lament/pantheon

audit-pt1 #94

Merged

lament merged 3 commits from audit-pt1 into main

2026-07-17 17:06:53 -05:00

lament commented

2026-07-17 16:46:04 -05:00

Owner

split build offload from deploy - nixbldRemote + nixbldKey served both roles, meaning every host held a private key that was root everywhere
- new builder user (non-wheel, trusted-users) on brigid only - accepts builderKey for ssh-ng build connections
- new deployer user (wheel, passwordless sudo) replaces nixbldRemote fleet-wide - accepts fresh deployerKey
- builderKey secret scoped to non-builder hosts only (outbound to brigid); deployerKey lives exclusively in the runner's ~/.ssh/id_ed25519
- ceremony/01-gen-keys.sh + ceremony/02-update-sops.sh walk through key generation + sops rotation; old nixbldKey stays in sops until first successful deploy, then sops edit it out
stale nix-configurations paths fixed - repo renamed to pantheon a while back, several things missed it
- nh.flake, nixd server settings (4 expr paths in vscode.nix), ishtar borg backup path
- brigid.nix gets specialArgs = { inherit inputs self; } - silent with no static/brigid/ today, confusing crash the moment one appears
borg failure alerting wired up - there's already been one silent-failure incident and nothing was catching repeats
- borg-alert.service (oneshot, curl to athena smtp over WG) added to borgbackup.nix; onFailure on every job
- no relay config needed on spoke hosts - athena already trusts the full internal /48 in mynetworks + rspamd local_addrs
docs/ added to .gitignore - fable audit report lives there, not meant to be tracked
left for later: nixbldKey removal post-deploy, per-host age keys (audit #.1), second WG hub on minerva if a public port materializes

- split build offload from deploy - `nixbldRemote` + `nixbldKey` served both roles, meaning every host held a private key that was root everywhere - new `builder` user (non-wheel, `trusted-users`) on `brigid` only - accepts `builderKey` for `ssh-ng` build connections - new `deployer` user (wheel, passwordless sudo) replaces `nixbldRemote` fleet-wide - accepts fresh `deployerKey` - `builderKey` secret scoped to non-builder hosts only (outbound to `brigid`); `deployerKey` lives exclusively in the runner's `~/.ssh/id_ed25519` - `ceremony/01-gen-keys.sh` + `ceremony/02-update-sops.sh` walk through key generation + sops rotation; old `nixbldKey` stays in sops until first successful deploy, then `sops edit` it out - stale `nix-configurations` paths fixed - repo renamed to `pantheon` a while back, several things missed it - `nh.flake`, `nixd` server settings (4 expr paths in `vscode.nix`), `ishtar` borg backup path - `brigid.nix` gets `specialArgs = { inherit inputs self; }` - silent with no `static/brigid/` today, confusing crash the moment one appears - borg failure alerting wired up - there's already been one silent-failure incident and nothing was catching repeats - `borg-alert.service` (oneshot, curl to `athena` smtp over WG) added to `borgbackup.nix`; `onFailure` on every job - no relay config needed on spoke hosts - `athena` already trusts the full internal `/48` in `mynetworks` + rspamd `local_addrs` - `docs/` added to `.gitignore` - fable audit report lives there, not meant to be tracked - left for later: `nixbldKey` removal post-deploy, per-host age keys (audit #.1), second WG hub on `minerva` if a public port materializes ```

lament added 3 commits

2026-07-17 16:46:04 -05:00

README tweak 079b31e15f

flake paths, backup paths and alerting 6693be7370

seperation of builder and deployer

CI / check (pull_request) Successful in 50s

Details

CI / deploy (pull_request) Has been skipped

Details

CI / build (pull_request) Successful in 2m21s

Details

CI / dry-activate (pull_request) Successful in 45s