Archived
beatzaplentyandClaude Sonnet 4.6
59854a0229
- Run sync-host-keys.sh for proxmox-ha-server-{1,2}: generates SSH host
key pairs in vars/per-machine/, registers age anchors in .sops.yaml,
adds both hosts as recipients for common.yaml, ha-corosync-authkey,
and per-host secrets/keytab files
- Re-encrypt secrets/common.yaml with both new host keys
- Convert all stub secrets to real sops-encrypted files:
secrets/ha-server-{1,2}.yaml (YAML, beszel-token = PLACEHOLDER)
secrets/ha-server-{1,2}.keytab (binary, stub text encrypted)
secrets/ha-corosync-authkey (binary, stub text encrypted)
- Add scripts/ha/deploy.sh: full lifecycle script (bridge setup, VM
creation, DRBD disk + storage NIC attachment, boot wait, cluster-init,
acceptance tests, --destroy)
Bootstrap order (operator runs these before first deploy):
1. bash scripts/ha/deploy.sh # deploys, tests
# Post-deploy secret replacement:
2. sops secrets/ha-server-{1,2}.yaml (set real beszel-token)
3. bash scripts/ipa/create-nixos-ipa-host-account.sh --ip 192.168.2.228 ha-server-1
4. bash scripts/ipa/create-nixos-ipa-host-account.sh --ip 192.168.2.227 ha-server-2
5. Set services.beszel.agent.environment.KEY in host.nix after hub pairing
6. nixos-rebuild switch on both nodes to pick up real secrets
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HaH1cSGvhogRP5ExoF6nD8
224 lines
7.8 KiB
YAML
224 lines
7.8 KiB
YAML
keys:
|
|
- &admin age1njap586hc0q43kr03g6c8eqhdsmk8zcafkl3f83xwlc2gqhlmfgs4tmwad
|
|
- &proxmox-minimal age19m0m7vdfg86yqy8l5mmle5jdd0unrn3f55t232w8h5ey42cqw34sfpt32n
|
|
- &lxc-gui age1rrxqea6q6pn39sw8y5te63h2py8jgjl9v0jyper86w3ggtn67upqg3ah39
|
|
- &baremetal-gui age1adur9g330gua4l6ndk8cqjg35qc8yxwgme6wrl2hpylcc7vxm38q05ejuy
|
|
- &linode-docker age17e89ty6p0fw24daanen57wg8uald9s025t3wwxsw269svwpmgvrshfvfvt
|
|
- &linode-gui age1hrx8qj02fj2ea6d4g9vqhyj9hl7fppkjqfdx2l37py3h6pdkr95s8n8rvs
|
|
- &linode-minimal age1e7l8dusgmgfzd2cxrrzwepzjxt69hzqj4epee0cs27u6yg4kxcuqm34ncx
|
|
- &linode-nix-cache age1jcx3yajjhghn8qh8za3yeu8nxykzlg3p4nrv03vnfvzl0mzayg2qmg940e
|
|
- &linode-server age1sweerhrga9yf8x6sv0apz4ed4g48rnlcq34rpv20t0rcelwgpgeqwvndzz
|
|
- &linode-tailscale-router age1f7usptjx9rv4rxauasve200gxtdt9jkqhhdqstlf20wvlm7u75rsjfw50m
|
|
- &lxc-docker age17jqc66x9yeshfgd9v78mj483r4zzarqdtuxtrkxe4x5mw679gphshd94th
|
|
- &lxc-minimal age1px0h5l9zp2dww0m8fncrc82kfdmzplsfv2ltat7sna28xpg09pqqcl3s2k
|
|
- &lxc-nix-cache age1ufg390ydrmma849t9xfkxxl5xvdkk6mngnlzhmy7mvuaje8sgcmsmnq6l7
|
|
- &lxc-pxe-boot age16j42pdc5dr6wnj7xayhkqdj2rny9u68fcqejs50hqq42scssh4gsnrrnlt
|
|
- &lxc-server age1nruncs4l0ufk7yuc4des8p99c0alfndl0lhsws8tycl5pplfp56s30af5f
|
|
- &lxc-tailscale-router age1k7d2du5mejsmv5rzavm4xwgpthqvcfsehduquv28nzs53zppa3kqngfxq2
|
|
