9 Commits

Include renames

Author	SHA1	Message	Date
beatzaplentyandClaude Sonnet 5	222a3ced69	Re-encrypt secrets/nix-cache.yaml for current lxc-nix-cache key ... .sops.yaml's &lxc-nix-cache anchor was rotated (commit b3c8145) after today's LXC rebuild, but secrets/nix-cache.yaml was never re-run through sops updatekeys -- it stayed encrypted for the pre-rotation key. Per docs/nix-cache.md and docs/auto-installer.md, sops-nix decrypt failures are silent: cache-priv-key never materialized, nix-serve had nothing to bind its secretKeyFile to and failed to start, and nginx proxy_pass had no upstream -- the 502 Bad Gateway seen from clients. Confirmed the new key matches the currently-deployed host by deriving the age identity from host-keys/lxc-nix-cache_ssh_host_ed25519_key.pub via ssh-to-age and comparing to .sops.yaml. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-20 15:29:34 +00:00
beatzaplenty	17dd00bee1	updated sops keys	2026-07-20 12:27:24 +00:00
root	0e66cdabc9	rotated sops age key	2026-07-20 11:31:25 +00:00
beatzaplentyandClaude Sonnet 5	53b9a64826	Move nix-cache's binary cache signing key into sops ... nix-serve's secretKeyFile was a manual, undocumented-outside-a-comment `nix-store --generate-binary-cache-key` step per host -- easy to miss on a fresh nix-cache instance (as lxc-nix-cache testing just found: systemd fails the unit with EXIT_CREDENTIALS when LoadCredential can't find the source file, which nginx then reports as a 502 from clients). It also can't be regenerated per-host safely: modules/nix-cache/client.nix hardcodes every client's trust in one specific public key, so every nix-cache instance has to share the exact same keypair. Sourced from secrets/nix-cache.yaml's new cache-priv-key entry instead, via the same sops-nix pattern every other secret in this repo already uses. Verified the added value derives to the exact public key modules/nix-cache/client.nix already trusts before committing. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot	2026-07-20 09:49:30 +10:00
beatzaplentyandClaude Sonnet 5	559c538a3d	Register sops age key for proxmox-minimal ... Adds the proxmox-minimal host's age key (derived from its SSH host key via scripts/prepare-host-key.sh) as a recipient in .sops.yaml and re-encrypts secrets/common.yaml for it via sops updatekeys. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot	2026-07-20 07:01:56 +10:00
beatzaplenty	ff695c1917	added lxc-nix-cache key	2026-07-19 17:22:20 +10:00
beatzaplenty	fa2a9a595e	updated sops keys	2026-07-19 16:59:44 +10:00
beatzaplenty	3c3c5ae821	updated sops keys	2026-07-19 15:06:59 +10:00
beatzaplentyandClaude Sonnet 5	71d052e737	Migrate live secrets to sops-nix (Milestone 2) ... Audited the working tree and full git history for committed secrets (gitleaks + trufflehog + manual grep, see secrets-inventory.md, kept local/gitignored per the spec). Found: a password hash shared by root and the nixos user across every host, two live Beszel monitoring tokens, and a GitHub fine-grained PAT embedded in a home-manager nix.conf. Migrates all of them to sops-nix: - .sops.yaml + secrets/*.yaml, encrypted for admin + the age keys derived (via ssh-to-age) from each live host's existing SSH host key — no new key material transferred to any machine. - users.users.{root,nixos}.hashedPasswordFile replaces the inline hashedPassword shared by every target. - The GitHub PAT moves from a home-manager-managed, store-visible nix.conf to a sops.templates-rendered file included via nix.conf's native !include, system-wide instead of per-user. - Beszel TOKEN moves from `environment` (store-visible) to `environmentFile` (runtime-only via sops.templates); the dead commented-out docker token is removed from the tree entirely. Added a tracked pre-commit hook (gitleaks protect --staged, wired via core.hooksPath) so a secret can't be committed by accident again, and documented the sops workflow in README.md. Structural verification only: all 17 flake targets evaluate, and `nix build --dry-run --no-link` succeeds for the three currently deployed hosts. Per CLAUDE.md, actual `nixos-rebuild switch` — the step that confirms secrets decrypt and services start on a real machine — is left for manual verification. Git history still contains the original plaintext secrets; scrubbing history (Milestone 3) and rotating every credential (Milestone 4) are separate, deliberately gated steps per remove-sensetive-info-refactor.md. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-19 12:46:39 +10:00