nix-config/README.md

NixOS GitOps Migration (v2)

This branch contains the automated, pull-based GitOps architecture using comin, Terraform, and Forgejo.

Secret Management (SOPS-Nix)

This repository uses sops-nix for secret management, adhering to a strict separation between Production and Staging environments to prevent credential leakage during CI runs.

Production Keys

• prod-master: This is the ultimate master key for production secrets.
  • Best Practice: The private key is NEVER stored on any server (including the Control Center VM). It is kept locally on a securely backed-up USB key and a paper backup.
  • You only import the private key to your local machine temporarily when you need to encrypt a new secret or during a disaster recovery scenario.
• Host Keys: Production VMs use their individual SSH host keys (generated during provisioning) to decrypt their specific secrets at boot time.

Staging Keys

• staging-master: This key is used exclusively for encrypting secrets inside the secrets/staging/ directory.
  • The public key is in .sops.yaml.
  • The private key is stored securely in Forgejo Secrets.
  • During CI runs, the Forgejo Runner injects this private key into the ephemeral Staging VMs via Cloud-Init.
  • Even if this key is compromised, it cannot decrypt production data.

Generating the Master Keys

To generate your master keys (run this on your secure local workstation):

# Generate the prod-master key (save the private key to your USB drive)
age-keygen -o prod-master.txt

# Generate the staging-master key (upload the private key to Forgejo Secrets)
age-keygen -o staging-master.txt

Update .sops.yaml with the public keys outputted by these commands.