
      - age:
          - *host_netbox_ansible_pull_age_key
        merge:
          - *admin_keys
  - path_regex: "inventories/chaosknoten/host_vars/tickets\\.sops\\..+"
    key_groups:
      - age:
          - *host_tickets_ansible_pull_age_key
        merge:
          - *admin_keys
  - path_regex: "inventories/chaosknoten/host_vars/onlyoffice\\.sops\\..+"
    key_groups:
      - age:
          - *host_onlyoffice_ansible_pull_age_key
        merge:
          - *admin_keys
  - path_regex: "inventories/chaosknoten/host_vars/zammad\\.sops\\..+"
    key_groups:
      - age:
          - *host_zammad_ansible_pull_age_key
        merge:
          - *admin_keys
  - path_regex: "inventories/chaosknoten/host_vars/ntfy\\.sops\\..+"
    key_groups:
      - age:
          - *host_ntfy_ansible_pull_age_key
        merge:
          - *admin_keys
  - path_regex: "inventories/chaosknoten/host_vars/eh22-wiki\\.sops\\..+"
    key_groups:
      - age:
          - *host_eh22_wiki_ansible_pull_age_key
        merge:
          - *admin_keys
  - path_regex: "inventories/chaosknoten/host_vars/sunders\\.sops\\..+"
    key_groups:
      - age:
          - *host_sunders_ansible_pull_age_key
        merge:
          - *admin_keys
  - path_regex: "inventories/chaosknoten/host_vars/wiki\\.sops\\..+"
    key_groups:
      - age:
          - *host_wiki_ansible_pull_age_key
        merge:
          - *admin_keys
  - path_regex: "inventories/chaosknoten/host_vars/renovate\\.sops\\..+"
    key_groups:
      - age:
          - *host_renovate_ansible_pull_age_key
        merge:
          - *admin_keys
  - path_regex: "inventories/chaosknoten/host_vars/lists\\.sops\\..+"
    key_groups:
      - age:
          - *host_lists_ansible_pull_age_key
        merge:
          - *admin_keys
  - path_regex: "inventories/chaosknoten/host_vars/mumble\\.sops\\..+"
    key_groups:
      - age:
          - *host_mumble_ansible_pull_age_key
        merge:
          - *admin_keys
  - path_regex: "inventories/chaosknoten/host_vars/public-reverse-proxy\\.sops\\..+"
    key_groups:
      - age:
          - *host_public_reverse_proxy_ansible_pull_age_key
        merge:
          - *admin_keys
  - path_regex: "inventories/chaosknoten/host_vars/spaceapiccc\\.sops\\..+"
    key_groups:
      - age:
          - *host_spaceapiccc_ansible_pull_age_key
        merge:
          - *admin_keys
  - path_regex: "inventories/chaosknoten/host_vars/draupnir\\.sops\\..+"
    key_groups:
      - age:
          - *host_draupnir_ansible_pull_age_key
        merge:
          - *admin_keys
  - path_regex: "inventories/chaosknoten/host_vars/diday-staging-runner\\.sops\\..+"
    key_groups:
      - age:
          - *host_diday_staging_runner_ansible_pull_age_key
        merge:
          - *admin_keys
  - path_regex: "inventories/chaosknoten/host_vars/auth-dns\\.sops\\..+"
    key_groups:
      - age:
          - *host_auth_dns_ansible_pull_age_key
        merge:
          - *admin_keys
  - path_regex: "inventories/chaosknoten/host_vars/forgejo-runner\\.sops\\..+"
    key_groups:
      - age:
          - *host_forgejo_runner_ansible_pull_age_key
        merge:
          - *admin_keys
  - path_regex: "inventories/chaosknoten/host_vars/forgejo-runner-external\\.sops\\..+"
    key_groups:
      - age:
          - *host_forgejo_runner_external_ansible_pull_age_key
        merge:
          - *admin_keys
  # external hosts
  - path_regex: "inventories/external/host_vars/status\\.sops\\..+"
    key_groups:
      - age:
          - *host_status_ansible_pull_age_key
        merge:
          - *admin_keys
  # z9 hosts
  - path_regex: "inventories/z9/host_vars/dooris\\.sops\\..+"
    key_groups:
      - age:
          - *host_dooris_ansible_pull_age_key
        merge:
          - *admin_keys
  - path_regex: "inventories/z9/host_vars/light\\.sops\\..+"
    key_groups:
      - age:
          - *host_light_ansible_pull_age_key
        merge:
          - *admin_keys
  - path_regex: "inventories/z9/host_vars/waybackproxy\\.sops\\..+"
    key_groups:
      - age:
          - *host_waybackproxy_ansible_pull_age_key
        merge:
          - *admin_keys
  - path_regex: "inventories/z9/host_vars/yate\\.sops\\..+"
    key_groups:
      - age:
          - *host_yate_ansible_pull_age_key
        merge:
          - *admin_keys
  - path_regex: "inventories/z9/host_vars/z9-router\\.sops\\..+"
    key_groups:
      - age:
          - *host_z9_router_ansible_pull_age_key
        merge:
          - *admin_keys
  # general
  - path_regex: ".+\\.sops\\..+"
    key_groups:
      - *admin_keys

stores:
  yaml:
    indent: 2