beatzaplenty/nixos
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore(secrets): Phase 4 — remove stale sops.yaml anchors and re-encrypt #60

Merged
beatzaplenty merged 1 commits from worktree-phase0-provision-ordering-fix into main 2026-07-25 11:32:26 +00:00
Conversation 0 Commits 1 Files Changed 6
+170 -232
beatzaplenty commented 2026-07-25 11:32:12 +00:00
Owner
Copy Link
Copy Source

Remove stale &docker, &server, &nix-cache, &nix-minimal anchors from .sops.yaml (superseded by their lxc-* counterparts). Re-encrypt common.yaml, nix-cache.yaml, server.yaml without the stale recipients. Also remove the never-created secrets/docker.yaml creation_rules. Update README.md and CLAUDE.md to reflect clan vars as the primary key storage for deployed lxc-* hosts.

Remove stale &docker, &server, &nix-cache, &nix-minimal anchors from .sops.yaml (superseded by their lxc-* counterparts). Re-encrypt common.yaml, nix-cache.yaml, server.yaml without the stale recipients. Also remove the never-created secrets/docker.yaml creation_rules. Update README.md and CLAUDE.md to reflect clan vars as the primary key storage for deployed lxc-* hosts.
beatzaplenty added 1 commit 2026-07-25 11:32:13 +00:00
chore(secrets): Phase 4 — remove stale sops.yaml anchors and re-encrypt
Check NixOS configurations / eval-hosts (pull_request) Successful in 10m21s
Details
2df53fd5d7 
Remove four stale age key anchors from .sops.yaml that correspond to
non-lxc build-type variants that were never deployed (or are now
superseded by their lxc-* counterparts):

  &docker   → superseded by &lxc-docker (active running host)
  &server   → superseded by &lxc-server (active running host)
  &nix-cache → superseded by &lxc-nix-cache (active running host)
  &nix-minimal → superseded by &lxc-minimal (active running host)

Also remove the secrets/docker.yaml creation_rules block entirely since
that file does not exist.

Re-encrypt secrets/common.yaml, secrets/nix-cache.yaml, and
secrets/server.yaml with sops updatekeys to drop the stale recipients.
The four removed keys can no longer decrypt these files.

Update README.md and CLAUDE.md to clarify that deployed lxc-* hosts
now use clan vars (vars/per-machine/<target>/openssh/) rather than the
gitignored host-keys/ directory.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B2EJ4qTsM5KUqhS5c3GAwx
beatzaplenty added 1 commit 2026-07-25 11:32:13 +00:00
chore(secrets): Phase 4 — remove stale sops.yaml anchors and re-encrypt
Check NixOS configurations / eval-hosts (pull_request) Successful in 10m21s
Details
2df53fd5d7 
Remove four stale age key anchors from .sops.yaml that correspond to
non-lxc build-type variants that were never deployed (or are now
superseded by their lxc-* counterparts):

  &docker   → superseded by &lxc-docker (active running host)
  &server   → superseded by &lxc-server (active running host)
  &nix-cache → superseded by &lxc-nix-cache (active running host)
  &nix-minimal → superseded by &lxc-minimal (active running host)

Also remove the secrets/docker.yaml creation_rules block entirely since
that file does not exist.

Re-encrypt secrets/common.yaml, secrets/nix-cache.yaml, and
secrets/server.yaml with sops updatekeys to drop the stale recipients.
The four removed keys can no longer decrypt these files.

Update README.md and CLAUDE.md to clarify that deployed lxc-* hosts
now use clan vars (vars/per-machine/<target>/openssh/) rather than the
gitignored host-keys/ directory.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B2EJ4qTsM5KUqhS5c3GAwx
beatzaplenty merged commit 2526b2dca7 into main 2026-07-25 11:32:26 +00:00
This repo is archived. You cannot comment on pull requests.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
beatzaplenty
No Assignees
1 Participants
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: beatzaplenty/nixos#60