darmanandClaude Sonnet 5
7d63ba95df
New on-site host mars runs Hermes Agent as its sole service: joins the
tailnet, mounts jupiter's samba share at /mnt/jupiter (doubling as
Hermes's shared dropbox), and hosts state locally under /var/lib/hermes.
Same Authentik OIDC app/Telegram bot as before, just relocated — neptun's
hermes.mgaction.town vhost now points at mars.orbit.sol instead of jupiter.
hosts/jupiter/hermes-agent.nix and its three sops secrets are removed;
jupiter's Caddy vhost for it is gone too. Also refreshes tailscale_authkey
across all hosts and fixes two stale "erik@laptop" keys in flake.nix's
kexec/installer-iso images (leftover from a previous laptop, already
swapped out of common.nix back in 2fd5752) to darman@terra.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011FHr5ug9pu8q4XPrRkFnzJ
38 lines
1.8 KiB
YAML
38 lines
1.8 KiB
YAML
# sops-nix encryption rules.
|
|
# Secrets under secrets/ are encrypted to the age recipient(s) below.
|
|
# The matching PRIVATE key lives OFF-repo (~/.config/sops/age/keys.txt for
|
|
# editing; /var/lib/sops-nix/key.txt on the host for decryption).
|
|
#
|
|
# Add the host's own age key here later (derived from its ssh host key) so the
|
|
# machine can decrypt without shipping a separate key.
|
|
keys:
|
|
# admin key — for editing secrets on the laptop (~/.config/sops/age/keys.txt)
|
|
- &admin age1cekcqyf7073fsytcjxaa9dr9zwkmn4vjg36rv2tgxdglzfv4jvxqvcj6z2
|
|
# per-host keys — derived from each box's pre-generated SSH host key
|
|
# (ssh-to-age). The host decrypts at runtime using /etc/ssh/ssh_host_ed25519_key.
|
|
- &jupiter age1zak7glavmg4026p2389fyqe769vqm4jrryknuqckgqq4merz5f7q44rkkt
|
|
- &neptun age1hp72xyx2cnd05937e4eww95g5kdtn0wsf9j2nypw330pa69gfdxqn0lpkp
|
|
- &terra age1rfcmu6zh40v4260l9hnf8ajs9vly0s06rx3ey76eu78dp9t7getqyhmkut
|
|
- &mars age1eapjg6tdrr0fuvmgs3q3nlvnjkaxez298qynqqqxt0lpcv0lrsyq7ayxjk
|
|
# mercury (rpi) uses a dedicated age key (SD image, no ssh-host-key delivery);
|
|
# the private key is dropped on its boot partition after flashing.
|
|
- &mercury age1cpty7zrgnn6l97upq00w5wa8zcvnkxkdt2jvhlj97jh83exure4slha43t
|
|
# Each host's secrets go to admin (edit) + that host only. Order matters:
|
|
# the first matching rule wins, so keep these specific paths.
|
|
creation_rules:
|
|
- path_regex: secrets/jupiter\.yaml$
|
|
key_groups:
|
|
- age: [ *admin, *jupiter ]
|
|
- path_regex: secrets/neptun\.yaml$
|
|
key_groups:
|
|
- age: [ *admin, *neptun ]
|
|
- path_regex: secrets/terra\.yaml$
|
|
key_groups:
|
|
- age: [ *admin, *terra ]
|
|
- path_regex: secrets/mars\.yaml$
|
|
key_groups:
|
|
- age: [ *admin, *mars ]
|
|
- path_regex: secrets/mercury\.yaml$
|
|
key_groups:
|
|
- age: [ *admin, *mercury ]
|