# secrets.yaml — Sensitive values for your homestak deployment

#

# This file is auto-initialized from secrets.yaml.example during bootstrap.

# Most values are populated automatically — see comments below.

#

# Optional: encrypt with SOPS/age after real secrets exist.

# make encrypt # secrets.yaml -> secrets.yaml.enc

# make decrypt # secrets.yaml.enc -> secrets.yaml

# ── API Tokens ─────────────────────────────────────────

# Auto-generated by 'homestak pve-setup' — no manual setup needed.

# One entry per PVE host, keyed by hostname.

api_tokens: {}

# ── Passwords ──────────────────────────────────────────

# EDIT: VM root password hash (used by cloud-init)

# Generate with: openssl passwd -6

# Leave empty to disable root password login on VMs.

passwords:

vm_root: ""

# ── SSH Keys ───────────────────────────────────────────

# Auto-populated by 'homestak site-init' from the host's SSH key.

# Additional keys can be added manually (key: "ssh-ed25519 AAAA...").

ssh_keys: {}

# ── Auth ───────────────────────────────────────────────

# Signing key for VM provisioning tokens.

# Auto-generated on first use if empty.

auth:

signing_key: ""