lament/pantheon

sops rework #96

Merged

lament merged 2 commits from sops into main

2026-07-18 00:47:59 -05:00

lament commented

2026-07-18 00:42:27 -05:00

Owner

sops/privkeys.yaml split into per-host files - closes the "left for later" from #95
- each sops/privkeys/<host>.yaml encrypted to only that host + lament
- deployerKey now lives exclusively in sops/privkeys/brigid.yaml - a minerva compromise no longer has a path to fleet root
- builderKey in athena/ishtar/minerva only; each host's WG + SSH host keys in its own file
- modules updated: networking.nix, sshd.nix, buildMachines.nix, forgejo-runner.nix, lament.nix
sops/borg.yaml split into per-subuser files (sops/borg/sub{1,2,3,4}.yaml)
- each carries the Ssh+Repo+Enc trio; Enc kept for DR, sub4 pre-provisioned and ready
sops/pki.yaml split into sops/pki/lament.yaml + sops/pki/db.yaml
- PK/KEK/GUID -> lament-only; no host needs enrollment keys at runtime
- dbKey/dbPem -> shared db.yaml encrypted to ishtar/minerva/brigid; shared key is intentional (one SB hierarchy across trusted hosts)
- lanzaboote.nix updated to reference pki/db
lamentKey gated on cfg.desktop.enable in lament.nix
- personal SSH private key no longer materializes on servers
- sopsFile points at privkeys/ishtar - the only host that should have it
/var/lib/caddy persisted on athena
- caddy is a static user, not covered by the /var/lib/private blanket
- was borg-backed but not persisted - every reboot re-issued all vhost certs, walking toward LE rate limits
fossils swept
- stale nixbldRemote/nixbld user comments in deploy.nix + nixconf.nix
- justfile: rebase, nvd, cleanup removed (git-branch workflows); update stripped of its git add/commit tail
- CLAUDE.md: gollum -> wiki-js, mkDisableOption removed from helpers list, impermanent role -> postgres in directory description

- `sops/privkeys.yaml` split into per-host files - closes the "left for later" from #95 - each `sops/privkeys/<host>.yaml` encrypted to only that host + lament - `deployerKey` now lives exclusively in `sops/privkeys/brigid.yaml` - a minerva compromise no longer has a path to fleet root - `builderKey` in `athena`/`ishtar`/`minerva` only; each host's WG + SSH host keys in its own file - modules updated: `networking.nix`, `sshd.nix`, `buildMachines.nix`, `forgejo-runner.nix`, `lament.nix` - `sops/borg.yaml` split into per-subuser files (`sops/borg/sub{1,2,3,4}.yaml`) - each carries the `Ssh`+`Repo`+`Enc` trio; `Enc` kept for DR, `sub4` pre-provisioned and ready - `sops/pki.yaml` split into `sops/pki/lament.yaml` + `sops/pki/db.yaml` - PK/KEK/GUID -> lament-only; no host needs enrollment keys at runtime - `dbKey`/`dbPem` -> shared `db.yaml` encrypted to `ishtar`/`minerva`/`brigid`; shared key is intentional (one SB hierarchy across trusted hosts) - `lanzaboote.nix` updated to reference `pki/db` - `lamentKey` gated on `cfg.desktop.enable` in `lament.nix` - personal SSH private key no longer materializes on servers - sopsFile points at `privkeys/ishtar` - the only host that should have it - `/var/lib/caddy` persisted on `athena` - caddy is a static user, not covered by the `/var/lib/private` blanket - was borg-backed but not persisted - every reboot re-issued all vhost certs, walking toward LE rate limits - fossils swept - stale `nixbldRemote`/`nixbld user` comments in `deploy.nix` + `nixconf.nix` - `justfile`: `rebase`, `nvd`, `cleanup` removed (git-branch workflows); `update` stripped of its `git add/commit` tail - `CLAUDE.md`: gollum -> wiki-js, `mkDisableOption` removed from helpers list, `impermanent` role -> `postgres` in directory description

lament added 2 commits

2026-07-18 00:42:27 -05:00

seperated sops further c21af0c05a

PKI cleanup

CI / check (pull_request) Successful in 1m54s

Details

CI / deploy (pull_request) Has been skipped

Details

CI / build (pull_request) Successful in 2m45s

Details

CI / dry-activate (pull_request) Successful in 39s

Details