sensor.example.yaml

---
# Template for secrets/sensor.sops.yaml.
#
# ONE KEY: fenrir's token for the lab's ingest proxy on alexander (#834). Until
# then this stack had no secrets at all and was brought up without
# `make render`. It still holds nothing else: Zeek reads the mirror, and Alloy
# pushes what it collects to alexander.
#
# ---------------------------------------------------------------------------
# Create this ON FENRIR, not on the monitoring host or alexander
# ---------------------------------------------------------------------------
#
#   make secrets-init STACK=sensor    # first time only — creates the age keypair
#   make secrets-edit STACK=sensor    # opens the encrypted file in $EDITOR
#
# secrets-init writes fenrir's public key into the `sensor` rule in .sops.yaml,
# its own rule above the catch-all, so the sensor's host opens the sensor's
# secret and nothing else (ADR-0007, and ADR-0020 for the shape). It refuses if
# the key it would write is already a recipient of another rule.

# Not generated here: copy INGEST_TOKEN_FENRIR out of secrets/lab.sops.yaml on
# alexander. This stack's Alloy sends it on every push to 10.0.30.40.
INGEST_TOKEN: copy-INGEST_TOKEN_FENRIR-from-secrets-lab-sops-yaml