lament/pantheon

per-host age keys, scoped sops files #95

Merged

lament merged 2 commits from audit-pt2 into main

2026-07-17 22:45:27 -05:00

lament commented

2026-07-17 22:28:23 -05:00

Owner

nixbldKey removed from sops/privkeys.yaml - burned during the pt1 deploy, was left in sops pending first successful switch; deleted and re-encrypted out
- ceremony scripts from pt1 updated to note the manual cleanup step
single shared fleet age key replaced with per-host keys - a compromised host previously held the key to every secret on every other host
- .sops.yaml rewritten: creation_rules now scope each file to only the hosts that actually consume secrets from it
  - domain.yaml, mail.yaml -> athena only
  - borg.yaml -> athena, ishtar, minerva (brigid has no backup job)
  - pki.yaml -> ishtar, minerva, brigid (athena uses the BIOS, no lanzaboote)
  - services.yaml -> minerva, brigid
  - privkeys.yaml, pass.yaml -> all four (every host has ssh/wg keys and lamentKey)
- all 7 sops files re-encrypted via sops updatekeys to the new per-host pubkeys + personal admin key
- private keys distributed to /persist/key.age on each host (replaces the shared key in place; sops.age.keyFile config unchanged)
- ceremony/03-gen-host-age-keys.sh, ceremony/04-update-sops-age-keys.sh, ceremony/05-distribute-host-age-keys.sh walk the full rotation
left for later: splitting privkeys.yaml per-host (would tighten blast radius further but requires touching sshd.nix + networking.nix); second WG hub on minerva if a public port materializes

- `nixbldKey` removed from `sops/privkeys.yaml` - burned during the pt1 deploy, was left in sops pending first successful switch; deleted and re-encrypted out - ceremony scripts from pt1 updated to note the manual cleanup step - single shared fleet age key replaced with per-host keys - a compromised host previously held the key to every secret on every other host - `.sops.yaml` rewritten: `creation_rules` now scope each file to only the hosts that actually consume secrets from it - `domain.yaml`, `mail.yaml` -> `athena` only - `borg.yaml` -> `athena`, `ishtar`, `minerva` (brigid has no backup job) - `pki.yaml` -> `ishtar`, `minerva`, `brigid` (athena uses the BIOS, no lanzaboote) - `services.yaml` -> `minerva`, `brigid` - `privkeys.yaml`, `pass.yaml` -> all four (every host has ssh/wg keys and `lamentKey`) - all 7 sops files re-encrypted via `sops updatekeys` to the new per-host pubkeys + personal admin key - private keys distributed to `/persist/key.age` on each host (replaces the shared key in place; `sops.age.keyFile` config unchanged) - `ceremony/03-gen-host-age-keys.sh`, `ceremony/04-update-sops-age-keys.sh`, `ceremony/05-distribute-host-age-keys.sh` walk the full rotation - left for later: splitting `privkeys.yaml` per-host (would tighten blast radius further but requires touching `sshd.nix` + `networking.nix`); second WG hub on `minerva` if a public port materializes

lament added 2 commits

2026-07-17 22:28:24 -05:00

retired old key ea96547faa

per-host age keys, scoped sops files

CI / check (pull_request) Successful in 52s

Details

CI / deploy (pull_request) Has been skipped

Details

CI / build (pull_request) Successful in 2m3s

Details

CI / dry-activate (pull_request) Failing after 25s

Details