From b5f749daa99c045a51991ebd1e4d05ea2d536f24 Mon Sep 17 00:00:00 2001 From: beatzaplenty Date: Sun, 26 Jul 2026 00:11:03 +1000 Subject: [PATCH] docs(sync-host-keys): fix stale host-keys/ references in comments and usage After the clan vars migration all keys are in vars/per-machine/, not host-keys/. Update: - File header: "existing clan var is never overwritten" (not host-keys/ file) - Header --remove/--regenerate description: mention clan vars as primary - usage() --remove, --regenerate-all-keys, --dry-run text - cmd_remove/cmd_regenerate_all empty-guard messages - README.md vars/per-machine/ row: "all deployed hosts" (not "LXC hosts") Co-Authored-By: Claude Sonnet 4.6 Claude-Session: https://claude.ai/code/session_01B2EJ4qTsM5KUqhS5c3GAwx --- README.md | 2 +- scripts/secrets/sync-host-keys.sh | 32 +++++++++++++++---------------- 2 files changed, 17 insertions(+), 17 deletions(-) diff --git a/README.md b/README.md index 388534a..40a62b5 100644 --- a/README.md +++ b/README.md @@ -73,7 +73,7 @@ nix eval --json .#nixosConfigurations --apply builtins.attrNames | jq -r '.[]' | `modules/nix-cache/` | Binary cache and remote builder client/server modules | | `modules/installer/` | Auto-installer environment (ISO, also served as PXE netboot) — see `docs/auto-installer.md` | | `host-keys/` | Gitignored; only used by the auto-installer environment for pre-seeding SSH host keys before first boot — see `docs/auto-installer.md`. All deployed hosts use clan vars (`vars/per-machine//openssh/`) instead | -| `vars/per-machine/` | Clan vars: committed, sops-encrypted SSH host keys for deployed LXC hosts; read by `create-proxmox-resource.sh` at deploy time | +| `vars/per-machine/` | Clan vars: committed, sops-encrypted SSH host keys for all deployed hosts; read by `create-proxmox-resource.sh` at deploy time | | `docs/` | Operational notes for cache, builders, lock updates, boot services, the auto-installer, and Proxmox image builds | | `scripts/` | Codex setup, validation, host-key, release-bump, and Proxmox resource helpers | diff --git a/scripts/secrets/sync-host-keys.sh b/scripts/secrets/sync-host-keys.sh index e50ab36..512929e 100755 --- a/scripts/secrets/sync-host-keys.sh +++ b/scripts/secrets/sync-host-keys.sh @@ -11,17 +11,16 @@ # sync-host-keys.sh --regenerate-all-keys Remove and freshly regenerate # every locally-managed key. # -# "Generate/register" is idempotent and additive only: an existing -# host-keys/ file is never touched, and .sops.yaml only ever gains an -# anchor/alias it doesn't already have -- safe to re-run any time, e.g. -# right after adding a new host to flake.nix. +# "Generate/register" is idempotent and additive only: an existing clan +# var is never overwritten, and .sops.yaml only ever gains an anchor/alias +# it doesn't already have -- safe to re-run any time, e.g. right after +# adding a new host to flake.nix. # -# --remove and --regenerate-all-keys only ever operate on anchors that have -# a corresponding host-keys/_ssh_host_ed25519_key file. Anchors -# without one (&admin, and any anchor for an already-deployed host whose -# real /etc/ssh key was registered by hand, e.g. &docker/&server/&nix-cache -# today) are never listed, removed, or regenerated -- this tooling only -# ever touches keys it itself manages. +# --remove and --regenerate-all-keys only ever operate on anchors that +# have a corresponding clan var (vars/per-machine//openssh/) or +# host-keys/ file. Anchors without either (&admin) are never listed, +# removed, or regenerated -- this tooling only ever touches keys it itself +# manages. set -euo pipefail repo_root="$(cd "$(dirname "$0")/../.." && pwd)" @@ -56,13 +55,14 @@ Usage: $0 --all [--dry-run] Same, for just one target (e.g. lxc-server). Reports if it already has one. --remove Interactively pick one locally-managed key to - remove from .sops.yaml and host-keys/. + remove from .sops.yaml and vars/per-machine/ + (or host-keys/ for legacy keys). --regenerate-all-keys Remove every locally-managed key and generate - fresh replacements for every current flake - target. Destructive -- requires typed + fresh clan-var replacements for every current + flake target. Destructive -- requires typed confirmation. --dry-run Combine with any of the above: print what would - change (host-keys/ files, .sops.yaml anchors and + change (clan vars, .sops.yaml anchors and key_groups, which secrets/*.yaml would be re-encrypted) without touching anything. No keys generated, no files written, no sops calls, @@ -315,7 +315,7 @@ cmd_remove() { local hosts mapfile -t hosts < <(locally_managed_hosts) if [[ "${#hosts[@]}" -eq 0 ]]; then - echo "No locally-managed keys in host-keys/ -- nothing to remove." + echo "No locally-managed keys found (checked host-keys/ and vars/per-machine/) -- nothing to remove." return fi @@ -372,7 +372,7 @@ cmd_regenerate_all() { local hosts mapfile -t hosts < <(locally_managed_hosts) if [[ "${#hosts[@]}" -eq 0 ]]; then - echo "No locally-managed keys in host-keys/ -- nothing to regenerate." + echo "No locally-managed keys found (checked host-keys/ and vars/per-machine/) -- nothing to regenerate." return fi -- 2.54.0