alexion
d637d3e7f6
Add a `secrets` placement option to the guest builder: a list of secret names. The host declares each as one of its own sops secrets, so the host is the sole decryptor from the sops files it already holds, and the decrypted file is bind-mounted into the guest read-only at the same `/run/secrets/<name>` path it occupies on a host. A service inside the guest reads its credentials at a predictable location while the guest carries no age key and decrypts nothing itself. Ownership needs no new code: the container already runs in the host's uid and gid space one to one, so the decrypted file's host owner is its owner inside the guest. Assert that no in-guest path is claimed by both a mount and a secret, so the attribute-set merge fails loudly rather than resolving a collision silently in the secret's favour.