# Secrets

This directory contains encrypted secrets managed with sops-nix.

## Setup

1. Generate an age key on the target machine:
   ```
   mkdir -p /etc/age
   age-keygen -o /etc/age/keys.txt
   ```

2. Add the public key to `.sops.yaml`

3. Create/edit secrets:
   ```
   sops secrets/mail-accounts.yaml
   sops secrets/env.yaml
   ```

## Files

- `env.yaml` - Environment variables (WG_HOST, PASSWORD_HASH, etc.)
- `mail-accounts.yaml` - Mail server account credentials
- `wireguard-keys.yaml` - WireGuard private keys
- `ssh-keys.yaml` - SSH private keys (mail.private, etc.)