keys:
  - &anywhere age189v3q8quejkaz4r8u0g2aechsfk4sk3465khx35erd320rea5scq98v7er
  - &tower age1usm3v0ugducrzcwud60dda7xfnj49fdhecj7kcsfm7dzwzrzeyqq2jc2hm
  - &mac age1fwgg9h68zz8s6xa8qt4yn7gqcqp59s0mma8xdfq9hunksqv8fq4qd9yfaz
  - &deck age154uz4pavaj5qth25ytj0q8chsya4y65pgel04zcrm02je9w6uc9sug7dp2
  - &deck-host age1rhnaejc5nwcqcuq5qt45wzr2fncurlwqw0adhnavfraqsdzffatqh5yhl4

creation_rules:
  - path_regex: secrets/monero-deck\.yml$
    key_groups:
      - age:
          - *tower
          - *deck-host
  # Clés Switch (prod.keys) pour Eden sur le deck (posées dans le home de marc)
  - path_regex: secrets/switch-keys\.yml$
    key_groups:
      - age:
          - *tower
          - *deck-host
  - path_regex: secrets/monero\.yml$
    key_groups:
      - age:
          - *tower
          - *deck
  - path_regex: secrets/common\.yml$
    key_groups:
      - age:
          - *anywhere
          - *tower
          - *mac
          - *deck
          - *deck-host
  # Réseau ygg-mesh (services/ygg-mesh) : mot de passe commun aux machines
  # membres du mesh. Mêmes destinataires que common.yml, sans le mac.
  - path_regex: secrets/ygg-mesh\.yml$
    key_groups:
      - age:
          - *anywhere
          - *tower
          - *deck
          - *deck-host
  # Mesh headscale (services/headscale + services/tailscale) : clé de
  # pré-authentification partagée par les nœuds du tailnet, créée sur le VPS.
  - path_regex: secrets/headscale\.yml$
    key_groups:
      - age:
          - *anywhere
          - *tower
          - *mac
          - *deck-host
  - path_regex: secrets/stalwart-mcp\.yml$
    key_groups:
      - age:
          - *tower
  - path_regex: secrets/hermes_api_server_env\.yml$
    key_groups:
      - age:
          - *tower
  - path_regex: secrets/mac\.yml$
    key_groups:
      - age:
          - *mac
  - path_regex: secrets/anywhere\.yml$
    key_groups:
      - age:
          - *anywhere
  - path_regex: secrets/wireguard\.yml$
    key_groups:
      - age:
          - *tower
  - path_regex: secrets/tower\.yml$
    key_groups:
      - age:
          - *tower
  - path_regex: secrets/protonmail\.yml$
    key_groups:
      - age:
          - *tower
  - path_regex: secrets/zitadel\.yml$
    key_groups:
      - age:
          - *tower
  - path_regex: secrets/zitadel-smtp\.yml$
    key_groups:
      - age:
          - *tower
  - path_regex: secrets/hermes-matrix\.yml$
    key_groups:
      - age:
          - *tower
  - path_regex: secrets/hermes-discord\.yml$
    key_groups:
      - age:
          - *tower
  - path_regex: secrets/discord-hermes-bridge\.yml$
    key_groups:
      - age:
          - *tower
  - path_regex: secrets/hermes-dashboard\.yml$
    key_groups:
      - age:
          - *tower
  - path_regex: secrets/reactive-resume\.yml$
    key_groups:
      - age:
          - *tower
  - path_regex: secrets/gitea\.yml$
    key_groups:
      - age:
          - *tower
  - path_regex: secrets/gitea-oidc\.yml$
    key_groups:
      - age:
          - *tower
  - path_regex: secrets/gitea-mcp\.yml$
    key_groups:
      - age:
          - *tower
  - path_regex: secrets/openrouter-mcp\.yml$
    key_groups:
      - age:
          - *tower
  - path_regex: secrets/codeberg\.yml$
    key_groups:
      - age:
          - *tower
  - path_regex: secrets/audiobookshelf\.yml$
    key_groups:
      - age:
          - *tower
  - path_regex: secrets/ibkr\.yml$
    key_groups:
      - age:
          - *tower
  - path_regex: secrets/kasmvnc\.yml$
    key_groups:
      - age:
          - *tower
  - path_regex: secrets/anki\.yml$
    key_groups:
      - age:
          - *tower
  - path_regex: secrets/winnie\.yml$
    key_groups:
      - age:
          - *tower
  - path_regex: secrets/wise\.yml$
    key_groups:
      - age:
          - *tower