Added hetzner server configs

servers/hetzner/secrets/README.md

@@ -0,0 +1,26 @@
+# Secrets
+
+This directory contains encrypted secrets managed with sops-nix.
+
+## Setup
+
+1. Generate an age key on the target machine:
+   ```
+   mkdir -p /etc/age
+   age-keygen -o /etc/age/keys.txt
+   ```
+
+2. Add the public key to `.sops.yaml`
+
+3. Create/edit secrets:
+   ```
+   sops secrets/mail-accounts.yaml
+   sops secrets/env.yaml
+   ```
+
+## Files
+
+- `env.yaml` - Environment variables (WG_HOST, PASSWORD_HASH, etc.)
+- `mail-accounts.yaml` - Mail server account credentials
+- `wireguard-keys.yaml` - WireGuard private keys
+- `ssh-keys.yaml` - SSH private keys (mail.private, etc.)