[goldman] Switch secrets

machines/.sops.yaml

@@ -133,7 +133,7 @@ creation_rules:
       age:
       - *machine_ns1
       - *admin_atlan
-  - path_regex: goldman/gatekeeper.env$
+  - path_regex: goldman/secrets.yaml$
     key_groups:
     - pgp:
       - *admin_kalipso

machines/goldman/configuration.nix

@@ -67,8 +67,7 @@ in
     }];
   };
   sops.secrets.gatekeeperEnv = {
-    sopsFile = ./gatekeeper.env;
-    key = "";
+    sopsFile = ./secrets.yaml;
   };
   services = {
     gatekeeper = {

machines/goldman/gatekeeper.env

@@ -1,27 +0,0 @@
-MIFARE_APP_MASTER_KEY=ENC[AES256_GCM,data:I1YgnEjcMOnUtp5W2etsJgYyLr7lonzNg8gsUwZJcslfAw==,iv:oZknXxh5KcVzX6vdtyUH69kKjYAckmHL56QaMF1MOH0=,tag:GfR7AVn6IXCfI3mGBN9Dsw==,type:str]
-MIFARE_ACL_READ_BASE_KEY=ENC[AES256_GCM,data:A5cnHzlEW38YrQpoAL20+YMtx+PbaidM5Q2n9b4fWngQUg==,iv:eNhI23L2GVzpPEa0QyEU97iBQVDuhqsOwWPezzuS8+Y=,tag:9CuZSpqYsV/y0mvaAO3S/w==,type:str]
-MIFARE_ACL_WRITE_BASE_KEY=ENC[AES256_GCM,data:V4q0PuQJxcDXsix6XQsBamq1V/V+K+N4noRGgpJjjTB13g==,iv:4OJN8HzWQtaoJlh01uFmUvgXRwFY0jorkTgZjljJsRc=,tag:1H648/Jy7KANtRNDSkyTSA==,type:str]
-SECRET_KEY=ENC[AES256_GCM,data:K2FYP/4vk9maohnSQF735zGbkeV5HGcCJFSzyrifGPS3YA==,iv:oAxz/gAn76ch/UliCDlXzVNTRzuIDgdhD/k92vXqmok=,tag:NuoXXPdhLpxDuDh78qTF1A==,type:str]
-MQTT_HOST =ENC[AES256_GCM,data:6YTmAljhE9w/pnXo,iv:08FNf3xopciUPLeGMnSIkehaM/Gjfvwi2RHb4t7TzJI=,tag:UYyFxbkugBULoQ6hS1aqWw==,type:str]
-MQTT_PORT =ENC[AES256_GCM,data:sGh+xyaVwQ==,iv:YuY1prObChjS0Urwe6M90hMMeBDkpG8sAou/uP2jXq4=,tag:Sqp92fwgGTRgHe9zk+D6Tw==,type:str]
-DISABLE_CALDAV =ENC[AES256_GCM,data:3iAINTq/Htc=,iv:GWcnwG607jbMxVpl0jKRFBJ+tCRHM9SLUbj7ChVwh1k=,tag:sQUdgiGqlROtSH4/cfvoCg==,type:str]
-DISABLE_CARDS =ENC[AES256_GCM,data:4IFbzoLNdYU=,iv:So2jIQ6bBvKbh9aki0H/yJ4cvdeqYxMj0gtS7C/Snhs=,tag:G21lbZ6DpMwBjIzERXBjZw==,type:str]
-CALDAV_URL =ENC[AES256_GCM,data:hgObeMHReiqCXXQ2N8Y1rLKPydz1bY1ae4YBt1X1BIsnpU0S7EB1XFifhpcx9X12szibtQ59YA==,iv:jxsDZnSX78UF8Hrtjng8/JThg/MweBUYvqdVLptYWXI=,tag:YfFgxQehpYIuZQ7MHq0WkA==,type:str]
