darmanandClaude Opus 4.8
d9ea6a9ecc
mercury was the only host with no tailscale at all -- no module import, no secret, no key in its sops file. It had been enrolled before the NixOS migration and silently dropped off the tailnet when it was reflashed with a config that omitted it. --accept-dns=false, as on neptun and for a sharper reason: headscale pushes override_local_dns, so accepting MagicDNS would repoint the LAN's own DNS server at 100.100.100.100 and make house-wide name resolution depend on tailscaled being up. This host has already deadlocked once on boot-time DNS (see CLAUDE.md). darman_password is also rotated: the account had "!" in /etc/shadow, because on mercury's first boot the secret wasn't readable yet and update-users-groups.pl falls back to a locked account. mutableUsers is true, so no later rebuild ever revisited it and the lock was permanent. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
28 lines
2.2 KiB
YAML
28 lines
2.2 KiB
YAML
darman_password: ENC[AES256_GCM,data:iZQERcXtyH+91yUc3r7U6jnFYrGQPFeCPk/9ZDfxOhPLlGMX3/iEZ+SzZ7a7rDKUeUAaQUsrqANLDLclRYm4Ngo09EkbDxBx5x2GpQwlqSAS45LHnTen9LTzisWghdy79Xnilq322eaB3g==,iv:ozx/BPLR8nZTKHZroKrrh2z6ZlVCuLydQ3aNY4XvcIg=,tag:CSrq5ZipYxtXTT8RintuHQ==,type:str]
|
|
pihole_webpassword: ENC[AES256_GCM,data:5iOTqD0CcbOCnM1b4+RbajMTyAU=,iv:2ZRW7dshnPzWkuudrn6n92y4Z2n/6fdnBB7BO5/ypS4=,tag:8UZSqJM6dVECQgrF6v5Fuw==,type:str]
|
|
tailscale_authkey: ENC[AES256_GCM,data:CZe1wkh2DNF2g4wy30Wph0c4/3f1M2K9Up+3oAcLEVdZjJzLRJotAU/0Nw2PSGoDZTtqOSfDaEXsaa45DBIJj2EUvWKSYrkV4XkLCio6ZWoGhmxH9PYfkw==,iv:UqNZz7grRPT/d1a2Tv1PW4H2k5FeZCuDy/fK+jVou9E=,tag:cYbLk+7JqU/1by8j2ri0Xg==,type:str]
|
|
sops:
|
|
age:
|
|
- enc: |
|
|
-----BEGIN AGE ENCRYPTED FILE-----
|
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOQUdJRFBlYUYzWTFiaWJn
|
|
SS80UlJ0VWhhQmMzSWc3bkM3Q2NHNHJVT0ZFCmRDdnp5bzhCTHlTK2NseHRVc2Mw
|
|
OVl4QVdNclh5VXhoeGlsWXNLUkxUUE0KLS0tIE5jV1djL1FiTithVjZabTRHTzJ2
|
|
anR2d3V3TXA1L1RMcEtHZ0g3dTZ0dncKtzI9bsQEcuJb5PPuXMkNHOObdSmxxvWl
|
|
D3A1dJu2wnMV6TO5TNVAy9+jyp26RBkdkxoUqlChzBs0kl3/gmJNTA==
|
|
-----END AGE ENCRYPTED FILE-----
|
|
recipient: age1cekcqyf7073fsytcjxaa9dr9zwkmn4vjg36rv2tgxdglzfv4jvxqvcj6z2
|
|
- enc: |
|
|
-----BEGIN AGE ENCRYPTED FILE-----
|
|
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1UWhaT2tOdm02QWgyTkdB
|
|
Ry9XS0Q4U0dEdkhtbHZDVDNtcFRxcDhZOENrCkdmbjFvWUpzdnFEUTg3bjdXN3Rz
|
|
OXAxYUNGdDlxNjNaMlRZRjVFbDhVYjQKLS0tIHB0Z3RaOUJtZEVGTzlBSHRaQjBh
|
|
V0Yza1RVTmJTblBLZFkzZElwWTlmdncKCAiA6NdlpVJmuTbU1/rcTsB9UeGIQPlD
|
|
x6FfYadcRfqvSX60l6+TGdzq6xDpxLIZOJ8q19qZsAvB0in50HW5gg==
|
|
-----END AGE ENCRYPTED FILE-----
|
|
recipient: age1cpty7zrgnn6l97upq00w5wa8zcvnkxkdt2jvhlj97jh83exure4slha43t
|
|
lastmodified: "2026-07-20T08:31:19Z"
|
|
mac: ENC[AES256_GCM,data:kdWGhCOENvnUAnwbLW58JH8Ur+g+f4Z1pr3seZGGOFa04xeXb5HOzegpIH+x7OT5OvsKZsMKWf7sBGgB/nx+m2ZKy4NLC39dLbV8V5hs18NhRKl5vKZBZHE1D2xAK4+REwRYT6LiXArQssPv9e2q5fcW6q3rtnlHMF0tUsWip9o=,iv:BkKv2ZBxZMX4agHTzF2Mcmasxpp+hqkiu9mH0mUeLS4=,tag:t0MeKRPikYR5MAmU8r77sg==,type:str]
|
|
unencrypted_suffix: _unencrypted
|
|
version: 3.13.1
|