{{- $osFamily := "unknown" -}}
{{- $idLike := "" -}}
{{- if hasKey .chezmoi.osRelease "idLike" -}}
  {{- $idLike = .chezmoi.osRelease.idLike -}}
{{- end -}}
{{- if or (eq .chezmoi.osRelease.id "arch") (contains "arch" $idLike) -}}
  {{- $osFamily = "arch" -}}
{{- else if or (eq .chezmoi.osRelease.id "debian") (contains "debian" $idLike) -}}
  {{- $osFamily = "debian" -}}
{{- end -}}
encryption: "age"
sourceDir: {{ .chezmoi.sourceDir | quote }}

# age config — see https://www.chezmoi.io/user-guide/encryption/age/
#
# To bootstrap age on a new box:
#   1. Generate a recovery key (offline, store secret in password manager):
#        age-keygen -o ~/.config/chezmoi/keys/recovery.key
#      Add the printed public key below as a recipient.
#   2. Generate a per-machine key on each box:
#        age-keygen -o ~/.config/chezmoi/key.txt
#      Add its public key below, then `chezmoi age rekey` to rewrite *.age files.
#
# To encrypt a new secret:
#   echo 'secret' | chezmoi encrypt --output private_dot_.../<name>.age
#
# To decrypt (auto, on apply):
#   chezmoi uses ~/.config/chezmoi/key.txt (per-machine) by default.

age:
    identity: "~/.config/chezmoi/key.txt"

    # Multiple recipients: every listed recipient can decrypt every *.age file.
    # Add a new recipient by pasting their public key below, then
    # `chezmoi age rekey` to rewrite existing files with the new recipient.
    recipients:
        # Recovery key — secret stored offline (password manager, USB stick).
        # Don't lose this: it's the only way to recover secrets if every
        # machine key is lost.
        - age1yyq42ctqwp5s5yd64week3aav9getk3p8aeyr5n5454d0v59a4dsjljsgs

        # Per-machine keys — one per box. Generate on the box itself with
        # `age-keygen -o ~/.config/chezmoi/key.txt`, paste its public key
        # here, then `chezmoi age rekey`.
        - age1eja7trs8mmsgf0qga0h5fsdltaryxgk4ksumshar5xxtdx0exy3q0a5hc5  # miche (Strix Halo GPU host)
        # - age1byte_pubkey_placeholder                                 # byte (CachyOS laptop)
        # - age1kaiser_pubkey_placeholder                              # kaiser (services host)
        # - age1rye_pubkey_placeholder                                 # rye (Debian Pi)
        # - age1crouton_pubkey_placeholder                             # crouton (Debian Pi)

data:
    os_family: {{ $osFamily | quote }}
    os_id: {{ .chezmoi.osRelease.id | quote }}