feat(nixos): add zeus SSH configuration

configs/nixos/.sops.yaml

@@ -7,28 +7,36 @@ keys:
   - &admin age1m0pk94ysjlw3lmf6pyuv5l5pepvdjss8w0vxjv90dq6ndp02tdgsdwdvue
   # Generated on the machine it names.
   - &neogaia age14a04vphzjq74epfrz9a09wjw8lzchtru84awzuq2n45d8f42ychqjs89qe
+  - &zeus age199atsykyh0hp0yuxymznxs0mqv4ram9ttaddk6jrsjjc43rmvu7snh9dq8
   - &pikachu age1wf5s0n0tgt6ld2ysgu9dc67mj8ylwecgl4utzg7hqwy3kut9zyms7aglmh
 
 creation_rules:
   # Material belonging to one machine.
   # No machine other than the one named is a recipient, so a host that is
   # compromised cannot decrypt another's material.
-  - path_regex: configs/nixos/secrets/neogaia\.yaml$
+  - path_regex: secrets/neogaia\.yaml$
     key_groups:
       - age:
           - *admin
           - *neogaia
 
-  - path_regex: configs/nixos/secrets/pikachu\.yaml$
+  - path_regex: secrets/zeus\.yaml$
+    key_groups:
+      - age:
+          - *admin
+          - *zeus
+
+  - path_regex: secrets/pikachu\.yaml$
     key_groups:
       - age:
           - *admin
           - *pikachu
 
   # Material common to every machine, so it is stored once rather than per host.
-  - path_regex: configs/nixos/secrets/shared\.yaml$
+  - path_regex: secrets/shared\.yaml$
     key_groups:
       - age:
           - *admin
           - *neogaia
+          - *zeus
           - *pikachu