- &lxc-tor-relay age16kqfmvz4e23hmdlqresnyw69ej604s320mmd49h4hm3fhqchtgyqrws0k2
|
|
- &proxmox-docker age1arhf2q45zw6wf2uevju4savp575x3m2tfvved5zzq3ay92ynua9s3cm92c
|
|
- &proxmox-gui age19mn8zrxl8zpps9yvrh4euquvygpp4fp8queg7xc6qhtnl4ng8c9qx02qwn
|
|
- &proxmox-nix-cache age1jlltcv5jcnm40z5k0q6hv053k2rqpqvemtuecdwn527uw8uqz4es3x7m68
|
|
- &proxmox-pxe-boot age1ug787sgt6st6k82fgkrug2lzltw4qsukrrqqs3w27ewwqj8rg4hsxcmylz
|
|
- &proxmox-server age1529taqdwr6t0w7cvzmty0d5y5593wffl0krt48j6uc4u39k56g2qf6ywtp
|
|
- &proxmox-tailscale-router age1zhfyuzlq40reuqlr34gf77852nhs3t6mqfzrqmas8z6sxk7tcfhsungrm0
|
|
- &proxmox-ha-server-1 age1nxlnrevqs2msdatze562vz6ym4pgydt2zndye83lwqauy6flggtqrevyw5
|
|
- &proxmox-ha-server-2 age1scfc8p53q5aq2a87tcmsazmj8sfeft0s8kxg0et4nm3ucxyp3c3s6te82y
|
|
|
|
creation_rules:
|
|
# Shared across every currently-deployed host: root/nixos password hash,
|
|
# GitHub access token. Same value on every host today, so every live host's
|
|
# key can decrypt it (matches current risk profile — narrow further in
|
|
# Milestone 4 if hosts should diverge).
|
|
- path_regex: secrets/common\.yaml$
|
|
key_groups:
|
|
- age:
|
|
- *admin
|
|
- *proxmox-minimal
|
|
- *lxc-gui
|
|
- *baremetal-gui
|
|
- *linode-docker
|
|
- *linode-gui
|
|
- *linode-minimal
|
|
- *linode-nix-cache
|
|
- *linode-server
|
|
- *linode-tailscale-router
|
|
- *lxc-docker
|
|
- *lxc-minimal
|
|
- *lxc-nix-cache
|
|
- *lxc-pxe-boot
|
|
- *lxc-server
|
|
- *lxc-tailscale-router
|
|
- *lxc-tor-relay
|
|
- *proxmox-docker
|
|
- *proxmox-gui
|
|
- *proxmox-nix-cache
|
|
- *proxmox-pxe-boot
|
|
- *proxmox-server
|
|
- *proxmox-tailscale-router
|
|
- *proxmox-ha-server-1
|
|
- *proxmox-ha-server-2
|
|
|
|
- path_regex: secrets/nix-cache\.yaml$
|
|
key_groups:
|
|
- age:
|
|
- *admin
|
|
- *linode-nix-cache
|
|
- *lxc-nix-cache
|
|
- *proxmox-nix-cache
|
|
|
|
- path_regex: secrets/server\.yaml$
|
|
key_groups:
|
|
- age:
|
|
- *admin
|
|
- *linode-server
|
|
- *lxc-server
|
|
- *proxmox-server
|
|
|
|
- path_regex: secrets/tor-relay\.yaml$
|
|
key_groups:
|
|
- age:
|
|
- *admin
|
|
- *lxc-tor-relay
|
|
|
|
- path_regex: secrets/tailscale-router\.yaml$
|
|
key_groups:
|
|
- age:
|
|
- *admin
|
|
- *linode-tailscale-router
|
|
- *lxc-tailscale-router
|
|
- *proxmox-tailscale-router
|
|
|
|
# HA file server per-node secrets (beszel-token).
|
|
# proxmox-ha-server-1 / proxmox-ha-server-2 keys are added automatically
|
|
# by scripts/secrets/sync-host-keys.sh once the hosts are provisioned;
|
|
# until then only the admin key can decrypt these files.
|
|
- path_regex: secrets/ha-server-1\.yaml$
|
|
key_groups:
|
|
- age:
|
|
- *admin
|
|
- *proxmox-ha-server-1
|
|
# proxmox-ha-server-1 added by sync-host-keys.sh
|
|
|
|
- path_regex: secrets/ha-server-2\.yaml$
|
|
key_groups:
|
|
- age:
