nimmo/nixos-config

Watch

Fork 0

feat(nix): distribute isolated Nova builder credentials #243

Merged

nimmo merged 3 commits from feat/issue-233-nova-builder-credentials into main

2026-09-20 01:45:22 +01:00

nimmo commented

2026-09-20 01:38:07 +01:00

Owner

Closes #233.

Scope:

Distributes independent root-only SOPS binary credentials to Lyra and Electra.
Limits each encrypted credential to its respective host plus administrative recovery recipients.
Documents the restricted Nova builder credential boundary.
Removes the unrelated duplicate GNU netcat package from the server baseline.

Validation:

nix flake check completed without diagnostics.
just test succeeded on Lyra; no switch was used.
Electra completed a just test activation and has its credential at root:root, mode 0400.
Both clients authenticated to Nova and each submitted a deliberately non-substituted derivation with local jobs disabled; Nova built the derivations and returned the outputs.
Revoking only the Lyra Nova key denied Lyra while Electra continued to access the remote store; Lyra was restored and revalidated.
Declarative evaluation confirms Vega receives neither key and each opted-in client receives only its own.

The user-created Lyra auto-update hold remains active and must be released after this MR merges.

Closes #233. Scope: - Distributes independent root-only SOPS binary credentials to Lyra and Electra. - Limits each encrypted credential to its respective host plus administrative recovery recipients. - Documents the restricted Nova builder credential boundary. - Removes the unrelated duplicate GNU netcat package from the server baseline. Validation: - nix flake check completed without diagnostics. - just test succeeded on Lyra; no switch was used. - Electra completed a just test activation and has its credential at root:root, mode 0400. - Both clients authenticated to Nova and each submitted a deliberately non-substituted derivation with local jobs disabled; Nova built the derivations and returned the outputs. - Revoking only the Lyra Nova key denied Lyra while Electra continued to access the remote store; Lyra was restored and revalidated. - Declarative evaluation confirms Vega receives neither key and each opted-in client receives only its own. The user-created Lyra auto-update hold remains active and must be released after this MR merges.

nimmo added this to the NixOS Build & Deployment Pipeline milestone

2026-09-20 01:38:07 +01:00

nimmo added the

host:fleet

host:nova

phase:prep

project:nixos-build-deployment-pipeline

service:nix

labels

2026-09-20 01:38:08 +01:00

nimmo added 3 commits

2026-09-20 01:38:10 +01:00

feat(nix): provision Lyra Nova builder credential 30e7af18d0

feat(nix): add Electra builder credential 615bc6dc39

config(electra): install builder credential

Build and Push Attic Cache / test (pull_request) Successful in 1m45s

Details

AI pull-request review / review (pull_request) Successful in 1m53s

Details

Build and Push Attic Cache / build (pull_request) Has been skipped

Details

Build and Push Attic Cache / pin-lifecycle (pull_request) Has been skipped

Details

Build and Push Attic Cache / remediate (pull_request) Has been skipped

Details

Build and Push Attic Cache / notify-remediation (pull_request) Has been skipped

Details

Build and Push Attic Cache / record-remediation-notify-failure (pull_request) Has been skipped

Details

354130339f

nimmo commented

2026-09-20 01:40:07 +01:00

Author

Owner

Automated code review

Reviewed commit: 354130339f55b8d70bac8eea3f09f7157438bfdd

Verdict: Requires further work

Resolve the blocking or important findings and investigate failed deterministic checks before merging.

Overall assessment

The PR introduces isolated SOPS-managed SSH keys for Nix remote builders on Lyra and Electra, configures .sops.yaml with host-specific recipient groups, installs secrets with restrictive permissions, and removes an unnecessary netcat-gnu dependency. Validation confirms correct decryption, installation, and functional remote builds.

Blocking findings

None.

Important findings

Missing SOPS Recipient Anchors in Diff Context (.sops.yaml:97; high confidence)
The diff adds rules referencing *lyra and *electra anchors. The human reply states these are defined at the top of .sops.yaml, but this definition is not present in the supplied diff.
Impact: If the anchors *lyra and *electra are not correctly defined in the full file, SOPS operations will fail with 'unknown anchor' errors.
Suggested fix: Verify that *lyra and *electra are defined as YAML anchors mapping to the correct age public keys in the .sops.yaml file outside the diff context.

Suggestions

Documentation References Future Issue #234 (docs/nova-remote-builder.md:175; medium confidence)
The documentation states: '#234 will consume it when Electra explicitly opts in...'
Impact: Users relying on this documentation might expect immediate functionality or be confused by the reference to a future issue.
Suggested fix: Ensure Issue #234 is linked or tracked appropriately, or update the documentation if the consumption mechanism changes.

Tests and validation

No configured deterministic checks.

Questions

The human reply confirms that *lyra and *electra anchors exist in .sops.yaml. Can you confirm their exact values to ensure they match the recipients in the encrypted secrets?

Review limitations

The review relies on the provided diff and human replies; it does not inspect the live system state or the full content of .sops.yaml outside the diff.
The actual decryption keys and their validity are not verified, only the structure and configuration.

