- name: Ensure /etc/sops exists
  file:
    path: /etc/sops
    state: directory
    owner: root
    group: root
    mode: "0700"

- name: Upload age key
  copy:
    src: files/age.key
    dest: /etc/sops/age.key
    owner: root
    group: root
    mode: "0600"