nimmo/nixos-config
Watch
1
0
Fork
You've already forked nixos-config
 0
Code Issues 29 Pull requests Wiki Activity Actions

Prepare lyra SOPS bootstrap and validate the repo for deployment #18

New issue
Closed
opened 2026-07-01 16:16:59 +01:00 by nimmo · 0 comments
nimmo commented 2026-07-01 16:16:59 +01:00
Owner
Copy link

Goal

Finish the repo-side preparation needed before wiping and deploying lyra via nixos-anywhere.

Acceptance Checklist

  • Generate the dedicated SSH host key for lyra.
  • Add the printed age public key to .sops.yaml.
  • Add *lyra to the relevant SOPS creation rule group.
  • Re-encrypt the relevant secrets.
  • Stage the new tracked files before validation.
  • Run nix flake check successfully for the updated config.

Procedure Outline

  1. Generate /tmp/lyra_ssh_host_ed25519_key and derive the age recipient.
  2. Update .sops.yaml.
  3. Run sops updatekeys secrets/secrets.yaml.
  4. Stage hosts/lyra, secrets/secrets.yaml, and .sops.yaml.
  5. Run the usual filtered nix flake check.

Notes

This issue covers the repo-prep section of projects/lyra-nixos-anywhere-deploy.md and must finish before any destructive deploy step.

## Goal Finish the repo-side preparation needed before wiping and deploying `lyra` via `nixos-anywhere`. ## Acceptance Checklist - Generate the dedicated SSH host key for `lyra`. - Add the printed age public key to `.sops.yaml`. - Add `*lyra` to the relevant SOPS creation rule group. - Re-encrypt the relevant secrets. - Stage the new tracked files before validation. - Run `nix flake check` successfully for the updated config. ## Procedure Outline 1. Generate `/tmp/lyra_ssh_host_ed25519_key` and derive the age recipient. 2. Update `.sops.yaml`. 3. Run `sops updatekeys secrets/secrets.yaml`. 4. Stage `hosts/lyra`, `secrets/secrets.yaml`, and `.sops.yaml`. 5. Run the usual filtered `nix flake check`. ## Notes This issue covers the repo-prep section of `projects/lyra-nixos-anywhere-deploy.md` and must finish before any destructive deploy step.
nimmo closed this issue 2026-07-11 12:31:28 +01:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
feat/split-scoped-secrets
cosmos-postgres-vm-stable
electra-sddm-hyprland
pre-electra-disko-migration
Labels
Clear labels   
host:electra
Issues specific to the electra host.

  
host:fleet
Issues that span multiple hosts or the fleet as a whole.

  
host:lyra
Issues specific to the lyra host.

  
host:vega
Issues specific to the vega host.

  
host:vega

   
phase:cutover
The service cutover execution phase.

  
phase:deploy

   
phase:mcp

   
phase:module

   
phase:packaging

   
phase:prep
Preparation and preflight work before service cutover.

  
phase:validation
Post-cutover validation and rollback-window work.

  
project:attic-postgres-lyra-rollout
Issues in the Attic PostgreSQL migration and Lyra rollout workstream.

  
project:auto-update-reliability
Work arising from the automated update reliability review.

  
project:declarative-purity-cleanup
Issues in the declarative purity cleanup workstream.

  
project:external-review
Review of external configurations for ideas and improvements

  
project:host-facts-refactor
Issues in the host facts refactor workstream.

  
project:lyra-nixos-deploy
Issues in the Lyra NixOS deployment workstream.

  
project:lyra-service-stack-migration
Issues in the lyra service stack migration workstream.

  
project:nebula-mesh-network
Issues in the Nebula mesh network workstream.

  
project:security-hardening
Work belonging to the Security Hardening milestone

  
project:service-stack-migration
Issues in the service stack migration workstream.

  
project:vega-sillytavern-cutover
Issues in the Vega SillyTavern cutover workstream.

  
service:auto-update
NixOS flake update, cache build, and consumer deployment automation.

  
service:mem0

   
service:sillytavern
Issues related to the SillyTavern service.

No labels
host:electra
host:fleet
host:lyra
host:vega
host:vega
phase:cutover
phase:deploy
phase:mcp
phase:module
phase:packaging
phase:prep
phase:validation
project:attic-postgres-lyra-rollout
project:auto-update-reliability
project:declarative-purity-cleanup
project:external-review
project:host-facts-refactor
project:lyra-nixos-deploy
project:lyra-service-stack-migration
project:nebula-mesh-network
project:security-hardening
project:service-stack-migration
project:vega-sillytavern-cutover
service:auto-update
service:mem0
service:sillytavern
Milestone
Clear milestone
No items
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
nimmo/nixos-config#18
No description provided.