---
# SOPS configuration for Ansible secrets
# Copy to project root as .sops.yaml
# See: https://github.com/getsops/sops
#
# No rule sets `encrypted_regex`. Without a selector SOPS encrypts every value
# in the document, so a credential named `client_secret`, `private_key`,
# `aws_secret_access_key` or `database_password` is covered without anyone
# having to extend an allowlist first.
#
# If a file must keep readable metadata, add `unencrypted_regex` to that single
# rule and review the pattern as carefully as the secrets themselves. Anything
# the pattern matches is committed in the clear:
#
#     unencrypted_regex: "^(app_name|environment|ansible_managed)$"
#
# SOPS accepts only one selector per rule, so `unencrypted_regex` and
# `encrypted_regex` are mutually exclusive.

creation_rules:
  # Production secrets - use AWS KMS
  - path_regex: vault/production\.ya?ml$
    kms: arn:aws:kms:us-east-1:123456789:key/your-key-id
    pgp: ""  # Disable PGP for this rule

  # Staging secrets - use PGP
  - path_regex: vault/staging\.ya?ml$
    pgp: "YOUR_PGP_FINGERPRINT"

  # Development secrets - use age (modern alternative to PGP)
  - path_regex: vault/dev\.ya?ml$
    age: age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p

  # Multi-cloud example - use multiple KMS providers
  - path_regex: vault/multicloud\.ya?ml$
    kms: arn:aws:kms:us-east-1:123456789:key/aws-key-id
    gcp_kms: projects/my-project/locations/global/keyRings/my-keyring/cryptoKeys/my-key
    azure_kv: https://my-vault.vault.azure.net/keys/my-key/version

  # Default rule for all other files
  - path_regex: \.ya?ml$
    pgp: "YOUR_PGP_FINGERPRINT"

# Unencrypted suffix (optional)
# Files ending with .cleartext.yml won't be encrypted
unencrypted_suffix: .cleartext.yml

# Store creation date/time
creation_date: true