-CALDAV_USER =ENC[AES256_GCM,data:+BSTNCi7mULdWhM1oa06,iv:UlpkZTEmvuktC0daH4nBm0kaJiIaWt8DVL+wMLBjuxo=,tag:RfX5dbLBtJ0FfSXVxlW99w==,type:str]
-CALDAV_PASSWORD =ENC[AES256_GCM,data:TXUBlhjge6b3Uu0BH/IJ53zqGAAVF8/XhvXVHuhgmi8=,iv:oSDpRWTP/jP06ZS4diwcUdAAnI+GSIomY+IbIERki4E=,tag:RKNW99kkZd5WmOe2poFM1A==,type:str]
-CALDAV_CALENDARS =ENC[AES256_GCM,data:0T42oZqIDFgUegGBzw==,iv:LFYzH4Ej+Aavugg3lRaR+rP4ZGjDUPyTbxwTc9DChgc=,tag:IPx04P8KFW6vfN6UTKJPIA==,type:str]
-CALDAV_REFRESH_INTERVAL =ENC[AES256_GCM,data:/tHX+A==,iv:I7JNh30TMyT5L8cLPGINTxZVUXzk94nix4tMHfIHKlI=,tag:flZqije+8tsQXL68nEewnQ==,type:str]
-sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxQTNNN0dpbWR2OFJtalIz\nOGFQaHlzRGEyVlZTUUpBRGI0Q3NpbnZVeWlRClYrTlAvZmNMUVg5MnhETlEvTU8x\nSzdlU0syT3FjdmZqOWY5eGprYkxPeHMKLS0tIENNOXZZc2hkTXhyUkgxN3I1TE8y\nU2h5d0ZaWS9QdTVsZGJjVlZuL3kwK28K6ATJuMyMSKAbbz0DVC/Yuz0g7F0DgNd5\nEo1L86EefttFwUuvz+hpNqllU3f6kGa19sFBcQc5cpQF6G6MTCJxOA==\n-----END AGE ENCRYPTED FILE-----\n
-sops_age__list_0__map_recipient=age10gk6kydhljjk99vmaj6z0sz5d9x7pwp458gpr3hzqpl5hh04z5xqgley7j
-sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5aGgxWmovR2gzVnZaT1Uw\nd2VtUis1SEM5OXZYVENjWURrNUJscnQ0TUhjCmZ2dURBL2NESUJFd3RYNGdWWmNM\nSmpRdURMK0xJVzFhUkwrMHd3ZDkwbm8KLS0tIDRjemJEN1lJSXBvN2prRVFEQ25N\ncXBqeXF4dzNIak8vTUd1Rmt1ZkhTclEKRSoxGpRmrejYTx/KnbG6IxRSzrRXNyHP\nTQpY5OD6/nmajrxIymvEFdsMMw2DiWevypCAJZQK3/+OqIlgKnfiaQ==\n-----END AGE ENCRYPTED FILE-----\n
-sops_age__list_1__map_recipient=age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
-sops_lastmodified=2026-11-07T23:23:15Z
-sops_mac=ENC[AES256_GCM,data:VT1hKDEC2QUwEz6E+qAbUBVJi0sF6yNBfdkYIccb4+5EYWr1dKIiwOxwkqvvHKi1S5Kw501CH/oB3nswgDV1/fJsXlrgvCrF9AeX8W5IFMyTYe/aEtsWBS2lnyL2do5YFGss9XX0RJOXmqvsyGDRpnMi0wTvths/f7tmVv8m3Es=,iv:UZDX5rF0sl2nGwbR16IQcQJq/W+QYjeTwSE1CkjHHC0=,tag:kJIpwvmYThnjoS09XSEmtQ==,type:str]
-sops_pgp__list_0__map_created_at=2026-11-07T23:23:15Z
