Refactor nebula host keys out of secrets/secrets.yaml into dedicated file #74

New issue

Closed

opened 2026-07-19 17:28:52 +01:00 by nimmo · 0 comments

nimmo commented

2026-07-19 17:28:52 +01:00

Owner

Problem

All nebula private keys are currently stored as individual entries inside secrets/secrets.yaml under the ["nebula"]["host-key"] path. This mixes per-host secrets with every other secret in the repo, making key rotation harder to audit and violating the principle of separating CA-issued host secrets into their own encrypted file.

Goal

Move each nebula host key from secrets/secrets.yaml into a dedicated SOPS file (e.g. secrets/nebula-hosts.yaml), or at minimum ensure they are logically grouped and clearly separated from unrelated service secrets.

Considerations

The current SOPS creation rules in .sops.yaml govern secrets/nebula-ca.yaml (restricted to admin machines + YubiKeys). Any new/separate file needs matching rules.
Current key reference path: sops.secrets."nebula/${hostname}-key" → resolved from secrets/secrets.yaml. If we move keys, the SOPS file path in the nebula module (../../secrets/secrets.yaml) would need updating too, or we'd introduce a new SOPS reference.
The just nebula-add-host recipe writes keys directly into secrets.yaml today. Refactoring here requires updating that Just recipe as well.

Scope

Audit current key placement in secrets.yaml (all hosts: vega, lyra, nova, mass-storage, media1, nimmog-de, electra, lena, phone)
Decide on target structure (dedicated file vs. logical grouping within secrets.yaml)
Add/update .sops.yaml creation rules for the new file location if applicable
Update modules/networking/nebula.nix — SOPS file reference for host keys
Update justfiles/nebula.just — nebula-add-host and nebula-reissue to write to the new location
Migrate all existing keys (run migrate recipe or manual process per host)
Commit, deploy, verify nebula still works on all hosts

## Problem All nebula private keys are currently stored as individual entries inside `secrets/secrets.yaml` under the `["nebula"]["host-key"]` path. This mixes per-host secrets with every other secret in the repo, making key rotation harder to audit and violating the principle of separating CA-issued host secrets into their own encrypted file. ## Goal Move each nebula host key from `secrets/secrets.yaml` into a dedicated SOPS file (e.g. `secrets/nebula-hosts.yaml`), or at minimum ensure they are logically grouped and clearly separated from unrelated service secrets. ## Considerations - The current SOPS creation rules in `.sops.yaml` govern `secrets/nebula-ca.yaml` (restricted to admin machines + YubiKeys). Any new/separate file needs matching rules. - Current key reference path: `sops.secrets."nebula/${hostname}-key"` → resolved from `secrets/secrets.yaml`. If we move keys, the SOPS file path in the nebula module (`../../secrets/secrets.yaml`) would need updating too, or we'd introduce a new SOPS reference. - The `just nebula-add-host` recipe writes keys directly into secrets.yaml today. Refactoring here requires updating that Just recipe as well. ## Scope - Audit current key placement in secrets.yaml (all hosts: vega, lyra, nova, mass-storage, media1, nimmog-de, electra, lena, phone) - Decide on target structure (dedicated file vs. logical grouping within `secrets.yaml`) - Add/update `.sops.yaml` creation rules for the new file location if applicable - Update `modules/networking/nebula.nix` — SOPS file reference for host keys - Update `justfiles/nebula.just` — `nebula-add-host` and `nebula-reissue` to write to the new location - Migrate all existing keys (run migrate recipe or manual process per host) - Commit, deploy, verify nebula still works on all hosts

nimmo added this to the Nebula Mesh Network milestone

2026-07-19 17:28:52 +01:00

nimmo

2026-07-19 17:29:09 +01:00