nimmo/nixos-config

Watch

Fork 0

feat(newt): add native Lyra tunnel client #160

Merged

nimmo merged 2 commits from issue-16-network-exposure into main

2026-08-10 19:13:51 +01:00

nimmo commented

2026-08-10 18:33:25 +01:00

Owner

Summary

add a native, SOPS-backed Newt client to Lyra
make every Newt-enabled host declare its own credential file explicitly
add the SOPS creation rule for the Lyra Newt identity

Scope

Refs #16. This is an intentionally partial prerequisite and does not close the issue. It prepares Lyra to route Attic through a loopback Newt target; #16 remains open for the subsequent shared Attic loopback/firewall change on Lyra and Vega, plus the broader exposure-posture work.

Validation

nix flake check
verified the encrypted Lyra secret uses the lyra/env key with age recipients; no secret values were read

Deployment evidence still required

Deploy the branch to Lyra, confirm the native Newt client is healthy without a duplicate legacy Docker client, then change the Lyra Attic target to 127.0.0.1:8081 and verify its Pangolin health check.

## Summary - add a native, SOPS-backed Newt client to Lyra - make every Newt-enabled host declare its own credential file explicitly - add the SOPS creation rule for the Lyra Newt identity ## Scope Refs #16. This is an intentionally partial prerequisite and does **not** close the issue. It prepares Lyra to route Attic through a loopback Newt target; #16 remains open for the subsequent shared Attic loopback/firewall change on Lyra and Vega, plus the broader exposure-posture work. ## Validation - `nix flake check` - verified the encrypted Lyra secret uses the `lyra/env` key with age recipients; no secret values were read ## Deployment evidence still required Deploy the branch to Lyra, confirm the native Newt client is healthy without a duplicate legacy Docker client, then change the Lyra Attic target to `127.0.0.1:8081` and verify its Pangolin health check.

nimmo added this to the Host Facts Refactor milestone

2026-08-10 18:33:25 +01:00

nimmo added 1 commit

2026-08-10 18:33:25 +01:00

feat(newt): add native Lyra tunnel client

Build and Push Attic Cache / test (pull_request) Successful in 1m13s

Details

Build and Push Attic Cache / build (pull_request) Has been skipped

Details

Build and Push Attic Cache / pin-lifecycle (pull_request) Has been skipped

Details

Build and Push Attic Cache / remediate (pull_request) Has been skipped

Details

AI pull-request review / review (pull_request) Successful in 3m10s

Details

b355f1aee8

nimmo commented

2026-08-10 18:36:35 +01:00

Author

Owner

Automated code review

Reviewed commit: 473caf86cdd5a37b1af1c7ff8814c1237693c76f

Verdict: Requires further work

Resolve the blocking or important findings and investigate failed deterministic checks before merging.

Overall assessment

Refactors the Newt service module to require explicit host-specific SOPS credential paths, removing the previous hostname-based default. Adds native Lyra tunnel client support with a new SOPS-encrypted secret and corresponding .sops.yaml creation rule. All currently enabled hosts in the diff are updated to comply with the new required option.

Blocking findings

None.

Important findings

Removed default for sopsFile requires explicit configuration on all Newt-enabled hosts (modules/services/newt.nix:39; high confidence)
Diff removes the default value for the sopsFile option and updates its description to state it is required. Host configs for chaos, lyra, and vega are updated to provide explicit paths.
Impact: Any host, profile, or specialisation enabling newt.enable without setting sopsFile will fail NixOS evaluation.
Suggested fix: Search the repository to confirm no other hosts or profiles enable the module outside the three updated files. Update documentation to reflect the mandatory option.
Verify SOPS alias resolution matches encrypted recipient keys (.sops.yaml:264; high confidence)
New creation rule for secrets/newt/lyra.yaml$ references aliases (*lyra, *yubikey-nano5c, etc.). The encrypted file uses specific age public keys as recipients.
Impact: If the aliases in .sops.yaml do not resolve to the exact recipient keys used during encryption, SOPS decryption will fail during deployment or runtime.
Suggested fix: Cross-reference the age public keys listed as recipients in secrets/newt/lyra.yaml with the alias definitions in .sops.yaml. Test local decryption before merging.

Suggestions

Validate relative path resolution for sopsFile across environments (hosts/chaos/default.nix:112; medium confidence)
Host configs pass relative paths (e.g., ../../secrets/newt/chaos.yaml) to the module option.
Impact: NixOS path evaluation depends on the import context. Changes to module or host locations may break these relative references.
Suggested fix: Confirm the paths resolve correctly from the flake root and module import location. Consider absolute flake-relative paths if evaluation becomes environment-dependent.

Tests and validation

No configured deterministic checks.

Questions

Are there any other hosts, profiles, or specialisations that enable the Newt service which were not updated in this PR?
Do the age recipient keys in secrets/newt/lyra.yaml exactly match the aliases defined in .sops.yaml?

Review limitations

Review is based solely on provided diff and text; cannot run nix flake check or validate runtime service behavior.
Cannot verify actual SOPS decryption or connectivity of the new Lyra tunnel client without deployment evidence.
Alias definitions for *lyra, *yubikey-nano5c, etc. are not included in the diff, so cross-referencing is structural only.

