alexion/dotfiles
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: plan sops secrets with two-tier age identities

Browse Source 
Supersede ADR 0001's SSH-derived key mechanism with an admin identity held
outside the repo plus a per-host identity on each encrypted root. Decoupling
the two is what lets the SSH host keys become secrets themselves rather than
the root of trust they were.

Add the spec, the three implementing tasks, and the glossary terms the
breakdown speaks in.
This commit is contained in:
alexion
2026-07-19 14:57:41 -04:00
parent 7cd9370366
commit 5e254857b9
7 changed files with 290 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
.claude/adr/0001-sops-nix-for-secrets.md
View File

@@ -1,3 +1,7 @@
---
status: superseded by ADR-0002
---
# Use sops-nix for secrets
The repo is public, so no secret — including password hashes and the WireGuard/ProtonVPN key — may be committed in plaintext. We manage all secrets with **sops-nix**: encrypted into the repo and decrypted per-host at activation via an age key derived from each machine's SSH host key.