beatzaplenty/nixos
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(ha): wire sops secrets and disable NetworkManager for HA servers

Browse Source 
- cluster-config.nix: add corosync_authkey sops binary secret
  (/etc/corosync/authkey, mode 0400) and force-disable NetworkManager
  (common config enables it; HA nodes need stable static IP networking)
- hosts/ha-server-{1,2}/host.nix: add host-token.nix import for
  sops-managed beszel-token; add KEY placeholder for beszel hub pairing
- .sops.yaml: add creation rules for secrets/ha-server-{1,2}.yaml and
  secrets/ha-corosync-authkey (admin-only until sync-host-keys.sh runs)
- secrets/ha-server-{1,2}.yaml, secrets/ha-corosync-authkey: stub files
  so eval passes before real secrets are provisioned

Bootstrap order (post-merge):
  1. bash scripts/secrets/sync-host-keys.sh proxmox-ha-server-1
  2. bash scripts/secrets/sync-host-keys.sh proxmox-ha-server-2
  3. sops updatekeys secrets/common.yaml  (grants HA nodes common secrets)
  4. sops secrets/ha-server-{1,2}.yaml   (set beszel-token values)
  5. On node1: corosync-keygen; sops -e --input-type binary
     /etc/corosync/authkey > secrets/ha-corosync-authkey; git add/commit

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HaH1cSGvhogRP5ExoF6nD8
This commit is contained in:
beatzaplenty
2026-07-27 11:45:36 +10:00
co-authored by Claude Sonnet 4.6
parent e3498b1087
commit 5856d45575
7 changed files with 76 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/ha-server-2/host.nix
+9 -7
View File
@@ -1,5 +1,12 @@
{ vars, ... }:
{
imports = [
(import ../../modules/beszel/host-token.nix {
name = "ha-server-2";
sopsFile = ../../secrets/ha-server-2.yaml;
})
];
networking = {
hostName = vars.haServer2Host;
hostId = "7e8f9a0b";
@@ -12,13 +19,8 @@
nameservers = [ "192.168.2.1" "8.8.8.8" ];
};
# TODO: after running `bash scripts/secrets/sync-host-keys.sh proxmox-ha-server-2`
# add beszel agent pairing and sops-managed corosync authkey:
# imports = [ (import ../../modules/beszel/host-token.nix {
# name = "ha-server-2";
# sopsFile = ../../secrets/ha-server-2.yaml;
# }) ];
# services.beszel.agent.environment.KEY = "...";
# Set KEY after pairing this host with the beszel hub; the token is sops-managed.
services.beszel.agent.environment.KEY = "";
system.stateVersion = "26.05";
}