Bos55/nix-config
2
Fork 1
Code Issues 2 Pull requests Projects Releases Packages Wiki Activity

chore: add master keys

Browse source
This commit is contained in:
Tibo De Peuter 2026-07-24 18:40:31 +02:00
parent 86b42b7f25
commit d125848b82
Signed by: tdpeuter
SSH key fingerprint: SHA256:u/h/LVoqKF1Iz02uOyxe6hcjmoZASCGV2HM0TG9ZMoU
2 changed files with 12 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

19
BOOTSTRAP.md
View file

@ -2,28 +2,29 @@
This document outlines the manual, real-world steps required to initialize the NixOS GitOps environment for the first time. You must perform these steps before the CI/CD pipeline or any automated staging environments can function.
## 1. Secret Management Initialization (SOPS-Nix)
## Secret Management Initialization
We use `sops-nix` to manage secrets, adhering to a strict separation between Production and Staging. You must generate these keys locally on a secure workstation.
**Prerequisites:** Install `age` ([age documentation](https://github.com/FiloSottile/age)).
1. **Generate the Production Master Key:**
```bash
age-keygen -o prod-master.txt
age-keygen -o prod-master.age
```
> [!CAUTION]
> Move `prod-master.txt` to a secure offline USB drive and/or print it on paper. **Do not** store this private key on any server.
> It is recommended to move `prod-master.age` to a secure offline USB drive and/or print it on paper.
2. **Generate the Staging Master Key:**
```bash
age-keygen -o staging-master.txt
age-keygen -o staging-master.age
```
3. **Update Configuration:**
Open both `.txt` files and copy their **Public Keys** (the strings starting with `age1...`). Open `.sops.yaml` in the root of this repository and replace the `# TODO` placeholders with your newly generated public keys. Commit and push this change.
Open both `.age` files and copy their **Public Keys** (the strings starting with `age1...`). Open `.sops.yaml` in the root of this repository and replace the placeholders with your newly generated public keys. Commit and push this change.
## 2. Proxmox Hypervisor Authentication & State
## Proxmox Hypervisor Authentication & State
The CI/CD pipeline needs restricted API access to Proxmox to provision Virtual Machines.
@ -46,7 +47,7 @@ The CI/CD pipeline needs restricted API access to Proxmox to provision Virtual M
3. Terraform will prompt you. You will need to provide your Proxmox `root@pam` credentials via environment variables or prompt.
4. Upon successful completion, the script will output a secure **API Token**. Copy this token securely.
## 3. Forgejo Secrets Configuration
## Forgejo Secrets Configuration
The CI/CD actions require access to the Proxmox token and the staging secret key.
@ -56,7 +57,7 @@ The CI/CD actions require access to the Proxmox token and the staging secret key
* `PROXMOX_TOKEN_SECRET`: Paste the token generated from Step 2.
* `RENOVATE_TOKEN`: Create a Personal Access Token (PAT) for your user in Forgejo with read/write access to code and pull requests, and paste it here.
## 4. Staging Golden Key Provisioning (Proxmox Snippet)
## Staging Golden Key Provisioning (Proxmox Snippet)
Instead of relying on Forgejo CI/CD to store the staging private key, we use a secure hypervisor-level Cloud-Init snippet.
@ -76,7 +77,7 @@ Instead of relying on Forgejo CI/CD to store the staging private key, we use a s
```
3. This completely removes the secret from Forgejo. When Terraform spins up a staging VM, it simply tells Proxmox to attach this local snippet!
## 5. TrueNAS API Security (RBAC)
## TrueNAS API Security (RBAC)
To prevent the CI/CD pipeline from having `root` access to your TrueNAS server, you must run the RBAC bootstrap script to create a restricted user (`forgejo-ci`) that can *only* clone datasets for staging, not destroy production data.