add sj-bm-hostkey0, bump steveej-t14, rework NIX_PATH and zsh

.sops.yaml

@@ -3,6 +3,7 @@
 # Also see https://github.com/Mic92/dotfiles/blob/master/nixos/.sops.yaml
 # for a more complex example.
 
+# use `ssh-keyscan <IP> | ssh-to-age` to get the age key for a remote machine
 keys:
   - &steveej 6F7069FE6B96E894E60EC45C6EEFA706CB17E89B
   - &steveej-t14 age17jxphuql70wjkd84azn62ltx9ky69hyvkac23lm8f2j92lznf9hseqq0vl
@@ -13,6 +14,8 @@ keys:
   - &srv0-dmz0 age13cyvxrd28j68f97q2dwsn62q5dy8tdxtq86ql2dxv2ncwfrf63dsmkj7n3
   # - &router0-dmz0 age1jetxwpmd9hc4crkjtrdle2qxn9dlq7vcmqhfslv0vlxctrk4u3xq8hcvkz
   - &router0-dmz0 age1k7cejd9tqz6a3expd63wkn7kmeawhhrp9vy5vevhjn6eavhdwywqeh7j86
+  - &sj-bm-hostkey0 age19dh6zurkx4xv6dx9lvjw0hychjjqvpcf6aq2s2y8srdk6g82qctqqkmu3v
+
 creation_rules:
   - path_regex: ^(.+/|)secrets/[^/]+$
     key_groups:
@@ -27,6 +30,7 @@ creation_rules:
       - *router0-dmz0
 
       - *sj-vps-htz0
+      - *sj-bm-hostkey0
   - path_regex: ^secrets/steveej-t14/.+$
     key_groups:
     - pgp:
@@ -62,4 +66,10 @@ creation_rules:
     - pgp:
       - *steveej
       age:
-      - *sj-vps-htz0
+      - *sj-vps-htz0
+  - path_regex: ^secrets/sj-bm-hostkey0/.+$
+    key_groups:
+    - pgp:
+      - *steveej
+      age:
+      - *sj-bm-hostkey0