|
|
- *admin
|
|
- *proxmox-ha-server-2
|
|
# proxmox-ha-server-2 added by sync-host-keys.sh
|
|
|
|
# Shared HA cluster corosync authkey (binary sops file).
|
|
# Encrypted for both HA nodes so either can decrypt on boot.
|
|
# Both host keys added by sync-host-keys.sh; admin key allows initial creation.
|
|
- path_regex: secrets/ha-corosync-authkey$
|
|
key_groups:
|
|
- age:
|
|
- *admin
|
|
- *proxmox-ha-server-1
|
|
- *proxmox-ha-server-2
|
|
# proxmox-ha-server-1 added by sync-host-keys.sh
|
|
# proxmox-ha-server-2 added by sync-host-keys.sh
|
|
|
|
# gui-host-specific secrets (currently: wifi-password, see
|
|
# modules/networking/wifi.nix). Only *lxc-gui has a registered key today
|
|
# -- proxmox-gui/linode-gui/baremetal-gui haven't been provisioned via
|
|
# scripts/secrets/sync-host-keys.sh yet, so whichever variant is actually
|
|
# deployed next needs its recipient added here (and `sops updatekeys` rerun)
|
|
# before it can decrypt this.
|
|
- path_regex: secrets/gui\.yaml$
|
|
key_groups:
|
|
- age:
|
|
- *admin
|
|
- *lxc-gui
|
|
- *baremetal-gui
|
|
- *linode-gui
|
|
- *proxmox-gui
|
|
|
|
# IPA host keytabs (binary sops files).
|
|
# Each keytab is encrypted for all platform variants of that host so any
|
|
# deployed variant can decrypt it at boot. Run
|
|
# scripts/ipa/create-nixos-ipa-host-account.sh <hostname> to enroll a new
|
|
# host and produce the keytab; this section is updated by that script.
|
|
|
|
- path_regex: secrets/nix-cache\.keytab$
|
|
key_groups:
|
|
- age:
|
|
- *admin
|
|
- *linode-nix-cache
|
|
- *lxc-nix-cache
|
|
- *proxmox-nix-cache
|
|
|
|
- path_regex: secrets/tailscale-router\.keytab$
|
|
key_groups:
|
|
- age:
|
|
- *admin
|
|
- *linode-tailscale-router
|
|
- *lxc-tailscale-router
|
|
- *proxmox-tailscale-router
|
|
|
|
- path_regex: secrets/pxe-boot\.keytab$
|
|
key_groups:
|
|
- age:
|
|
- *admin
|
|
- *lxc-pxe-boot
|
|
- *proxmox-pxe-boot
|
|
|
|
# nixos = the workstation (hosts/nixos/host.nix). All gui platform variants
|
|
# share the hostname "nixos" and must be able to decrypt at boot.
|
|
- path_regex: secrets/nixos\.keytab$
|
|
key_groups:
|
|
- age:
|
|
- *admin
|
|
- *baremetal-gui
|
|
- *lxc-gui
|
|
- *proxmox-gui
|
|
- *linode-gui
|
|
|
|
- path_regex: secrets/server\.keytab$
|
|
key_groups:
|
|
- age:
|
|
- *admin
|
|
- *linode-server
|
|
- *lxc-server
|
|
- *proxmox-server
|
|
|
|
- path_regex: secrets/docker\.keytab$
|
|
key_groups:
|
|
- age:
|
|
- *admin
|
|
- *linode-docker
|
|
- *lxc-docker
|
|
- *proxmox-docker
|
|
|
|
- path_regex: secrets/tor-relay\.keytab$
|
|
key_groups:
|
|
- age:
|
|
- *admin
|
|
- *lxc-tor-relay
|
|
|
|
- path_regex: secrets/nix-minimal\.keytab$
|
|
key_groups:
|
|
- age:
|
|
- *admin
|
|
- *lxc-minimal
|
|
- *proxmox-minimal
|
|
- *linode-minimal
|
|
|
|
# Host keytab for ha-server-1 FreeIPA enrollment (binary sops file).
|
|
# Generated by scripts/ipa/create-nixos-ipa-host-account.sh.
|
|
- path_regex: secrets/ha-server-1\.keytab$
|
|
key_groups:
|
|
- age:
|
|
- *admin
|
|
- *proxmox-ha-server-1
|
|
# proxmox-ha-server-1 added by sync-host-keys.sh
|
|
|
|
# Host keytab for ha-server-2 FreeIPA enrollment (binary sops file).
|
|
# Generated by scripts/ipa/create-nixos-ipa-host-account.sh.
|
|
- path_regex: secrets/ha-server-2\.keytab$
|
|
key_groups:
|
|
- age:
|
|
- *admin
|
|
- *proxmox-ha-server-2
|
|
# proxmox-ha-server-2 added by sync-host-keys.sh
|