feat(secrets): add push-host-keys.sh; integrate into sync/recover scripts #53

Merged

beatzaplenty merged 1 commits from worktree-push-host-keys into main 2026-07-25 05:30:33 +00:00

Conversation 0 Commits 1 Files Changed 3

+313 -3

beatzaplenty commented 2026-07-25 05:30:29 +00:00

Owner

Copy Link

Copy Source

New script: scripts/secrets/push-host-keys.sh

• Pushes newly-generated SSH host keys from host-keys/ to already-running
  NixOS hosts after sync-host-keys.sh --regenerate-all-keys.
• Before pushing any key, checks that .sops.yaml and secrets/*.yaml are
  committed and pushed to the remote Gitea flake (hosts rebuild from there,
  so recipient changes must land first); offers to auto-commit/push if not.
• Reads /etc/flake-target from each host to confirm which key to install,
  handling the case where multiple flake targets share a hostname.
• Deduplicates by hostname in --all mode; skips hand-registered targets
  that have no host-keys/ entry.
• --dry-run, --skip-git-check, SSH_USER override (default: nixos).

sync-host-keys.sh --regenerate-all-keys:

• Updated pre-confirmation warning to distinguish already-running hosts
  (need push-host-keys.sh) from not-yet-deployed hosts (need installer
  image rebuild).
• Added next-steps block after regeneration completes pointing to
  push-host-keys.sh --all.

recover-hosts.sh:

• Header and SSH host key mismatch warn now cross-reference
  push-host-keys.sh as the proactive (pre-drift) alternative.

Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com

New script: scripts/secrets/push-host-keys.sh - Pushes newly-generated SSH host keys from host-keys/ to already-running NixOS hosts after sync-host-keys.sh --regenerate-all-keys. - Before pushing any key, checks that .sops.yaml and secrets/*.yaml are committed and pushed to the remote Gitea flake (hosts rebuild from there, so recipient changes must land first); offers to auto-commit/push if not. - Reads /etc/flake-target from each host to confirm which key to install, handling the case where multiple flake targets share a hostname. - Deduplicates by hostname in --all mode; skips hand-registered targets that have no host-keys/ entry. - --dry-run, --skip-git-check, SSH_USER override (default: nixos). sync-host-keys.sh --regenerate-all-keys: - Updated pre-confirmation warning to distinguish already-running hosts (need push-host-keys.sh) from not-yet-deployed hosts (need installer image rebuild). - Added next-steps block after regeneration completes pointing to push-host-keys.sh --all. recover-hosts.sh: - Header and SSH host key mismatch warn now cross-reference push-host-keys.sh as the proactive (pre-drift) alternative. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

beatzaplenty added 1 commit 2026-07-25 05:30:29 +00:00

feat(secrets): add push-host-keys.sh; integrate into sync/recover scripts ... d74efd9f66

New script: scripts/secrets/push-host-keys.sh
- Pushes newly-generated SSH host keys from host-keys/ to already-running
  NixOS hosts after sync-host-keys.sh --regenerate-all-keys.
- Before pushing any key, checks that .sops.yaml and secrets/*.yaml are
  committed and pushed to the remote Gitea flake (hosts rebuild from there,
  so recipient changes must land first); offers to auto-commit/push if not.
- Reads /etc/flake-target from each host to confirm which key to install,
  handling the case where multiple flake targets share a hostname.
- Deduplicates by hostname in --all mode; skips hand-registered targets
  that have no host-keys/ entry.
- --dry-run, --skip-git-check, SSH_USER override (default: nixos).

sync-host-keys.sh --regenerate-all-keys:
- Updated pre-confirmation warning to distinguish already-running hosts
  (need push-host-keys.sh) from not-yet-deployed hosts (need installer
  image rebuild).
- Added next-steps block after regeneration completes pointing to
  push-host-keys.sh --all.

recover-hosts.sh:
- Header and SSH host key mismatch warn now cross-reference
  push-host-keys.sh as the proactive (pre-drift) alternative.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

beatzaplenty merged commit 7a2b5ecf71 into main 2026-07-25 05:30:33 +00:00

This repo is archived. You cannot comment on pull requests.

Reviewers

No Reviewers

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

beatzaplenty

No Assignees

1 Participants

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: beatzaplenty/nixos#53