nimmo/nixos-config

Watch

Fork 0

02 - Secure and Automate Access to the Nova Build Machine #233

New issue

Closed

opened 2026-09-19 20:26:37 +01:00 by nimmo · 5 comments

nimmo commented

2026-09-19 20:26:37 +01:00

Owner

Goal

Manage client authentication to Nova's dedicated builder identity without manually copying credentials, while keeping build access separate from Forgejo, CI publication, and deployment authority.

Dependencies

Blocked by #232: the builder identity, protocol, and privilege boundary must exist before credentials are distributed.

Requirements

Generate purpose-specific, key-only client credentials; never reuse personal SSH, host, Forgejo, or deployment keys.
Prefer one credential per authorised client/controller so access is attributable and can be revoked independently. A shared key requires an explicit, documented exception and rotation plan.
Use sops-nix to distribute client private keys only to opted-in NixOS hosts with strict ownership and modes.
Manage Nova's corresponding Fedora authorized_keys/account configuration through the documented Fedora procedure until Nova is migrated to NixOS.
Do not distribute the key to CI by default, and do not give the builder identity target-host or Forgejo authority.

Validation

An opted-in client authenticates and submits a build without manual key installation.
A non-opted-in host does not receive a credential.
Revoking one client key blocks that client without interrupting another authorised client.
Verify no client key grants target deployment or Forgejo write access.

## Goal Manage client authentication to Nova's dedicated builder identity without manually copying credentials, while keeping build access separate from Forgejo, CI publication, and deployment authority. ## Dependencies Blocked by #232: the builder identity, protocol, and privilege boundary must exist before credentials are distributed. ## Requirements - Generate purpose-specific, key-only client credentials; never reuse personal SSH, host, Forgejo, or deployment keys. - Prefer one credential per authorised client/controller so access is attributable and can be revoked independently. A shared key requires an explicit, documented exception and rotation plan. - Use sops-nix to distribute client private keys only to opted-in NixOS hosts with strict ownership and modes. - Manage Nova's corresponding Fedora `authorized_keys`/account configuration through the documented Fedora procedure until Nova is migrated to NixOS. - Do not distribute the key to CI by default, and do not give the builder identity target-host or Forgejo authority. ## Validation - An opted-in client authenticates and submits a build without manual key installation. - A non-opted-in host does not receive a credential. - Revoking one client key blocks that client without interrupting another authorised client. - Verify no client key grants target deployment or Forgejo write access.

nimmo added this to the NixOS Build & Deployment Pipeline milestone

2026-09-19 20:26:38 +01:00

nimmo added the

host:fleet

host:nova

phase:prep

project:nixos-build-deployment-pipeline

service:nix

labels

2026-09-19 21:01:03 +01:00

nimmo referenced this issue

2026-09-19 21:01:25 +01:00

03 – Enable NixOS Hosts to Offload Builds to Nova #234

nimmo referenced this issue

2026-09-19 21:42:48 +01:00

feat(nova): establish restricted remote Nix builder #242

nimmo commented

2026-09-19 22:17:51 +01:00

Author

Owner

Working branch: feat/issue-233-nova-builder-credentials (created from current main). This issue will use just test for any activation validation; no switch deployment is in scope.

Working branch: `feat/issue-233-nova-builder-credentials` (created from current `main`). This issue will use `just test` for any activation validation; no `switch` deployment is in scope.

nimmo commented

2026-09-19 22:29:03 +01:00

Author

Owner

Progress on feat/issue-233-nova-builder-credentials:\n\n- Added a Lyra-only SOPS binary secret encrypted to Lyra plus administrative recovery recipients; Vega and other clients are excluded.\n- just test on Lyra succeeded (no switch): the rendered key is root:root, mode 0400, and matches its Nova public key.\n- Nova accepted that key under the existing restricted nix-remote-builder identity. A nix store info request authenticated through the forced command.\n- A deliberately non-substituted derivation with Lyra local jobs disabled was built on Nova and copied back to Lyra.\n- Temporary plaintext key material and Nova staging files were removed. The existing user-created auto-update hold remains active and will be released only after this issue is merged.\n\nThe remaining completion criterion needs a second NixOS client (recommended: Electra): deploy its distinct SOPS key, prove its access, verify a non-opted host does not receive a key, and revoke one client key without disrupting the other.

