6 Commits

Include renames

Author	SHA1	Message	Date
beatzaplentyandClaude Sonnet 4.6	2df53fd5d7	chore(secrets): Phase 4 — remove stale sops.yaml anchors and re-encrypt ... Remove four stale age key anchors from .sops.yaml that correspond to non-lxc build-type variants that were never deployed (or are now superseded by their lxc-* counterparts): &docker → superseded by &lxc-docker (active running host) &server → superseded by &lxc-server (active running host) &nix-cache → superseded by &lxc-nix-cache (active running host) &nix-minimal → superseded by &lxc-minimal (active running host) Also remove the secrets/docker.yaml creation_rules block entirely since that file does not exist. Re-encrypt secrets/common.yaml, secrets/nix-cache.yaml, and secrets/server.yaml with sops updatekeys to drop the stale recipients. The four removed keys can no longer decrypt these files. Update README.md and CLAUDE.md to clarify that deployed lxc-* hosts now use clan vars (vars/per-machine/<target>/openssh/) rather than the gitignored host-keys/ directory. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01B2EJ4qTsM5KUqhS5c3GAwx	2026-07-25 21:31:56 +10:00
beatzaplenty	c329988cdd	secrets: update recipients and re-encrypt for host key changes	2026-07-25 15:31:22 +10:00
beatzaplenty	82eea7f088	synced all keys	2026-07-24 08:17:34 +10:00
beatzaplenty	1004538f00	updated sops secrets	2026-07-21 20:07:14 +00:00
root	0e66cdabc9	rotated sops age key	2026-07-20 11:31:25 +00:00
beatzaplentyandClaude Sonnet 5	71d052e737	Migrate live secrets to sops-nix (Milestone 2) ... Audited the working tree and full git history for committed secrets (gitleaks + trufflehog + manual grep, see secrets-inventory.md, kept local/gitignored per the spec). Found: a password hash shared by root and the nixos user across every host, two live Beszel monitoring tokens, and a GitHub fine-grained PAT embedded in a home-manager nix.conf. Migrates all of them to sops-nix: - .sops.yaml + secrets/*.yaml, encrypted for admin + the age keys derived (via ssh-to-age) from each live host's existing SSH host key — no new key material transferred to any machine. - users.users.{root,nixos}.hashedPasswordFile replaces the inline hashedPassword shared by every target. - The GitHub PAT moves from a home-manager-managed, store-visible nix.conf to a sops.templates-rendered file included via nix.conf's native !include, system-wide instead of per-user. - Beszel TOKEN moves from `environment` (store-visible) to `environmentFile` (runtime-only via sops.templates); the dead commented-out docker token is removed from the tree entirely. Added a tracked pre-commit hook (gitleaks protect --staged, wired via core.hooksPath) so a secret can't be committed by accident again, and documented the sops workflow in README.md. Structural verification only: all 17 flake targets evaluate, and `nix build --dry-run --no-link` succeeds for the three currently deployed hosts. Per CLAUDE.md, actual `nixos-rebuild switch` — the step that confirms secrets decrypt and services start on a real machine — is left for manual verification. Git history still contains the original plaintext secrets; scrubbing history (Milestone 3) and rotating every credential (Milestone 4) are separate, deliberately gated steps per remove-sensetive-info-refactor.md. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-19 12:46:39 +10:00