feat(secrets): cles Switch (deck) et cle de pre-auth du mesh headscale

secrets/switch-keys.yml (prod.keys d'Eden sur le deck, posees dans le home de marc) et secrets/headscale.yml (preauth_key reutilisable, consommee par services/tailscale sur tower, le deck et le VPS). Regles de creation sops associees dans .sops.yaml.

.sops.yaml

@@ -11,6 +11,12 @@ creation_rules:
       - age:
           - *tower
           - *deck-host
+  # Clés Switch (prod.keys) pour Eden sur le deck (posées dans le home de marc)
+  - path_regex: secrets/switch-keys\.yml$
+    key_groups:
+      - age:
+          - *tower
+          - *deck-host
   - path_regex: secrets/monero\.yml$
     key_groups:
       - age:
@@ -33,6 +39,15 @@ creation_rules:
           - *tower
           - *deck
           - *deck-host
+  # Mesh headscale (services/headscale + services/tailscale) : clé de
+  # pré-authentification partagée par les nœuds du tailnet, créée sur le VPS.
+  - path_regex: secrets/headscale\.yml$
+    key_groups:
+      - age:
+          - *anywhere
+          - *tower
+          - *mac
+          - *deck-host
   - path_regex: secrets/stalwart-mcp\.yml$
     key_groups:
       - age:

secrets/headscale.yml

@@ -0,0 +1,43 @@
+preauth_key: ENC[AES256_GCM,data:fT/JTi2nI74C7UahbzvpM9q4z7W44GtSnHG85XiLRHDG6MUpjj9ZZVtnot34BQbcuDh1uWnhQ7xt1n1/+vg6htPeVihFYuHpdNH9/4oVMaTAWBatjosTEw==,iv:hSg9rj5vAq8Kpr3f4zvRjGgocQB/zTEkgXCJm0RPaZE=,tag:1dkM5aRzzLwoI0bEe4NYbQ==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyU0hKa2FjS21aSS9NV0Qw
+            VnRZY2pCR2EvZGZ1SW1TQ1gvYlUyY0luVG1jCktDMnZ2cDR2SlpxVmh3Zmhmd3JZ
+            Ym9pOTV4dHJYT0R2SjBOUzJUR0hkWkEKLS0tIHo5dDBydXYvd3J4VjZsZHU4ajFm
+            YjUwTmRTY1h3dFVNUWdlVG9ncHhHaFEKffQlEqzUTyqc5GKuvw2tmBoUryTRni3l
+            LFnRmx84Rgt9i2AJZimyLuwwll/g5IaGfEMjsudw3tOuBY6XJ+yUtA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age189v3q8quejkaz4r8u0g2aechsfk4sk3465khx35erd320rea5scq98v7er
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHOUVBNVNINzNCZGJUaGNZ
+            UlhtS0NqUFRhaHhsRTRIOUMrVHpYM0dGV2dFClpRVnBISUhhY2FpeWhnT0U4MjVC
+            UFlTdDNpb0tZa0ZmQ1h2TmNSUS9JdDQKLS0tIFZRTmRkYnQ2cDFwUWdDaS9Ha3JJ
+            TTcvUHhUU2ZLeW5ablBOZEtnZ1RPd2MKqmbBKq+3gX+p6uI3wwCVejsb6p30Hy7V
+            A+1xX4naGf0Hmvu7EUmy0aIAJbLjkoMGd6BVfhYr5GAcGnCmfAI8BQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1usm3v0ugducrzcwud60dda7xfnj49fdhecj7kcsfm7dzwzrzeyqq2jc2hm
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuNmZkTGREcWhkVksxbFBh
+            TC94Q0xGTFpTVkZmU21UckdMNkdmMXNuK0JNCm9oeGowUDFzQUEwK1ZJY25qWHM5
+            RDJIQVlucm1sclgzMlVjOWNLa1JVYVUKLS0tIDVRcVkyaTNMY1RiUS9BTFUyck9w
+            VVJRRHRGSDhoM3drdjB3Z2VLS3U0Mk0KKIffomrNApPi5W8s1lH/m8UcF/aKeNVy
+            c5yX65jf5j6KI4sTrLUoaEpfu8HKGBsiH+C1L6TeIggew9OfwX3GAQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1fwgg9h68zz8s6xa8qt4yn7gqcqp59s0mma8xdfq9hunksqv8fq4qd9yfaz
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4VmF5WlRQWmc2alIrQjRU
+            NkNoYUp6bTd2TmJ3TUFSY1N1c1ZTSkNyVGk0CmpabE9Dc01kNFJWdFhqMXRKZGNH
+            bGNPd2d0bzJpcjNlRjJ4UkcyNUc3ZVkKLS0tIHdLQXpSdlZ5WUVUNVA5SkcyTzJy
+            alFTVUxMSWZaTGd2YUlDL1BoQTF0T0EKX3u83IiD4e2foEnCbofwDfr1DMuOEwka
+            q4iU+jnknu9Ji7CJNhBOQBx7IMT/Orco3R/M+PUWofID7dZtu45ENQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1rhnaejc5nwcqcuq5qt45wzr2fncurlwqw0adhnavfraqsdzffatqh5yhl4
+    lastmodified: "2026-10-23T16:18:02Z"
+    mac: ENC[AES256_GCM,data:cgxBiCYJGMGD8MKnaCk8K5q1OtPJANr7srl5M73NT8JKSDk/oY0g0b8OjuWXzwoNoRiTMvcZD5i1wIt09hoAWTyS+fIqYLkOe/5kraDv/fimk4TRjHcgzOCSOXuLLcOMRQxlC3ov9JXsz6VC9G51niDKlwdzpgKznsDjn6ryYG0=,iv:Ca9JH8WLeu5O4MgFL5oxf/xcWb+h+rvPfs9ug7jNzv4=,tag:MLUcfwUnPvMqgcBeaXA6tQ==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.3