4e7ca1ad61
- .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state - state-sync: try Vault Transit first, fall back to age key on disk - Re-encrypted all 101 state files with both Vault Transit + age - Normal workflow: vault login → decrypt via Transit (no key files) - Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
6 lines
289 B
YAML
6 lines
289 B
YAML
creation_rules:
|
|
- path_regex: '\.tfstate(\.enc)?$'
|
|
hc_vault_transit_uri: "https://vault.viktorbarzin.me/v1/transit/keys/sops-state"
|
|
age: >-
|
|
age1z64h9t3acsm2rr74pz7j4846kwj5tutx9sk78jqv46y8fln4vs2sy920ce,
|
|
age1rekkad48r2wzhwqgfetw5yugu3ln3qlht4xg3txmx55tee8cveess60r90
|