Master Keys

Stackpanel still uses AGE keys, but it does not create a separate cryptographic keypair per recipient group.

What Exists Now

• Your machine gets a local AGE key on shell entry.
• Shared recipients are configured in Nix and rendered into .stack/secrets/.sops.yaml.
• Recipient groups are config-time expansions in creation rules; they are not separate encrypted group keys.
• SOPS files are encrypted directly to the resolved recipients (and optionally KMS).

Local Key Flow

1. Enter the devshell.
2. Stackpanel generates your local key if it does not exist yet.
3. Add your public key in stackpanel.secrets.recipients or stackpanel.users.

Rekeying

When recipients or creation rules change, re-encrypt the SOPS files directly:

.stack/secrets/bin/rekey.sh

This command must be run by someone who can already decrypt the current vars/*.sops.yaml files.