-sops_pgp__list_0__map_enc=-----BEGIN PGP MESSAGE-----\n\nhQGMA5HdvEwzh/H7AQv/R4//v0z5OOfd+OB52bTcA8Cl1s5vkPg7Xkjzn4yhc47e\nWdMHW3i2y18I1WJyoNTQGqoZNXAIyvZleq8q8e/iibfr+ZefP/UaCKOPiLJ6fUN+\nD+bqYn3LBR0whzEBI7GWr+/xwyJX6L7qk16NhR2zTFku+PGRaHo2YhfKxqw9GqbL\niNSVs3MGRvinLlLYZbAAKtfQ7IZJ/JIvWLAU4ZGvfNBh8XQ9xirVnl32A5/2dSPV\nOv1gg1gmxGAkOFbShw4k6nmCCM+HB95goHbriWk/3oCsToNuhQyVVGz3m+E4ZXFP\n6GDHh2zuRENe+UZHQStle1fS/4v/mHrkXfH771pDy6DPWGbOz/abmRYD+CtOxhRP\niD0w0jbrvma5+kn53/CN/WTJa3aBzyr1T+5fVamczriC7cnZgR+u1zp2gS+th1WE\nFtsh7WrNkHRYWBXsj1YnH/x62cO9t/29i6i0qXuCILxP/39wdcljyNIUzFBZ04TI\naY3Nc3+uoSp42RTeYfIm0lYBs8uuPhELVlFblaI8dZ4hTDLzr7lRYs07nvOkWvfS\nWnnY23oYRvmj66qujLaxYrvhrOe9l+xe1qGj0Kzolb9xgDsSdb/HjUysLNGU3CuL\nBbquv+RcSA==\n=k+7t\n-----END PGP MESSAGE-----
-sops_pgp__list_0__map_fp=c4639370c41133a738f643a591ddbc4c3387f1fb
-sops_pgp__list_1__map_created_at=2026-11-07T23:23:15Z
-sops_pgp__list_1__map_enc=-----BEGIN PGP MESSAGE-----\n\nhQIMA98TrrsQEbXUAQ/7BPsXeKJ4NwpHMonr0l5nfWrbXwtBCwE6YrMWsYFVnleZ\nxZe/w8vsAfe2fcVyXsmPsHnskh7Mqjnxk+M6oc9OWxCS35NQ2BROxqPDXVqOuTNJ\nQTNuHNMMornysa28TCnO+zr90K7s3WUc0g53VcWxEZndPhiSdA/KftAmJJaFV+kd\nbUQW7Yc0WkO64S2DMpFI9GCfgqNll53nnXt6KgbRrNcE7bD08kOBVCHyZ1hXJKai\nQ0LLQ4+odv1mSn5UP48dOKYZcFlIQ0QCKdCJ96zApaPajOF24f+0Yi4f6wMEVxfs\nAWQbBOFot78zOQJH8mZO0WlOf1Cw6v18tE74dGPPsFInCqMYth9oDJ4lTP+wMyl2\nskXJRuK3wzmmWL8h9qL4yym1vVW9V0NHZLlTip8SKlnujrmE+rjgKAmFvcezygDG\nKIQuOUQsuiWiRE7XCMMQX+2bwjUjerM3yhoLQixX6fDzhWTX5f70nq+OBnLR0SD9\n1uq5Nkb5N01qyhAtYyTcsxJvTy0YJ6NE6CDoGmIOS4hUq1Lf4nMRx7vfemsrvcca\nNj7nkMWcLeOUcBSVBR84nRVlTN96qjAeOycl4TmAw3H9sciBWs6MNdPgD6XR7D0r\nboHxhXApCiPj6YGTdCGEtqs5ha0yFJVljyWR63+EM9iKVV4lMZL4excHSCBlmojS\nVgEufYXXDTuWonGAsLyciMGokCvxCIKuIxC/3FcdHT0Ijg97h1vZ9K3qY8VQ1NeI\n92fAnC7edWJ3W7zbbxZqhXKx6NOF1EideBdy8xOP2nk6RZkS82i0\n=LofN\n-----END PGP MESSAGE-----
-sops_pgp__list_1__map_fp=aef8d6c7e4761fc297cda833df13aebb1011b5d4
-sops_unencrypted_suffix=_unencrypted
-sops_version=3.13.3

machines/goldman/secrets.yaml

@@ -0,0 +1,64 @@
