nimmo/nixos-config
Watch
1
0
Fork
You've already forked nixos-config
 0
Code Issues 29 Pull requests Wiki Activity Actions

Complete Electra's post-change Secure Boot recovery archive #42

New issue
Open
opened 2026-07-01 19:37:37 +01:00 by nimmo · 0 comments
nimmo commented 2026-07-01 19:37:37 +01:00
Owner
Copy link

Context

Electra's Secure Boot and TPM hardening is deployed and recovery-tested. The only remaining operational handoff is to create a final post-change archive so the off-host recovery material matches the validated configuration.

Scope

  • Capture current bootctl, sbctl, systemd-pcrlock, signature, and LUKS-token status.
  • Create the post-change encrypted recovery archives, including the required Secure Boot and LUKS recovery material.
  • Restore and inspect the new archives in a temporary test location.
  • Store the verified archives off-host and record where they are held without committing sensitive details.

Completion criteria

  • Current status captures and encrypted archives exist off-host.
  • A restore test confirms the archives are readable and complete.
  • The Secure Boot recovery playbook reflects the final archive contents and verification date.
## Context Electra's Secure Boot and TPM hardening is deployed and recovery-tested. The only remaining operational handoff is to create a final post-change archive so the off-host recovery material matches the validated configuration. ## Scope - Capture current `bootctl`, `sbctl`, systemd-pcrlock, signature, and LUKS-token status. - Create the post-change encrypted recovery archives, including the required Secure Boot and LUKS recovery material. - Restore and inspect the new archives in a temporary test location. - Store the verified archives off-host and record where they are held without committing sensitive details. ## Completion criteria - Current status captures and encrypted archives exist off-host. - A restore test confirms the archives are readable and complete. - The Secure Boot recovery playbook reflects the final archive contents and verification date.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
feat/split-scoped-secrets
cosmos-postgres-vm-stable
electra-sddm-hyprland
pre-electra-disko-migration
Labels
Clear labels   
host:electra
Issues specific to the electra host.

  
host:fleet
Issues that span multiple hosts or the fleet as a whole.

  
host:lyra
Issues specific to the lyra host.

  
host:vega
Issues specific to the vega host.

  
host:vega

   
phase:cutover
The service cutover execution phase.

  
phase:deploy

   
phase:mcp

   
phase:module

   
phase:packaging

   
phase:prep
Preparation and preflight work before service cutover.

  
phase:validation
Post-cutover validation and rollback-window work.

  
project:attic-postgres-lyra-rollout
Issues in the Attic PostgreSQL migration and Lyra rollout workstream.

  
project:auto-update-reliability
Work arising from the automated update reliability review.

  
project:declarative-purity-cleanup
Issues in the declarative purity cleanup workstream.

  
project:external-review
Review of external configurations for ideas and improvements

  
project:host-facts-refactor
Issues in the host facts refactor workstream.

  
project:lyra-nixos-deploy
Issues in the Lyra NixOS deployment workstream.

  
project:lyra-service-stack-migration
Issues in the lyra service stack migration workstream.

  
project:nebula-mesh-network
Issues in the Nebula mesh network workstream.

  
project:security-hardening
Work belonging to the Security Hardening milestone

  
project:service-stack-migration
Issues in the service stack migration workstream.

  
project:vega-sillytavern-cutover
Issues in the Vega SillyTavern cutover workstream.

  
service:auto-update
NixOS flake update, cache build, and consumer deployment automation.

  
service:mem0

   
service:sillytavern
Issues related to the SillyTavern service.

No labels
host:electra
host:fleet
host:lyra
host:vega
host:vega
phase:cutover
phase:deploy
phase:mcp
phase:module
phase:packaging
phase:prep
phase:validation
project:attic-postgres-lyra-rollout
project:auto-update-reliability
project:declarative-purity-cleanup
project:external-review
project:host-facts-refactor
project:lyra-nixos-deploy
project:lyra-service-stack-migration
project:nebula-mesh-network
project:security-hardening
project:service-stack-migration
project:vega-sillytavern-cutover
service:auto-update
service:mem0
service:sillytavern
Milestone
Clear milestone
No items
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
nimmo/nixos-config#42
No description provided.