Diff coverage

.sops.yaml: reviewed — included in a context-limited batch
hosts/chaos/default.nix: reviewed — included in a context-limited batch
hosts/lyra/default.nix: reviewed — included in a context-limited batch
hosts/vega/default.nix: reviewed — included in a context-limited batch
modules/services/newt.nix: reviewed — included in a context-limited batch
secrets/newt/lyra.yaml: reviewed — included in a context-limited batch

Review metadata

Reviewer: forgejo-ai-review v1
Model: qwen3.6:35b-a3b-q8_0
Guidance loaded: .forgejo/ai-review.md, .forgejo/ai-review.yml, AGENTS.md, README.md
Commits considered: 2
Previous automated review: updated
Findings: 3

## Automated code review Reviewed commit: `473caf86cdd5a37b1af1c7ff8814c1237693c76f` ## Verdict: Requires further work Resolve the blocking or important findings and investigate failed deterministic checks before merging. ### Overall assessment Refactors the Newt service module to require explicit host-specific SOPS credential paths, removing the previous hostname-based default. Adds native Lyra tunnel client support with a new SOPS-encrypted secret and corresponding .sops.yaml creation rule. All currently enabled hosts in the diff are updated to comply with the new required option. ### Blocking findings None. ### Important findings - **Removed default for sopsFile requires explicit configuration on all Newt-enabled hosts** (modules/services/newt.nix:39; high confidence) Diff removes the default value for the sopsFile option and updates its description to state it is required. Host configs for chaos, lyra, and vega are updated to provide explicit paths. Impact: Any host, profile, or specialisation enabling newt.enable without setting sopsFile will fail NixOS evaluation. Suggested fix: Search the repository to confirm no other hosts or profiles enable the module outside the three updated files. Update documentation to reflect the mandatory option. - **Verify SOPS alias resolution matches encrypted recipient keys** (.sops.yaml:264; high confidence) New creation rule for secrets/newt/lyra\.yaml$ references aliases (*lyra, *yubikey-nano5c, etc.). The encrypted file uses specific age public keys as recipients. Impact: If the aliases in .sops.yaml do not resolve to the exact recipient keys used during encryption, SOPS decryption will fail during deployment or runtime. Suggested fix: Cross-reference the age public keys listed as recipients in secrets/newt/lyra.yaml with the alias definitions in .sops.yaml. Test local decryption before merging. ### Suggestions - **Validate relative path resolution for sopsFile across environments** (hosts/chaos/default.nix:112; medium confidence) Host configs pass relative paths (e.g., ../../secrets/newt/chaos.yaml) to the module option. Impact: NixOS path evaluation depends on the import context. Changes to module or host locations may break these relative references. Suggested fix: Confirm the paths resolve correctly from the flake root and module import location. Consider absolute flake-relative paths if evaluation becomes environment-dependent. ### Tests and validation - No configured deterministic checks. ### Questions - Are there any other hosts, profiles, or specialisations that enable the Newt service which were not updated in this PR? - Do the age recipient keys in secrets/newt/lyra.yaml exactly match the aliases defined in .sops.yaml? ### Review limitations - Review is based solely on provided diff and text; cannot run nix flake check or validate runtime service behavior. - Cannot verify actual SOPS decryption or connectivity of the new Lyra tunnel client without deployment evidence. - Alias definitions for *lyra, *yubikey-nano5c, etc. are not included in the diff, so cross-referencing is structural only. ### Diff coverage - `.sops.yaml`: **reviewed** — included in a context-limited batch - `hosts/chaos/default.nix`: **reviewed** — included in a context-limited batch - `hosts/lyra/default.nix`: **reviewed** — included in a context-limited batch - `hosts/vega/default.nix`: **reviewed** — included in a context-limited batch - `modules/services/newt.nix`: **reviewed** — included in a context-limited batch - `secrets/newt/lyra.yaml`: **reviewed** — included in a context-limited batch <details><summary>Review metadata</summary> - Reviewer: forgejo-ai-review v1 - Model: qwen3.6:35b-a3b-q8_0 - Guidance loaded: .forgejo/ai-review.md, .forgejo/ai-review.yml, AGENTS.md, README.md - Commits considered: 2 - Previous automated review: updated - Findings: 3 </details>

nimmo added 1 commit

2026-08-10 18:55:37 +01:00

docs(newt): require explicit credential files

Build and Push Attic Cache / test (pull_request) Successful in 1m11s

Details

Build and Push Attic Cache / build (pull_request) Has been skipped

Details

Build and Push Attic Cache / pin-lifecycle (pull_request) Has been skipped

Details

Build and Push Attic Cache / remediate (pull_request) Has been skipped

Details

AI pull-request review / review (pull_request) Successful in 3m58s

Details

473caf86cd

nimmo commented

2026-08-10 19:05:34 +01:00

Author

Owner

Automated-review follow-up for 473caf8:

Repository-wide search confirms that only Vega, Lyra, and Chaos import and enable the Newt module; all three now set sopsFile explicitly.
Without decrypting the Lyra secret, verified it is encrypted and its four public age recipients exactly match the *lyra, *yubikey-nano5c, *yubikey-5-nfc, and *provision-key aliases in .sops.yaml.
nix flake check passed after the relative host paths were added, validating their Nix evaluation.

The review identified no remaining code change. Runtime deployment evidence remains the PR blocker.

Automated-review follow-up for `473caf8`: - Repository-wide search confirms that only Vega, Lyra, and Chaos import and enable the Newt module; all three now set `sopsFile` explicitly. - Without decrypting the Lyra secret, verified it is encrypted and its four public age recipients exactly match the `*lyra`, `*yubikey-nano5c`, `*yubikey-5-nfc`, and `*provision-key` aliases in `.sops.yaml`. - `nix flake check` passed after the relative host paths were added, validating their Nix evaluation. The review identified no remaining code change. Runtime deployment evidence remains the PR blocker.

nimmo merged commit 552cb0bec0 into main

2026-08-10 19:13:51 +01:00

nimmo deleted branch issue-16-network-exposure

2026-08-10 19:13:52 +01:00

nimmo referenced this pull request from a commit

2026-08-10 19:13:52 +01:00

Merge pull request 'feat(newt): add native Lyra tunnel client' (#160) from issue-16-network-exposure into main