clan.core.sops.defaultGroups to all machines

machines/control/configuration.nix

@@ -14,6 +14,8 @@ in
     ../../modules/docs.nix
   ];
 
+  clan.core.sops.defaultGroups = [ "admins" ];
+
   # Public IPv6 (from modules/hosts.nix); SLAAC doesn't bring it up here.
   cnx.staticIPv6 = {
     enable = true;

machines/gw-cnx-1/configuration.nix

@@ -8,6 +8,8 @@
     ../../modules/monitoring/exporters.nix
   ];
 
+  clan.core.sops.defaultGroups = [ "admins" ];
+
   # Until the install generates facter.json (which normally provides this).
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
 

machines/mx1/configuration.nix

@@ -10,6 +10,8 @@ in
     ../../modules/monitoring/exporters.nix
   ];
 
+  clan.core.sops.defaultGroups = [ "admins" ];
+
   # Public IPv6 (from modules/hosts.nix); SLAAC doesn't bring it up here.
   cnx.staticIPv6 = {
     enable = true;

machines/ns1/configuration.nix

@@ -18,6 +18,8 @@ in
     ../../modules/monitoring/exporters.nix
   ];
 
+  clan.core.sops.defaultGroups = [ "admins" ];
+
   # Knot's state dir holds the non-regenerable DNSSEC key material (KSK/ZSK
   # private keys in the KASP keystore). Declaring it as clan state makes the
   # borgbackup client back it up; losing it forces an emergency DS rollover at

machines/ns2/configuration.nix

@@ -10,6 +10,8 @@ in
     ../../modules/monitoring/exporters.nix
   ];
 
+  clan.core.sops.defaultGroups = [ "admins" ];
+
   # Public IPv6 (from modules/hosts.nix; matches the ns2 AAAA glue); SLAAC
   # doesn't bring it up here.
   cnx.staticIPv6 = {

machines/web01/configuration.nix

@@ -9,6 +9,8 @@ in
     ../../modules/web-proxy.nix
   ];
 
+  clan.core.sops.defaultGroups = [ "admins" ];
+
   # Public IPv6 (from modules/hosts.nix); SLAAC doesn't bring it up here.
   cnx.staticIPv6 = {
     enable = true;