+gatekeeperEnv: ENC[AES256_GCM,data:BwfUsw95AlrPdp68URZsEzUrVtphPtWpsCzkPRdFlC6fH5XM5Om3UNG+fmJce9bWyH2pA4aRcYuJKgQhrk8NttXt9O4nsqE3X7pgRuv2ruZ2A4g0yXZo+smCXFhp9VADCB7VbO18/UbZhi6SHSuSgrlk//8BygTKdrzVNDw0sTOOAKTlGPGLUbjqzLh18bgytVArROOwEs/LO3oQoTyATT01TInczQHqFC+0+PVCKp30jn3QGrOf5tL5OBtqSmlkJUtsh87zZ8npJ0VOF05yBiSEdYKt3ljCha8o9AUfGSJZ6VSWQt+dbYnfeuiAkHWjoR2hYL387k9/dN0i4/fXL1piC7QWIGfd0M8DfS1Jib+CWBUuEEE5XnUuX4tyV07jMGP4OGSwbvA5q1rRIXFtF6HR/ZXyMA6KSwPpejf0QEoZfu6UKvT42uWk5IxYq06YQsfoKjgGXw0wVn1OA/HhIqUIC82KzyS6BV06X8AgDy2dM1k77bjKI01ewW0XcOjErP2og93oqF+skrA7dtJ4gQtkEIKG7K2+Z2EjCZSiTARYG/yHI/D+M2C4SmO22UhgJ3CMDULtlMvto35fzojQokZbflp34lPT4XzziWr/EAmupzG3ZGxjhr51L6hK7HiZbrB8enmaAhUBeNaNzAo7W4CyOm9MvQbUdZvz,iv:zyZgbwKxG9w2OUFeJVB3scXedzFyInGdR4LPVf4F2GE=,tag:DUFeJ1Qj6i/bg1Nv/zgOyg==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0ZVNEdENac1RGaXdzb0ox
+            aXJvQ3RhOHZULzVUMjIzVkFKMUp0aG00ZHlnCmFqQmlLbmZQVUUveG1INGVnbW5x
+            OE1HOUx1TmR6bERuUGxYUjNwSGoyRlEKLS0tIE1tWEJXQk5CT1lMdmdad2FTOENa
+            NW9lOTd5TGNobFN5VFR4Q2xIMjk3MkkKj85PvBY45bF4UlwQ2BhCjmfLdpWvtuD5
+            MmBql3JijU22TVh4d85tvKGrxmwMPenLC+GzawR0wbMXKKwmGu+Tqg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age10gk6kydhljjk99vmaj6z0sz5d9x7pwp458gpr3hzqpl5hh04z5xqgley7j
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4UlYvam94d1hvbmRpdHI2
+            dEhocE5ZQUkwQ1ljcDlwYVZYelRTcHI3T0VnCjVURFNvc1c3Q2tTNXB1cXE5SWZj
+            aXl6YU9TMmJNaERGT1pOZWFEVG9tNDgKLS0tIEE2TzZ2eTJlQXMzOUp5UXIvMGFU
+            b0o0VFdNZGpjOWRSSmQ2RWlkUm9IZkkK33kOgGs5K8QEYwQ/n65y+Lftio1A6SGD
+            UK46fFb+yAoK/H3XRgzot0dt8+7RBTCJwNF+1tHWPl2Nk/1KY2bJ1g==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
+    lastmodified: "2026-11-10T14:44:01Z"
+    mac: ENC[AES256_GCM,data:70/rcqZJ5H1wTnEDAPo3MZEVrbAqwifgHu8+gdnc5E0K3Ng2dYWR/LyeX8FiaAssmchVk6kQE+1HQygLm5dk87F26Niu4Y098v0YY3XG5PrzaltRho6voBNRyORb6MtOPIZrMgooUD22hVZJq/0aG+slas3eP+YbbGu1my75/84=,iv:DlEMElxoV/ciX1g6ZdEAFWnejGPKKqxJ3oxaZRXi/3c=,tag:5kraajN1jIaF44g7fGMs/g==,type:str]
+    pgp:
+        - created_at: "2026-11-10T14:43:03Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQGMA5HdvEwzh/H7AQwAmZuazwF5B/LTZMEe6nV+TBPubQN2b4CVI8HEFwfFKPeM
+            sKhn8isOnf+Q7gonZVLRiSraMc/Ttj2VZEJDA1Y76GSBNQK5irIQsYHl6J7fd2c4
