docs: show more clearly how to update secret keys

doc/adding-a-host.md

@@ -25,4 +25,4 @@ to add a host:
   - instructions in hosts/common/secrets.nix
   - run `ssh-to-age` on user/host pubkeys
   - add age key to .sops.yaml
-  - update encrypted secrets: `sops updatekeys path/to/secret.yaml`
+  - update encrypted secrets: `find secrets -type f -exec sops updatekeys '{}' ';'`

hosts/common/secrets.nix

@@ -14,9 +14,9 @@
 #   since we specify ssh pubkeys in the nix config, you can just grep for `ssh-ed25519` here and use those instead
 #
 # for each host you want to decrypt secrets:
-#   $ cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age
+#   $ cat /etc/ssh/ssh_host_keys/ssh_host_ed25519_key.pub | ssh-to-age
 #   add the result to .sops.yaml
-#   $ sops updatekeys secrets/example.yaml
+#   $ find secrets -type f -exec sops updatekeys '{}' ';'
 #
 # to create a new secret:
 #   $ sops secrets/example.yaml