beatzaplenty/nixos
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add scripts/rotate-admin-key.sh to automate sops admin key rotation #10

Merged
beatzaplenty merged 2 commits from worktree-rotate-admin-key-script into main 2026-07-20 11:28:33 +00:00
Conversation 0 Commits 2 Files Changed 2
+208 -6
beatzaplenty commented 2026-07-20 11:27:19 +00:00
Owner
Copy Link
Copy Source

Automates the manual steps sync-host-keys.sh/create-proxmox-resource.sh
print when they bootstrap a fresh, not-yet-trusted age key: verifies a
backed-up key matches the current &admin entry, swaps in a new key, and
re-encrypts every secrets/*.yaml. Explicitly cds into repo_root before any
sops call, since sops resolves .sops.yaml by walking up from cwd rather
than from the target file's path -- confirmed via a scratch-repo test that
running from elsewhere would otherwise silently rotate against the wrong
config.

Co-Authored-By: Claude Sonnet 5 noreply@anthropic.com

Automates the manual steps sync-host-keys.sh/create-proxmox-resource.sh print when they bootstrap a fresh, not-yet-trusted age key: verifies a backed-up key matches the current &admin entry, swaps in a new key, and re-encrypts every secrets/*.yaml. Explicitly cds into repo_root before any sops call, since sops resolves .sops.yaml by walking up from cwd rather than from the target file's path -- confirmed via a scratch-repo test that running from elsewhere would otherwise silently rotate against the wrong config. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
beatzaplenty added 1 commit 2026-07-20 11:27:26 +00:00
Add scripts/rotate-admin-key.sh to automate sops admin key rotation
Check NixOS configurations / eval-hosts (pull_request) Failing after 11m15s
Details
cafeb8853b 
Automates the manual steps sync-host-keys.sh/create-proxmox-resource.sh
print when they bootstrap a fresh, not-yet-trusted age key: verifies a
backed-up key matches the current &admin entry, swaps in a new key, and
re-encrypts every secrets/*.yaml. Explicitly cds into repo_root before any
sops call, since sops resolves .sops.yaml by walking up from cwd rather
than from the target file's path -- confirmed via a scratch-repo test that
running from elsewhere would otherwise silently rotate against the wrong
config.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
beatzaplenty added 1 commit 2026-07-20 11:27:57 +00:00
Merge branch 'main' into worktree-rotate-admin-key-script
Check NixOS configurations / eval-hosts (pull_request) Failing after 1h6m12s
Details
bfeea90597
beatzaplenty merged commit 9c892ce1c2 into main 2026-07-20 11:28:33 +00:00
This repo is archived. You cannot comment on pull requests.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
beatzaplenty
No Assignees
1 Participants
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: beatzaplenty/nixos#10