7 Commits

Include renames

Author	SHA1	Message	Date
beatzaplentyandClaude Sonnet 5	f55e33b807	Migrate host-key tooling from nix-auto-installer, bake keys into images ... Finishes the nix-auto-installer migration: scripts/prepare-host-key.sh and the local host-keys/ directory (gitignored, private key material, never committed — moved as plain files, not through git history) weren't carried over in the initial migration. Also implements automatic key staging, replacing the manual scp-after-boot step: - modules/installer/host-keys.nix reads host-keys/ via builtins.getEnv, which Nix silently returns as "" under normal (non---impure) evaluation — the module is a no-op by default, safe for CI, until explicitly opted into: NIXOS_HOST_KEYS_DIR=$(pwd)/host-keys nix build .#iso --impure When built this way every key present gets baked into the image at /etc/host-keys/, and auto-install.sh installs whichever one matches the flake target selected at install time — no manual per-host scp. - This deliberately includes the PXE netboot variant, even though pxe-boot serves it unauthenticated over LAN HTTP: accepted explicitly as a reasonable trade-off for a network that sits behind LAN-only infrastructure, not the open internet. auto-install.sh still falls back to /root/host-keys (manual scp) if a key isn't baked in, so images built without --impure keep working exactly as before. - docs/auto-installer.md replaces nix-auto-installer's README, updated for in-repo paths and the new build flow. Verified: normal `nix eval` (no --impure) evaluates identically across all 19 nixosConfigurations + 4 packages with zero host-keys/* entries (CI-unaffected); with --impure + the env var set, all three installer variants (installer/ISO, proxmox-lxc, pxe) correctly embed every key in host-keys/. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot	2026-07-20 04:41:34 +10:00
beatzaplentyandClaude Sonnet 5	2f7831aea8	Migrate live secrets to sops-nix (Milestone 2) ... Audited the working tree and full git history for committed secrets (gitleaks + trufflehog + manual grep, see secrets-inventory.md, kept local/gitignored per the spec). Found: a password hash shared by root and the nixos user across every host, two live Beszel monitoring tokens, and a GitHub fine-grained PAT embedded in a home-manager nix.conf. Migrates all of them to sops-nix: - .sops.yaml + secrets/*.yaml, encrypted for admin + the age keys derived (via ssh-to-age) from each live host's existing SSH host key — no new key material transferred to any machine. - users.users.{root,nixos}.hashedPasswordFile replaces the inline hashedPassword shared by every target. - The GitHub PAT moves from a home-manager-managed, store-visible nix.conf to a sops.templates-rendered file included via nix.conf's native !include, system-wide instead of per-user. - Beszel TOKEN moves from `environment` (store-visible) to `environmentFile` (runtime-only via sops.templates); the dead commented-out docker token is removed from the tree entirely. Added a tracked pre-commit hook (gitleaks protect --staged, wired via core.hooksPath) so a secret can't be committed by accident again, and documented the sops workflow in README.md. Structural verification only: all 17 flake targets evaluate, and `nix build --dry-run --no-link` succeeds for the three currently deployed hosts. Per CLAUDE.md, actual `nixos-rebuild switch` — the step that confirms secrets decrypt and services start on a real machine — is left for manual verification. Git history still contains the original plaintext secrets; scrubbing history (Milestone 3) and rotating every credential (Milestone 4) are separate, deliberately gated steps per remove-sensetive-info-refactor.md. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-19 12:46:39 +10:00
beatzaplenty	ec82189d47	modified: .gitignore	2025-07-21 01:47:56 +10:00
beatzaplenty	fb73fe70cd	modified: .gitignore	2025-07-21 00:53:34 +10:00
beatzaplenty	b0dd745a03	modified: .gitignore	2025-07-21 00:14:59 +10:00
beatzaplenty	be3012a65a	modified: .gitignore	2025-07-21 00:13:55 +10:00
beatzaplenty	dccd499d3e	Initial commit	2025-07-16 03:22:31 +00:00