Diff coverage

.sops.yaml: reviewed — included in a context-limited batch
docs/nova-remote-builder.md: reviewed — included in a context-limited batch
hosts/electra/default.nix: reviewed — included in a context-limited batch
hosts/lyra/default.nix: reviewed — included in a context-limited batch
modules/server/base.nix: reviewed — included in a context-limited batch
secrets/nix-remote-builders/electra.json: reviewed — included in a context-limited batch
secrets/nix-remote-builders/lyra.json: reviewed — included in a context-limited batch

Review metadata

Reviewer: forgejo-ai-review v1
Model: qwen3.6:35b-a3b-q8_0
Guidance loaded: .forgejo/ai-review.md, .forgejo/ai-review.yml, AGENTS.md, docs/auto-update-remediation.md, docs/nova-remote-builder.md, README.md
Commits considered: 3
Previous automated review: updated
Findings: 2

## Automated code review Reviewed commit: `354130339f55b8d70bac8eea3f09f7157438bfdd` ## Verdict: Requires further work Resolve the blocking or important findings and investigate failed deterministic checks before merging. ### Overall assessment The PR introduces isolated SOPS-managed SSH keys for Nix remote builders on Lyra and Electra, configures `.sops.yaml` with host-specific recipient groups, installs secrets with restrictive permissions, and removes an unnecessary `netcat-gnu` dependency. Validation confirms correct decryption, installation, and functional remote builds. ### Blocking findings None. ### Important findings - **Missing SOPS Recipient Anchors in Diff Context** (.sops.yaml:97; high confidence) The diff adds rules referencing `*lyra` and `*electra` anchors. The human reply states these are defined at the top of `.sops.yaml`, but this definition is not present in the supplied diff. Impact: If the anchors `*lyra` and `*electra` are not correctly defined in the full file, SOPS operations will fail with 'unknown anchor' errors. Suggested fix: Verify that `*lyra` and `*electra` are defined as YAML anchors mapping to the correct age public keys in the `.sops.yaml` file outside the diff context. ### Suggestions - **Documentation References Future Issue #234** (docs/nova-remote-builder.md:175; medium confidence) The documentation states: '#234 will consume it when Electra explicitly opts in...' Impact: Users relying on this documentation might expect immediate functionality or be confused by the reference to a future issue. Suggested fix: Ensure Issue #234 is linked or tracked appropriately, or update the documentation if the consumption mechanism changes. ### Tests and validation - No configured deterministic checks. ### Questions - The human reply confirms that `*lyra` and `*electra` anchors exist in `.sops.yaml`. Can you confirm their exact values to ensure they match the recipients in the encrypted secrets? ### Review limitations - The review relies on the provided diff and human replies; it does not inspect the live system state or the full content of `.sops.yaml` outside the diff. - The actual decryption keys and their validity are not verified, only the structure and configuration. ### Diff coverage - `.sops.yaml`: **reviewed** — included in a context-limited batch - `docs/nova-remote-builder.md`: **reviewed** — included in a context-limited batch - `hosts/electra/default.nix`: **reviewed** — included in a context-limited batch - `hosts/lyra/default.nix`: **reviewed** — included in a context-limited batch - `modules/server/base.nix`: **reviewed** — included in a context-limited batch - `secrets/nix-remote-builders/electra.json`: **reviewed** — included in a context-limited batch - `secrets/nix-remote-builders/lyra.json`: **reviewed** — included in a context-limited batch <details><summary>Review metadata</summary> - Reviewer: forgejo-ai-review v1 - Model: qwen3.6:35b-a3b-q8_0 - Guidance loaded: .forgejo/ai-review.md, .forgejo/ai-review.yml, AGENTS.md, docs/auto-update-remediation.md, docs/nova-remote-builder.md, README.md - Commits considered: 3 - Previous automated review: updated - Findings: 2 </details>

nimmo commented

2026-09-20 01:41:57 +01:00

Author

Owner

Review follow-up:\n\n- The claimed missing aliases are already defined at the top of .sops.yaml: electra and lyra map to their respective age public keys. The new rules reference those existing anchors.\n- The recipient mappings are verified live, not just inferred: just test successfully decrypted and installed both binary SOPS secrets on their intended hosts. Lyra and Electra each rendered its own root:root mode-0400 key.\n- Nova authorization and remote builds were live-validated for both keys.\n- The netcat-gnu removal is intentional: server/base imports common/system, which already supplies netcat-openbsd. Repository-wide search found no GNU-netcat-specific consumers; the follow-up just test on Lyra removed the prior nc collision warning.\n- Issue #234 exists and is the declared successor that will consume these credentials.\n\nNo code change is needed for these diff-context limitations. Please reassess using this reply and the validation evidence in #233/MR description.

nimmo commented

2026-09-20 01:45:08 +01:00

Author

Owner

Final review confirmation:

*electra is defined in the tracked .sops.yaml as age1qkndq2jf4ezw3gp2mrq76xhh8u5aczkrux23wxgw35y9pmejj99s90s46l.
*lyra is defined in the same file as age1sxaj9le979k69925p7emxr34m6r78xd9ksnzeuytxm9szzymrgdqhm26kh.

Those exact public recipients are the host-specific entries used by the corresponding creation rules. The successful just test secret decryption on each respective host independently verifies that mapping. Issue #234 is already open and is the tracked consumer for the opt-in builder configuration.

Final review confirmation: - `*electra` is defined in the tracked `.sops.yaml` as `age1qkndq2jf4ezw3gp2mrq76xhh8u5aczkrux23wxgw35y9pmejj99s90s46l`. - `*lyra` is defined in the same file as `age1sxaj9le979k69925p7emxr34m6r78xd9ksnzeuytxm9szzymrgdqhm26kh`. Those exact public recipients are the host-specific entries used by the corresponding creation rules. The successful `just test` secret decryption on each respective host independently verifies that mapping. Issue #234 is already open and is the tracked consumer for the opt-in builder configuration.

nimmo merged commit 4e19e863ab into main

2026-09-20 01:45:22 +01:00

nimmo referenced this pull request from a commit

2026-09-20 01:45:23 +01:00

Merge pull request 'feat(nix): distribute isolated Nova builder credentials' (#243) from feat/issue-233-nova-builder-credentials into main