Progress on `feat/issue-233-nova-builder-credentials`:\n\n- Added a Lyra-only SOPS binary secret encrypted to Lyra plus administrative recovery recipients; Vega and other clients are excluded.\n- `just test` on Lyra succeeded (no `switch`): the rendered key is `root:root`, mode `0400`, and matches its Nova public key.\n- Nova accepted that key under the existing restricted `nix-remote-builder` identity. A `nix store info` request authenticated through the forced command.\n- A deliberately non-substituted derivation with Lyra local jobs disabled was built on Nova and copied back to Lyra.\n- Temporary plaintext key material and Nova staging files were removed. The existing user-created auto-update hold remains active and will be released only after this issue is merged.\n\nThe remaining completion criterion needs a second NixOS client (recommended: Electra): deploy its distinct SOPS key, prove its access, verify a non-opted host does not receive a key, and revoke one client key without disrupting the other.

nimmo commented

2026-09-19 22:32:22 +01:00

Author

Owner

Checkpoint commit: 30e7af1 (feat(nix): provision Lyra Nova builder credential). It includes the Lyra SOPS credential, recipient isolation, durable-client documentation, and removal of the pre-existing duplicate netcat package warning. The branch is intentionally not yet pushed; #233 remains open pending the second-client and independent-revocation validation.

Checkpoint commit: `30e7af1` (`feat(nix): provision Lyra Nova builder credential`). It includes the Lyra SOPS credential, recipient isolation, durable-client documentation, and removal of the pre-existing duplicate netcat package warning. The branch is intentionally not yet pushed; #233 remains open pending the second-client and independent-revocation validation.

nimmo commented

2026-09-19 23:24:19 +01:00

Author

Owner

Electra preparation checkpoint (not yet pushed): 615bc6d adds the independently encrypted Electra credential and 3541303 adds its Electra-only SOPS recipient rule plus root-owned 0400 declaration. Electra preflight is clean, currently booted in igpu, and has no auto-update hold. No Nova authorization line or Electra live activation has been performed yet.

Electra preparation checkpoint (not yet pushed): `615bc6d` adds the independently encrypted Electra credential and `3541303` adds its Electra-only SOPS recipient rule plus root-owned `0400` declaration. Electra preflight is clean, currently booted in `igpu`, and has no auto-update hold. No Nova authorization line or Electra live activation has been performed yet.

nimmo commented

2026-09-20 01:34:50 +01:00

Author

Owner

Completion evidence for the two-client credential boundary (branch remains local/unpushed):\n\n- Electra completed a just test activation without switch; its rendered key is root:root, mode 0400, and has an independent fingerprint from Lyra.\n- Nova now holds exactly the two restricted nix-remote-builder public keys, both under the existing forced nix-store --serve --write SSHD boundary.\n- Electra authenticated to the forced store and submitted a deliberately non-substituted derivation with local jobs disabled; Nova built it and Electra copied the result back.\n- Revocation proof: removing only Lyra’s Nova key denied Lyra (Permission denied, exit 1) while Electra retained remote-store access (exit 0). Lyra’s exact key was restored and revalidated (exit 0).\n- Declarative scope: Vega receives neither credential; Lyra receives only Lyra’s; Electra receives only Electra’s.\n- All temporary key/public-key staging files were removed. Lyra’s user-created auto-update hold remains active and must be released only after the eventual MR merge.

Completion evidence for the two-client credential boundary (branch remains local/unpushed):\n\n- Electra completed a `just test` activation without `switch`; its rendered key is `root:root`, mode `0400`, and has an independent fingerprint from Lyra.\n- Nova now holds exactly the two restricted `nix-remote-builder` public keys, both under the existing forced `nix-store --serve --write` SSHD boundary.\n- Electra authenticated to the forced store and submitted a deliberately non-substituted derivation with local jobs disabled; Nova built it and Electra copied the result back.\n- Revocation proof: removing only Lyra’s Nova key denied Lyra (`Permission denied`, exit 1) while Electra retained remote-store access (exit 0). Lyra’s exact key was restored and revalidated (exit 0).\n- Declarative scope: Vega receives neither credential; Lyra receives only Lyra’s; Electra receives only Electra’s.\n- All temporary key/public-key staging files were removed. Lyra’s user-created auto-update hold remains active and must be released only after the eventual MR merge.

nimmo referenced this issue from a pull request that will close it,

2026-09-20 01:38:10 +01:00

feat(nix): distribute isolated Nova builder credentials #243

nimmo added reference feat/issue-233-nova-builder-credentials

2026-09-20 01:40:05 +01:00

nimmo closed this issue

2026-09-20 01:45:23 +01:00

nimmo referenced this issue

2026-09-20 08:51:43 +01:00

feat(nix): offload workload-host builds to nova #245