beatzaplenty/nixos
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
545 Commits 70 Branches 0 Tags
0c29c6a93d11aa5cc8ef360469481e7956d8a48c
Commit Graph
19 Commits
Author SHA1 Message Date
beatzaplenty 0a2298b0e2 update flake.lock
Check NixOS configurations / eval-hosts (push) Successful in 10m21s
Details
2026-07-21 23:48:06 +00:00
beatzaplentyandClaude Sonnet 5 71d052e737 Migrate live secrets to sops-nix (Milestone 2) 
Audited the working tree and full git history for committed secrets
(gitleaks + trufflehog + manual grep, see secrets-inventory.md, kept
local/gitignored per the spec). Found: a password hash shared by root
and the nixos user across every host, two live Beszel monitoring
tokens, and a GitHub fine-grained PAT embedded in a home-manager
nix.conf.

Migrates all of them to sops-nix:
- .sops.yaml + secrets/*.yaml, encrypted for admin + the age keys
  derived (via ssh-to-age) from each live host's existing SSH host
  key — no new key material transferred to any machine.
- users.users.{root,nixos}.hashedPasswordFile replaces the inline
  hashedPassword shared by every target.
- The GitHub PAT moves from a home-manager-managed, store-visible
  nix.conf to a sops.templates-rendered file included via nix.conf's
  native !include, system-wide instead of per-user.
- Beszel TOKEN moves from `environment` (store-visible) to
  `environmentFile` (runtime-only via sops.templates); the dead
  commented-out docker token is removed from the tree entirely.

Added a tracked pre-commit hook (gitleaks protect --staged, wired via
core.hooksPath) so a secret can't be committed by accident again, and
documented the sops workflow in README.md.

Structural verification only: all 17 flake targets evaluate, and
`nix build --dry-run --no-link` succeeds for the three currently
deployed hosts. Per CLAUDE.md, actual `nixos-rebuild switch` — the
step that confirms secrets decrypt and services start on a real
machine — is left for manual verification.

Git history still contains the original plaintext secrets; scrubbing
history (Milestone 3) and rotating every credential (Milestone 4) are
separate, deliberately gated steps per remove-sensetive-info-refactor.md.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
 2026-07-19 12:46:39 +10:00
beatzaplenty 5dc41e2866 added disko configuration to remove disk formatting from auto installer 2026-07-15 07:30:32 +10:00
beatzaplenty e577fda538 updated flake.lock 2026-07-13 19:44:35 +10:00
beatzaplenty 1788faf093 updated flake.lock 2026-07-13 01:45:44 +10:00
beatzaplenty bd117a8dd5 added tailscale exit node module and enabled on server 2026-07-08 12:48:52 +10:00
gitea-actions 258d471b21 chore: update flake.lock 2026-07-06 06:14:46 +00:00
git a2f2af77b6 updated lock file 2026-07-01 13:47:33 +10:00
beatzaplenty 27470bd854 updated flake.lock 2026-06-28 15:32:14 +10:00
git 72b58093b1 update lock file 2026-06-27 13:41:28 +10:00
beatzaplenty 688904321a Update flake.lock 2026-06-27 03:38:55 +00:00
beatzaplenty d424a70110 Update flake.lock.old 2026-06-27 03:12:17 +00:00
gitea-actions 923ac6c178 chore: update flake.lock 2026-06-22 06:13:04 +00:00
gitea-actions 0e29abd0ac chore: update flake.lock 2026-06-01 06:13:00 +00:00
gitea-actions e68b4f8d14 chore: update flake.lock 2026-05-25 06:13:47 +00:00
gitea-actions c47052fc21 chore: update flake.lock 2026-05-21 19:58:06 +00:00
beatz174-bit 5be2bdb170 chore: update flake.lock 2026-05-12 02:58:23 +00:00
beatzaplenty df6515ad6a Update flake.lock 2025-12-16 11:34:53 +00:00
beatzaplenty aa376a2448 Add flake.lock 2025-12-16 10:51:45 +00:00