Add scripts/rotate-admin-key.sh to automate sops admin key rotation #10

Merged

beatzaplenty merged 2 commits from worktree-rotate-admin-key-script into main

2026-07-20 11:28:33 +00:00

Author	SHA1	Message	Date
beatzaplenty	bfeea90597	Merge branch 'main' into worktree-rotate-admin-key-script Check NixOS configurations / eval-hosts (pull_request) Failing after 1h6m12s Details	2026-07-20 11:27:45 +00:00
rootandClaude Sonnet 5	cafeb8853b	Add scripts/rotate-admin-key.sh to automate sops admin key rotation Check NixOS configurations / eval-hosts (pull_request) Failing after 11m15s Details Automates the manual steps sync-host-keys.sh/create-proxmox-resource.sh print when they bootstrap a fresh, not-yet-trusted age key: verifies a backed-up key matches the current &admin entry, swaps in a new key, and re-encrypts every secrets/*.yaml. Explicitly cds into repo_root before any sops call, since sops resolves .sops.yaml by walking up from cwd rather than from the target file's path -- confirmed via a scratch-repo test that running from elsewhere would otherwise silently rotate against the wrong config. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-20 11:23:33 +00:00

Author

SHA1

Message

Date

beatzaplenty

bfeea90597

Merge branch 'main' into worktree-rotate-admin-key-script

Check NixOS configurations / eval-hosts (pull_request) Failing after 1h6m12s

Details

2026-07-20 11:27:45 +00:00

rootandClaude Sonnet 5

cafeb8853b

Add scripts/rotate-admin-key.sh to automate sops admin key rotation

Check NixOS configurations / eval-hosts (pull_request) Failing after 11m15s

Details

Automates the manual steps sync-host-keys.sh/create-proxmox-resource.sh
print when they bootstrap a fresh, not-yet-trusted age key: verifies a
backed-up key matches the current &admin entry, swaps in a new key, and
re-encrypts every secrets/*.yaml. Explicitly cds into repo_root before any
sops call, since sops resolves .sops.yaml by walking up from cwd rather
than from the target file's path -- confirmed via a scratch-repo test that
running from elsewhere would otherwise silently rotate against the wrong
config.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-07-20 11:23:33 +00:00