kebado.net/nixos-servers
Watch
4
0
Fork
You've already forked nixos-servers
 0
Code Issues 10 Pull requests 1 Projects Releases Packages Wiki Activity Actions

setup-machine: Add and deploy new host key automatically #8

New issue
Open
opened 2026-05-20 07:07:31 +00:00 by barnett · 0 comments
barnett commented 2026-05-20 07:07:31 +00:00
Owner
Copy link

Right now, when setting up a new machine that will require secrets immediately, one must generally:

  1. Run age-keygen -pq -o newhost.keys.txt to get the private key.
  2. Add the public key from age-keygen -y newhost.keys.txt to .sops.yaml .
  3. Create or rotate the secrets in the new host directory based on the new entries in .sops.yaml.
  4. Stage newhost.keys.txt in a small extra-files tree under etc/age.
  5. Pass --extra-files to nixos-anywhere to ensure it gets copied.

This should be automatable:

  1. Let the user create new secrets with only their user key at first when configuring a new host.
  2. On first deployment, a script should:
    1. Generate a key into a temporary folder following the etc/age structure.
    2. Add it to .sops.yaml with yq for the new host folder.
    3. Run sops updatekeys to rotate in the new key.
    4. Call nixos-anywhere while passing the temporary folder as --extra-files.
    5. Destroy the temporary folder afterwards.
Right now, when setting up a new machine that will require secrets immediately, one must generally: 1. Run `age-keygen -pq -o newhost.keys.txt` to get the private key. 2. Add the public key from `age-keygen -y newhost.keys.txt` to `.sops.yaml` . 3. Create or rotate the secrets in the new host directory based on the new entries in `.sops.yaml`. 4. Stage newhost.keys.txt in a small extra-files tree under `etc/age`. 5. Pass `--extra-files` to `nixos-anywhere` to ensure it gets copied. This should be automatable: 1. Let the user create new secrets with only their user key at first when configuring a new host. 2. On first deployment, a script should: 1. Generate a key into a temporary folder following the `etc/age` structure. 2. Add it to `.sops.yaml` with `yq` for the new host folder. 3. Run `sops updatekeys` to rotate in the new key. 4. Call `nixos-anywhere` while passing the temporary folder as `--extra-files`. 5. Destroy the temporary folder afterwards.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
renovate_container
renovate/lock-file-maintenance
colmena
No results found.
Labels
Clear labels
  
bug
Something is not working

  
duplicate
This issue or pull request already exists

  
enhancement
New feature

  
help wanted
Need some help

  
invalid
Something is wrong

  
question
More information is needed

  
wontfix
This won't be fixed

No labels
bug
duplicate
enhancement
help wanted
invalid
question
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kebado.net/nixos-servers#8
No description provided.