2026-07-20 11:28:33 +00:00
5 changed files with 36 additions and 15 deletions
@@ -7,7 +7,7 @@ servers and workstation.
 The flake exposes NixOS configurations named `<platform>-<buildtype>`
 (platforms: `linode`, `proxmox`, `lxc`; build types: `minimal`, `nix-cache`,
-`server`, `docker`, `gui`, `pxe-boot`), generated from `modules/platforms/*`
+`server`, `docker`, `gui`, `pxe-boot`, `tailscale-exit-node`), generated from `modules/platforms/*`
 and `modules/build-types/*` by the `mkTarget` function in `flake.nix`. Not
 every combination is built — `pxe-boot` has no `linode` variant. See
 `README.md` for the full current target list; treat `flake.nix` as the
@@ -62,8 +62,9 @@ There is no test suite — "correctness" here means the flake evaluates and
 sweeps: after editing one or two hosts/modules, evaluate just the
 `nixosConfigurations.<host>` you touched (plus any `config.system.build.tarball`
 /`diskoImagesScript`/package output affected) rather than looping over every
-host — `codex-maintenance.sh` evaluates 18 hosts plus every package/tarball/
+host — `codex-maintenance.sh` evaluates every `nixosConfigurations` host plus
-image variant now and is slow to run after each small change. Reserve a full
+every package/tarball/image variant and is slow to run after each small
 change. Reserve a full
 `codex-maintenance.sh` run for changes that plausibly affect every host
 (`modules/common/*`, `flake.nix`, `variables.nix`) or as a final check before
 committing. This is a session-workflow preference only — it does not apply to
@@ -176,7 +177,7 @@ removing a host.
  `vzdump` backup-archive metadata this doesn't have), no install step —
  see `docs/auto-installer.md`.
 - `modules/build-types/*.nix` — what a system is for:
-  minimal/server/docker/gui/pxe-boot/nix-cache.
+  minimal/server/docker/gui/pxe-boot/nix-cache/tailscale-exit-node.
 - `modules/common/configuration.nix` — base NixOS config imported by every
  host: locale, users, nix settings, git.
 - `modules/common/home.nix` / `hosts/nixos/home.nix` — Home Manager config for
@@ -19,7 +19,7 @@ see "LXC hosts" immediately below for why those are different.**
 ## LXC hosts
 `lxc-*` targets (`lxc-minimal`, `lxc-nix-cache`, `lxc-server`, `lxc-docker`,
-`lxc-gui`, `lxc-pxe-boot`) are **not** installed via `auto-install.sh` — the
+`lxc-gui`, `lxc-pxe-boot`, `lxc-tailscale-exit-node`) are **not** installed via `auto-install.sh` — the
 interactive menu deliberately excludes them. Don't try to select one there;
 `nixos-install` would bind-mount `/` onto `/mnt` (LXC containers have no raw
 disk to partition) and then refuse to touch the filesystem it's currently
@@ -1,5 +1,13 @@
 # Spec: Refactor Flake Targets into Platform × Build-Type Matrix
 **Status: implemented.** `flake.nix`'s `generatedTargets`/`mkTarget` and
 `modules/platforms/*`/`modules/build-types/*` are the result of this spec —
 kept here for historical rationale only (referenced from `CLAUDE.md`'s
 "Composition pattern" section), not as an active or open plan. The "Open
 Questions" below were resolved during implementation; don't treat them as
 outstanding. A `tailscale-exit-node` build type was added later, beyond this
 spec's original scope.
 ## Context
 The flake at `~/nixos` currently defines these output targets (flat, ad-hoc naming):
@@ -122,13 +122,25 @@ Add a pre-commit hook (or a `nix flake check` step) running `gitleaks protect --
 ## Definition of done
- [ ] Milestone 1 inventory complete and reviewed
+**Status as of 2026-07-20:** Milestones 1–3 are done — sops-nix is fully
- [ ] All hosts have per-host age keys; admin key backed up outside the repo
+wired (`.sops.yaml`, `secrets/*.yaml`, referenced via `hashedPasswordFile`/
- [ ] Every inventoried secret migrated to sops-nix, referenced via `*File`/`sops.secrets.*.path`, nothing plaintext in the working tree
+`*File`/`sops.secrets.*.path` throughout), and history has been scrubbed
- [ ] `nixos-rebuild dry-build` and at least one real `switch` verified per host
+with `git-filter-repo` + force-push (this removed a GitHub fine-grained PAT
- [ ] Working-tree scanner sweep clean
+that had been committed in plaintext in `flake.nix`/`common/home.nix`
- [ ] History rewritten with `git-filter-repo`, force-pushed, full-history scanner sweep clean
+between 2025-07-16 and 2026-02-09, later migrated to sops but never scrubbed
- [ ] All other clones deleted and re-cloned from the rewritten history
+from history until now). **Milestone 4 is not confirmed** — whether that PAT
- [ ] Every credential in the original inventory rotated (not just re-encrypted)
+(or any other historically-plaintext credential) was actually rotated, not
- [ ] Pre-commit secret scanning hook added
+just re-encrypted, isn't something this repo can attest to; that's an
- [ ] `secrets-inventory.md` deleted from the working directory (never committed)
+operator action against the issuing service (GitHub, etc.), not a repo
 change. Do that before considering this fully closed.
 - [x] Milestone 1 inventory complete and reviewed
 - [x] All hosts have per-host age keys; admin key backed up outside the repo
 - [x] Every inventoried secret migrated to sops-nix, referenced via `*File`/`sops.secrets.*.path`, nothing plaintext in the working tree
 - [x] `nixos-rebuild dry-build` and at least one real `switch` verified per host
 - [x] Working-tree scanner sweep clean
 - [x] History rewritten with `git-filter-repo`, force-pushed, full-history scanner sweep clean
 - [ ] All other clones deleted and re-cloned from the rewritten history — every clone that existed before 2026-07-20's rewrite (any other machine, WSL instance, or CI checkout) needs this
 - [ ] Every credential in the original inventory rotated (not just re-encrypted) — **the GitHub PAT found in history specifically still needs this**
 - [x] Pre-commit secret scanning hook added (`.githooks/pre-commit`, `gitleaks protect --staged`)
 - [x] `secrets-inventory.md` deleted from the working directory (never committed)