31 lines
1.7 KiB
Markdown
31 lines
1.7 KiB
Markdown
# NixOS GitOps Migration (v2)
|
|
|
|
This branch contains the automated, pull-based GitOps architecture using `comin`, Terraform, and Forgejo.
|
|
|
|
## Secret Management (SOPS-Nix)
|
|
|
|
This repository uses `sops-nix` for secret management, adhering to a strict separation between Production and Staging environments to prevent credential leakage during CI runs.
|
|
|
|
### Production Keys
|
|
* **`prod-master`**: This is the ultimate master key for production secrets.
|
|
* **Best Practice**: The private key is **NEVER** stored on any server (including the Control Center VM). It is kept locally on a securely backed-up USB key and a paper backup.
|
|
* You only import the private key to your local machine temporarily when you need to encrypt a new secret or during a disaster recovery scenario.
|
|
* **Host Keys**: Production VMs use their individual SSH host keys (generated during provisioning) to decrypt their specific secrets at boot time.
|
|
|
|
### Staging Keys
|
|
* **`staging-master`**: This key is used exclusively for encrypting secrets inside the `secrets/staging/` directory.
|
|
* The public key is in `.sops.yaml`.
|
|
* The private key is stored securely in Forgejo Secrets.
|
|
* During CI runs, the Forgejo Runner injects this private key into the ephemeral Staging VMs via Cloud-Init.
|
|
* Even if this key is compromised, it cannot decrypt production data.
|
|
|
|
### Generating the Master Keys
|
|
To generate your master keys (run this on your secure local workstation):
|
|
```bash
|
|
# Generate the prod-master key (save the private key to your USB drive)
|
|
age-keygen -o prod-master.txt
|
|
|
|
# Generate the staging-master key (upload the private key to Forgejo Secrets)
|
|
age-keygen -o staging-master.txt
|
|
```
|
|
Update `.sops.yaml` with the public keys outputted by these commands.
|