From 08d7de681a1cdd9d4e3eb1dff4a3bbf5af880a9d Mon Sep 17 00:00:00 2001
From: Grisha Shipunov
Date: Sun, 26 Jul 2026 18:08:29 +0200
Subject: setup cgit secrets

---
 .sops.yaml                 |  7 +++++++
 microvms/cgit/secrets.yaml | 37 +++++++++++++++++++++++++++++++++++++
 2 files changed, 44 insertions(+)
 create mode 100644 microvms/cgit/secrets.yaml

diff --git a/.sops.yaml b/.sops.yaml
index 864422b..18bbc3d 100644
--- a/.sops.yaml
+++ b/.sops.yaml
@@ -11,6 +11,7 @@ keys:
   - &immich age1afyntwvj672lcq2e4dpxmw3syplzurnnd8q8j3265843jeedpveqkp465z
   - &miniflux age15ja22wd9tt60vn32sk59pp6c7vtjsn8y3rypn8qfnvxthug8sp0q6f72uh
   - &stream age148r2q3cy9sjem37rvgtcc4qjx8usxkdg77pqexa56gmcexn58aaslh3cnj
+  - &cgit age1sqaw64c7vf2n937lhytqg5l39hl9ep47gqx7u7j8k5fz3w4ksv8qp9jjeh
 creation_rules:
   - path_regex: hosts/toaster/[^/]+\.yaml$
     key_groups:
@@ -60,3 +61,9 @@ creation_rules:
         - *admin_toaster
         - *admin_frituurpan
         - *stream
+  - path_regex: microvms/cgit/[^/]+\.yaml$
+    key_groups:
+      - age:
+        - *admin_toaster
+        - *admin_frituurpan
+        - *cgit
diff --git a/microvms/cgit/secrets.yaml b/microvms/cgit/secrets.yaml
new file mode 100644
index 0000000..cbbcf01
--- /dev/null
+++ b/microvms/cgit/secrets.yaml
@@ -0,0 +1,37 @@
+wg:
+    0xa-proxy: ENC[AES256_GCM,data:f0wxpc1lyE7gbLWwopnmz4LxgS0natwIyGSfgmkaH4nXlaiNgOjPjF0wX9o=,iv:tJ3ossMyD9RTO1r/0+ZUsSatmkEw/Gp2MmFd8RTHYic=,tag:SZgzgZgYqClxCz9ftHdOww==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IHowb2lXdyBlZnhS
+            dWtQeUk4NXlEMGdlb0lHSXl5NzJzdHc1U1JjL3U3bWQxT2pJVUQ4Ck9RZWQva3lH
+            bjB0UGNXTWdUMjFNVXNWM09kc0wzMHRJZStpMGVzZ3BaY0EKLS0tIEFDWEd4eEJG
+            RzVUdGhwNWExWTE1VFZBT0JQYVNTRGUzYTE4K0M2MkV1MGMKYgnFP9MIHTI1MIjD
+            +t1uXjCGo+7lGlBIt3t5mwaHeL0Y1s2gYmWhlZfqY09WFDHuZwmBaWc2ukn26jXl
+            acRroA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJl9iYG5oHBq/poBn7Jf1/FGWWbAnbx+NKjs7qtT3uAK
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFlJOElMUSBFdUhr
+            Vy9FRmxTQ1NSM1B6aHZnZS9ZVng5MzNSK2Rrd3UxejU4SXRzcVFjCjNHckJTTkho
+            YXBhVWRYcDlDaVJvblVTUURPWDI2TFY0VUhhYitvVThENFUKLS0tIHZFeUg2Z05t
+            WVVSZUNzbnJUOXloOHhhMFZWU1RmM3F2Sng2Qlc3S0NGQ1kKBZmy+nKi7NjPBRJ6
+            8+J551QLVupQz4EwnHSXUDV0uvcdOdStMURLWJVk+Hwk8h2a/qXWOcPuUuBpJErv
+            iUDPoA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAXrwZsBChUhVuF5gFEfj8GwQlnrqEttAytS5jVCfuE4 0xa@frituurpan
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMekpyQ2RqazFMTkxlWjR1
+            UXRYaGV4alJBY1hZNDBxcnhjU1FROE5LclJvClUyQ01sWWUzWDdIZUQ3OHJVUmsz
+            NDJwTEo1aTJ3LytsOHdlWUU0K0MwYjgKLS0tIFhTMDZLM0lwdFk1dVE0ZENVcUxI
+            QmwxMllXMHdxdWVvUlRIb0NnVFJMV0UKFamosF3tJavAY6p/iK9tC7Cq0mPG8vfj
+            3cVmLmoXKXSg9YyNkwlcrW3E3xK0rpFSWRN+YiOx3FFTep33Z6Khww==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1sqaw64c7vf2n937lhytqg5l39hl9ep47gqx7u7j8k5fz3w4ksv8qp9jjeh
+    lastmodified: "2026-07-26T14:05:47Z"
+    mac: ENC[AES256_GCM,data:bd4WafZbhkhJJN85aKCYoLrB12vj4qYfiw3bi0MBqu1SHY6W5C1XEHBHT9kF/ve9vb7wsSx/icLO+YFHL9eQmFWVtOIoCkPRiOTdgFl4k5Zmn/Hw34tIG7EzWlmroWYiY+7c5fcPxn99puB7OMCdOY8v5+ZFuQPBvvi1S9cX6ns=,iv:HrZWJvDVjcwI8QwpOnnZP5ODkyzepTrF3ult/oqb/mg=,tag:GeGz/l4LN/ojOStDrA6iPA==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.3
-- 
cgit v1.3.1