08 – Audit Forgejo Write Access Across Workload Hosts #239

New issue

Open

opened 2026-09-19 20:34:01 +01:00 by nimmo · 0 comments

nimmo commented

2026-09-19 20:34:01 +01:00

Owner

Goal

Audit Forgejo credentials on workload hosts and remove only write authority that is genuinely unnecessary. Vega remains an authorised NixOS configuration development and publishing host, so it must retain the ability to push when Electra is unavailable.

Dependencies

Blocked by #236 and informed by #238.

Requirements

Inventory each host's actual Git/Forgejo credentials, privileges, and consumers before any removal.
Preserve Vega's deliberate development and push capability as a recovery path when Electra is unavailable; document its credential, access scope, and operational rationale in the #238 trust-boundary review.
Distinguish write authority from read/deploy-key access. Current fleet configuration uses the primary user's SSH identity for root Nix fetches of private flake inputs, and consumer auto-updates retain legitimate fetch requirements.
For hosts without a development/publishing role, remove or revoke only credentials made unnecessary by the new workflow; preserve or replace required read access with least privilege.
Audit unrelated requirements, including Vega-hosted Forgejo MCP and Paseo/AI integrations, before revocation.

Validation

Publish a host-by-host credential inventory and rationale, explicitly identifying Vega's retained push path. Prove Vega and Lyra receive and activate a new configuration through the remote workflow while supported updates and private inputs still work. Verify that any credential removed from another host is not needed by its documented role.

## Goal Audit Forgejo credentials on workload hosts and remove only write authority that is genuinely unnecessary. **Vega remains an authorised NixOS configuration development and publishing host**, so it must retain the ability to push when Electra is unavailable. ## Dependencies Blocked by #236 and informed by #238. ## Requirements - Inventory each host's actual Git/Forgejo credentials, privileges, and consumers before any removal. - Preserve Vega's deliberate development and push capability as a recovery path when Electra is unavailable; document its credential, access scope, and operational rationale in the #238 trust-boundary review. - Distinguish write authority from read/deploy-key access. Current fleet configuration uses the primary user's SSH identity for root Nix fetches of private flake inputs, and consumer auto-updates retain legitimate fetch requirements. - For hosts without a development/publishing role, remove or revoke only credentials made unnecessary by the new workflow; preserve or replace required read access with least privilege. - Audit unrelated requirements, including Vega-hosted Forgejo MCP and Paseo/AI integrations, before revocation. ## Validation Publish a host-by-host credential inventory and rationale, explicitly identifying Vega's retained push path. Prove Vega and Lyra receive and activate a new configuration through the remote workflow while supported updates and private inputs still work. Verify that any credential removed from another host is not needed by its documented role.

nimmo added this to the NixOS Build & Deployment Pipeline milestone

2026-09-19 20:34:01 +01:00

nimmo added the

project:nixos-build-deployment-pipeline

service:nix

labels

2026-09-19 21:02:17 +01:00