+            85+YBbNiFLeSTmUMdkqjRDeo49o2J0ItAy7nwtiqpL59rLVcUq5cPvAHiaEGSTes
+            c1qe23BpRuagvKlzKYOoauGD3cDNyQ+jOhfJxsROlrsAL2N+1QNhIxE95JGhDnX9
+            AirNruuufDGVBsryZVUDo8fdZzc+p5CsL9UHMgowLiH+UjmfEvEr1y6uNgQnjhG3
+            SMVf0qnbJNI7jSpRtnLYg/x0y3NxcmZEWvTqJ7s1LoM3z8Fc8iSYz9W6xLmZXZMg
+            LxmYfd3tmYyE7CAKQ7UAPs0yu9YGbLP9hNRhALEW9mse8wpgQ377wl6nB7CtF3dT
+            F64zrB9P72RAHrn882LQac4gY7hAERkGzgtC1zOfPBUTHUo+b839lNQ1nBDYzNr9
+            On85Sud8dAd2mLEaCCG60lgBDdYz5kzoXkY7trpIG+w9YLJhOwXt4jMsbTlQTs2x
+            NFnCUxik+W65Bl7PIACCmfjsdPoiGy/yrdeAblCZlthjy4AkKlaRb4NpdTKt3tSc
+            9v+JtcrlUFpC
+            =Bhqc
+            -----END PGP MESSAGE-----
+          fp: c4639370c41133a738f643a591ddbc4c3387f1fb
+        - created_at: "2026-11-10T14:43:03Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA98TrrsQEbXUAQ/6Awh/C2TD7Bz3JrOE4+aKm79MuHYHCjwqat2F/bfpRANr
+            MqEjrKi1YpfcPoSd05FbmjJgXdp3vHk1xz7n28rjEtqdNhV30bWyvEEc+XOpcyPV
+            hjAzHcw93Hk7PZDRsq70JhwXo4GFwI+jamgtxKy3stcCeUPpjvX97Z9GhGLhPh+3
+            PVoAR13p0NtliYVLs53IYnJ1ZkAsGoyNaTdjAT4FgeIrXJxfW1QS+8A51ERNpW8f
+            i+GfvYdZhgjBh187hCvPdkW6Bl5tk3Rf9fOTKIQe3mrrqYzzzESQy43UskFod0I4
+            IOobruNzm6nxmdzA9tFITYFljtWSAH3HQMokY+UufsRuJWgc6r+osPWVGZTGrMF8
+            HYly3lYNZ5alwevk5R/jQ1cTQFrRbJr3+iRR6FNVf/clnLLnRzsjAbxlQobFW7tb
+            YxyQYMh7f8jXvl/T+HYM6yM8G4qtFYmaRVhnssHFvyOcBxNTc1rOvr4xrLLX+QG7
+            YYZiS+JYh3/Jf4SGahc4UW9Qq19spBSXz9nAy+WJ+wFv1UUQwBTDxne2dO8DMCQv
+            J5BI0tGc7LiavFJPnUkFtFMvl/+Q56QE6lALc8M0HmEOX4m2y/8HJdptyXO/DasZ
+            y23JHAOxFRgOWbiVEsNjtT2n2wCP3gkZrqYP2XKMTdLXSfvlRbKs/oUlzgMFUBXS
+            WAHCyiUKfKq3CkTknBAORgZDMqbX2L6uFLkDKdoD7XREzJruYxUOfmuzvgUI2/iR
+            RXdxeKrJhCRYTrKwyTO00eT0W+IK08E0clZM0SrMjsbggoYtOcAElyE=
+            =brjr
+            -----END PGP MESSAGE-----
+          fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
+    unencrypted_suffix: _unencrypted
+    version: 3.13.3