Archived
beatzaplentyandClaude Sonnet 5
2f7831aea8
Check NixOS configurations / eval-hosts (push) Failing after 11m5s
Audited the working tree and full git history for committed secrets
(gitleaks + trufflehog + manual grep, see secrets-inventory.md, kept
local/gitignored per the spec). Found: a password hash shared by root
and the nixos user across every host, two live Beszel monitoring
tokens, and a GitHub fine-grained PAT embedded in a home-manager
nix.conf.
Migrates all of them to sops-nix:
- .sops.yaml + secrets/*.yaml, encrypted for admin + the age keys
derived (via ssh-to-age) from each live host's existing SSH host
key — no new key material transferred to any machine.
- users.users.{root,nixos}.hashedPasswordFile replaces the inline
hashedPassword shared by every target.
- The GitHub PAT moves from a home-manager-managed, store-visible
nix.conf to a sops.templates-rendered file included via nix.conf's
native !include, system-wide instead of per-user.
- Beszel TOKEN moves from `environment` (store-visible) to
`environmentFile` (runtime-only via sops.templates); the dead
commented-out docker token is removed from the tree entirely.
Added a tracked pre-commit hook (gitleaks protect --staged, wired via
core.hooksPath) so a secret can't be committed by accident again, and
documented the sops workflow in README.md.
Structural verification only: all 17 flake targets evaluate, and
`nix build --dry-run --no-link` succeeds for the three currently
deployed hosts. Per CLAUDE.md, actual `nixos-rebuild switch` — the
step that confirms secrets decrypt and services start on a real
machine — is left for manual verification.
Git history still contains the original plaintext secrets; scrubbing
history (Milestone 3) and rotating every credential (Milestone 4) are
separate, deliberately gated steps per remove-sensetive-info-refactor.md.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
235 lines
6.1 KiB
JSON
235 lines
6.1 KiB
JSON
{
|
|
"nodes": {
|
|
"disko": {
|
|
"inputs": {
|
|
"nixpkgs": [
|
|
"nixpkgs"
|
|
]
|
|
},
|
|
"locked": {
|
|
"lastModified": 1781152676,
|
|
"narHash": "sha256-RxWs5ND31KzTG7wvMM+PMfUjyNpmIEr999lqNARaM5o=",
|
|
"owner": "nix-community",
|
|
"repo": "disko",
|
|
"rev": "ff8702b4de27f72b4c78573dfb89ec74e36abdf1",
|
|
"type": "github"
|
|
},
|
|
"original": {
|
|
"owner": "nix-community",
|
|
"repo": "disko",
|
|
"type": "github"
|
|
}
|
|
},
|
|
"flake-compat": {
|
|
"locked": {
|
|
"lastModified": 1767039857,
|
|
"narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
|
|
"owner": "edolstra",
|
|
"repo": "flake-compat",
|
|
"rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
|
|
"type": "github"
|
|
},
|
|
"original": {
|
|
"owner": "edolstra",
|
|
"repo": "flake-compat",
|
|
"type": "github"
|
|
}
|
|
},
|
|
"flake-compat_2": {
|
|
"flake": false,
|
|
"locked": {
|
|
"lastModified": 1650374568,
|
|
"narHash": "sha256-Z+s0J8/r907g149rllvwhb4pKi8Wam5ij0st8PwAh+E=",
|
|
"owner": "edolstra",
|
|
"repo": "flake-compat",
|
|
"rev": "b4a34015c698c7793d592d66adbab377907a2be8",
|
|
"type": "github"
|
|
},
|
|
"original": {
|
|
"owner": "edolstra",
|
|
"repo": "flake-compat",
|
|
"type": "github"
|
|
}
|
|
},
|
|
"flake-utils": {
|
|
"inputs": {
|
|
"systems": "systems"
|
|
},
|
|
"locked": {
|
|
"lastModified": 1694529238,
|
|
"narHash": "sha256-zsNZZGTGnMOf9YpHKJqMSsa0dXbfmxeoJ7xHlrt+xmY=",
|
|
"owner": "numtide",
|
|
"repo": "flake-utils",
|
|
"rev": "ff7b65b44d01cf9ba6a71320833626af21126384",
|
|
"type": "github"
|
|
},
|
|
"original": {
|
|
"owner": "numtide",
|
|
"repo": "flake-utils",
|
|
"type": "github"
|
|
}
|
|
},
|
|
"flake-utils-plus": {
|
|
"inputs": {
|
|
"flake-utils": "flake-utils"
|
|
},
|
|
"locked": {
|
|
"lastModified": 1715533576,
|
|
