# Tells the `sops` CLI which recipient to encrypt for, and which files that
# applies to. Files matching path_regex below get encrypted for this age
# public key when you run `sops -e`. Only the public key lives here — it can
# encrypt, but cannot decrypt anything. The matching private key lives only
# on your machine (~/.config/sops/age/keys.txt) and inside the cluster (a
# Secret created by hand, never committed) — see docs/10-secrets.md.
#
# Convention: any file ending in .sops.yaml is a secret meant to be committed
# encrypted. Plain .yaml files are never treated as secrets by this rule, so
# an accidental `sops -e` on the wrong file won't silently do nothing useful.
creation_rules:
  - path_regex: .*\.sops\.yaml$
    age: age1udejf5qa66rd6yvj5r8dz0fjnqfh0quf4t339c3cpqr26mkx2ydq3zel07