Viktor Barzin 77143dfd6b state: per-stack Transit keys for namespace-owner access control ... - Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>) - state-sync passes per-stack Transit URI + age keys on encrypt - Vault policies scope namespace-owners to their stacks only: - sops-admin: wildcard access to all transit keys - sops-user-<name>: access only to owned stack keys - Anca (plotting-book) can only decrypt plotting-book state - Admin can decrypt everything (via admin Transit policy or age fallback) - External group sops-plotting-book maps Authentik group to Vault policy - Updated CLAUDE.md with state sync documentation		2026-03-17 23:08:18 +00:00
..
terraform.tfstate.enc	state: per-stack Transit keys for namespace-owner access control	2026-03-17 23:08:18 +00:00