Archived
beatzaplentyandClaude Sonnet 5
71d052e737
Audited the working tree and full git history for committed secrets
(gitleaks + trufflehog + manual grep, see secrets-inventory.md, kept
local/gitignored per the spec). Found: a password hash shared by root
and the nixos user across every host, two live Beszel monitoring
tokens, and a GitHub fine-grained PAT embedded in a home-manager
nix.conf.
Migrates all of them to sops-nix:
- .sops.yaml + secrets/*.yaml, encrypted for admin + the age keys
derived (via ssh-to-age) from each live host's existing SSH host
key — no new key material transferred to any machine.
- users.users.{root,nixos}.hashedPasswordFile replaces the inline
hashedPassword shared by every target.
- The GitHub PAT moves from a home-manager-managed, store-visible
nix.conf to a sops.templates-rendered file included via nix.conf's
native !include, system-wide instead of per-user.
- Beszel TOKEN moves from `environment` (store-visible) to
`environmentFile` (runtime-only via sops.templates); the dead
commented-out docker token is removed from the tree entirely.
Added a tracked pre-commit hook (gitleaks protect --staged, wired via
core.hooksPath) so a secret can't be committed by accident again, and
documented the sops workflow in README.md.
Structural verification only: all 17 flake targets evaluate, and
`nix build --dry-run --no-link` succeeds for the three currently
deployed hosts. Per CLAUDE.md, actual `nixos-rebuild switch` — the
step that confirms secrets decrypt and services start on a real
machine — is left for manual verification.
Git history still contains the original plaintext secrets; scrubbing
history (Milestone 3) and rotating every credential (Milestone 4) are
separate, deliberately gated steps per remove-sensetive-info-refactor.md.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
92 lines
2.2 KiB
Bash
Executable File
92 lines
2.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
export NIX_CONFIG="${NIX_CONFIG:-}
|
|
experimental-features = nix-command flakes
|
|
accept-flake-config = false
|
|
warn-dirty = false
|
|
"
|
|
|
|
ensure_nix_profile() {
|
|
if [ -f /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh ]; then
|
|
. /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
|
|
elif [ -f "$HOME/.nix-profile/etc/profile.d/nix.sh" ]; then
|
|
. "$HOME/.nix-profile/etc/profile.d/nix.sh"
|
|
fi
|
|
}
|
|
|
|
install_nix_if_missing() {
|
|
if command -v nix >/dev/null 2>&1; then
|
|
return
|
|
fi
|
|
|
|
echo "Nix not found. Installing Nix..."
|
|
|
|
if [ "$(id -u)" -eq 0 ]; then
|
|
echo "Running as root; preparing nixbld users for container/Codex environment..."
|
|
|
|
if ! getent group nixbld >/dev/null; then
|
|
groupadd -r nixbld
|
|
fi
|
|
|
|
for i in $(seq 1 10); do
|
|
if ! id "nixbld$i" >/dev/null 2>&1; then
|
|
useradd \
|
|
-r \
|
|
-g nixbld \
|
|
-G nixbld \
|
|
-d /var/empty \
|
|
-s /usr/sbin/nologin \
|
|
"nixbld$i" || true
|
|
fi
|
|
done
|
|
|
|
mkdir -p /etc/nix
|
|
cat > /etc/nix/nix.conf <<'EOF'
|
|
experimental-features = nix-command flakes
|
|
accept-flake-config = false
|
|
warn-dirty = false
|
|
build-users-group = nixbld
|
|
EOF
|
|
|
|
sh <(curl -L https://nixos.org/nix/install) --no-daemon
|
|
else
|
|
sh <(curl -L https://nixos.org/nix/install) --no-daemon
|
|
fi
|
|
|
|
ensure_nix_profile
|
|
}
|
|
|
|
install_nix_if_missing
|
|
ensure_nix_profile
|
|
|
|
mkdir -p "$HOME/.config/nix"
|
|
cat > "$HOME/.config/nix/nix.conf" <<'EOF'
|
|
experimental-features = nix-command flakes
|
|
accept-flake-config = false
|
|
warn-dirty = false
|
|
EOF
|
|
|
|
echo "Nix version:"
|
|
nix --version
|
|
|
|
echo "Enabling tracked git hooks (pre-commit secret scan)..."
|
|
git config core.hooksPath .githooks
|
|
|
|
echo "Installing jq if unavailable..."
|
|
if ! command -v jq >/dev/null 2>&1; then
|
|
nix profile install nixpkgs#jq
|
|
fi
|
|
|
|
echo "Available NixOS hosts:"
|
|
hosts="$(nix eval --json --no-use-registries --no-accept-flake-config .#nixosConfigurations --apply builtins.attrNames | jq -r '.[]')"
|
|
echo "$hosts"
|
|
|
|
echo "Evaluating all host toplevel derivations..."
|
|
for host in $hosts; do
|
|
echo "==> Evaluating $host"
|
|
nix eval --raw --no-use-registries --no-accept-flake-config ".#nixosConfigurations.${host}.config.system.build.toplevel.drvPath"
|
|
done
|
|
|
|
echo "Codex setup complete."
|