# NixOS GitOps Migration (v2)

This branch contains the automated, pull-based GitOps architecture using `comin`, Terraform, and Forgejo.

## Secret Management (SOPS-Nix)

This repository uses `sops-nix` for secret management, adhering to a strict separation between Production and Staging environments to prevent credential leakage during CI runs.

### Production Keys
*   **`prod-master`**: This is the ultimate master key for production secrets.
    *   **Best Practice**: The private key is **NEVER** stored on any server (including the Control Center VM). It is kept locally on a securely backed-up USB key and a paper backup.
    *   You only import the private key to your local machine temporarily when you need to encrypt a new secret or during a disaster recovery scenario.
*   **Host Keys**: Production VMs use their individual SSH host keys (generated during provisioning) to decrypt their specific secrets at boot time.

### Staging Keys
*   **`staging-master`**: This key is used exclusively for encrypting secrets inside the `secrets/staging/` directory.
    *   The public key is in `.sops.yaml`.
    *   The private key is stored securely in Forgejo Secrets.
    *   During CI runs, the Forgejo Runner injects this private key into the ephemeral Staging VMs via Cloud-Init.
    *   Even if this key is compromised, it cannot decrypt production data.

### Generating the Master Keys
To generate your master keys (run this on your secure local workstation):
```bash
# Generate the prod-master key (save the private key to your USB drive)
age-keygen -o prod-master.txt

# Generate the staging-master key (upload the private key to Forgejo Secrets)
age-keygen -o staging-master.txt
```
Update `.sops.yaml` with the public keys outputted by these commands.