This repository has been archived on 2026-07-30. You can view files and clone it. You cannot open issues or pull requests or push a commit.

beatzaplentyandClaude Sonnet 5 0e5aa044c0 Move nix-cache's binary cache signing key into sops ...

nix-serve's secretKeyFile was a manual, undocumented-outside-a-comment
`nix-store --generate-binary-cache-key` step per host -- easy to miss on
a fresh nix-cache instance (as lxc-nix-cache testing just found: systemd
fails the unit with EXIT_CREDENTIALS when LoadCredential can't find the
source file, which nginx then reports as a 502 from clients). It also
can't be regenerated per-host safely: modules/nix-cache/client.nix
hardcodes every client's trust in one specific public key, so every
nix-cache instance has to share the exact same keypair.

Sourced from secrets/nix-cache.yaml's new cache-priv-key entry instead,
via the same sops-nix pattern every other secret in this repo already
uses. Verified the added value derives to the exact public key
modules/nix-cache/client.nix already trusts before committing.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01La55Nsss8jZ7ZuzUV9mfot

2026-07-20 09:49:30 +10:00

..

common.yaml

Register sops age key for proxmox-minimal

2026-07-20 07:01:56 +10:00

nix-cache.yaml

Move nix-cache's binary cache signing key into sops

2026-07-20 09:49:30 +10:00

server.yaml

Migrate live secrets to sops-nix (Milestone 2)

2026-07-19 12:46:39 +10:00