"narHash": "sha256-fT4ppWeCJ0uR300EH3i7kmgRZnAVxrH+XtK09jQWihk=",
|
|
"owner": "gytis-ivaskevicius",
|
|
"repo": "flake-utils-plus",
|
|
"rev": "3542fe9126dc492e53ddd252bb0260fe035f2c0f",
|
|
"type": "github"
|
|
},
|
|
"original": {
|
|
"owner": "gytis-ivaskevicius",
|
|
"repo": "flake-utils-plus",
|
|
"rev": "3542fe9126dc492e53ddd252bb0260fe035f2c0f",
|
|
"type": "github"
|
|
}
|
|
},
|
|
"home-manager": {
|
|
"inputs": {
|
|
"nixpkgs": [
|
|
"nixpkgs"
|
|
]
|
|
},
|
|
"locked": {
|
|
"lastModified": 1783740085,
|
|
"narHash": "sha256-qajyHfZY29G2oEQk+uHxmsJcRoBUBXP9maTpFlwP/dI=",
|
|
"owner": "nix-community",
|
|
"repo": "home-manager",
|
|
"rev": "3cd22efe6471dc7365c822bd9ad73a21e55f38fb",
|
|
"type": "github"
|
|
},
|
|
"original": {
|
|
"owner": "nix-community",
|
|
"ref": "release-26.05",
|
|
"repo": "home-manager",
|
|
"type": "github"
|
|
}
|
|
},
|
|
"nixos-conf-editor": {
|
|
"inputs": {
|
|
"flake-compat": "flake-compat",
|
|
"nixpkgs": "nixpkgs",
|
|
"snowfall-lib": "snowfall-lib"
|
|
},
|
|
"locked": {
|
|
"lastModified": 1771149335,
|
|
"narHash": "sha256-YPUIwyumbQOE2DUY8NIsHIUTGUQnDVhnTVUZMZDRwi4=",
|
|
"owner": "snowfallorg",
|
|
"repo": "nixos-conf-editor",
|
|
"rev": "9f8b4519a2e0e8919b69b7572bc26dab54274a6f",
|
|
"type": "github"
|
|
},
|
|
"original": {
|
|
"owner": "snowfallorg",
|
|
"repo": "nixos-conf-editor",
|
|
"type": "github"
|
|
}
|
|
},
|
|
"nixpkgs": {
|
|
"locked": {
|
|
"lastModified": 1771008912,
|
|
"narHash": "sha256-gf2AmWVTs8lEq7z/3ZAsgnZDhWIckkb+ZnAo5RzSxJg=",
|
|
"owner": "nixos",
|
|
"repo": "nixpkgs",
|
|
"rev": "a82ccc39b39b621151d6732718e3e250109076fa",
|
|
"type": "github"
|
|
},
|
|
"original": {
|
|
"owner": "nixos",
|
|
"ref": "nixos-unstable",
|
|
"repo": "nixpkgs",
|
|
"type": "github"
|
|
}
|
|
},
|
|
"nixpkgs_2": {
|
|
"locked": {
|
|
"lastModified": 1784011430,
|
|
"narHash": "sha256-lDebytrYdd47IBLwvNOD+6AGeoqZ78CIKlp70hzW280=",
|
|
"owner": "NixOS",
|
|
"repo": "nixpkgs",
|
|
"rev": "8eeec934ae0dbeca3d7868c059568a65c08b2fc3",
|
|
"type": "github"
|
|
},
|
|
"original": {
|
|
"owner": "NixOS",
|
|
"ref": "nixos-26.05",
|
|
"repo": "nixpkgs",
|
|
"type": "github"
|
|
}
|
|
},
|
|
"root": {
|
|
"inputs": {
|
|
"disko": "disko",
|
|
"home-manager": "home-manager",
|
|
"nixos-conf-editor": "nixos-conf-editor",
|
|
"nixpkgs": "nixpkgs_2",
|
|
"sops-nix": "sops-nix"
|
|
}
|
|
},
|
|
"snowfall-lib": {
|
|
"inputs": {
|
|
"flake-compat": "flake-compat_2",
|
|
"flake-utils-plus": "flake-utils-plus",
|
|
"nixpkgs": [
|
|
"nixos-conf-editor",
|
|
"nixpkgs"
|
|
]
|
|
},
|
|
"locked": {
|
|
"lastModified": 1765361626,
|
|
"narHash": "sha256-kX0Dp/kYSRbQ+yd9e3lmmUWdNbipufvKfL2IzbrSpnY=",
|
|
"owner": "snowfallorg",
|
|
"repo": "lib",
|
|
"rev": "c566ad8b7352c30ec3763435de7c8f1c46ebb357",
|
|
"type": "github"
|
|
},
|
|
"original": {
|
|
"owner": "snowfallorg",
|
|
"repo": "lib",
|
|
"type": "github"
|
|
}
|
|
},
|
|
"sops-nix": {
|
|
"inputs": {
|
|
"nixpkgs": [
|
|
"nixpkgs"
|
|
]
|
|
},
|
|
"locked": {
|
|
"lastModified": 1783174389,
|
|
"narHash": "sha256-aCWC8ngycU7OdJrU2+Je3qf+1a2ykuBvpPhZT/9tXMc=",
|
|
"owner": "Mic92",
|
|
"repo": "sops-nix",
|
|
"rev": "f1406619a3884cd5c47992a70b8b35c9c0fcb4c9",
|
|
"type": "github"
|
|
},
|
|
"original": {
|
|
"owner": "Mic92",
|
|
"repo": "sops-nix",
|
|
"type": "github"
|
|
}
|
|
},
|
|
"systems": {
|
|
"locked": {
|
|
"lastModified": 1681028828,
|
|
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
|
|
"owner": "nix-systems",
|
|
"repo": "default",
|
|
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
|
|
"type": "github"
|
|
},
|
|
"original": {
|
|
"owner": "nix-systems",
|
|
"repo": "default",
|
|
"type": "github"
|
|
}
|
|
}
|
|
},
|
|
"root": "root",
|
|
"version": 7
|
|
}
|