@@ -231,0 +295,4 @@
+          # The self-state seed (`seed-self-state.sh`, #833), invoked before each
+          # bootstrap apply with the cycle-appropriate `TF_VAR_self_state_*` so
+          # the netbox self-read survives. Empty when the effect sets no preRun.
+          BOOTSTRAP_SEED = if preRun == "" then "" else preRun;

@@ -0,0 +126,4 @@
+
+    with subtest("Normalizing reinvocation: migrate local state up to HTTP"):
+      # Backend node is live now, so a second BOOTSTRAP=1 run migrates the local
+      # state up to the HTTP backend and applies against it.

@@ -0,0 +1,82 @@
+# Graceful bootstrap of a fresh hosting-provider TF backend (#336, #882)

@@ -76,0 +104,4 @@
+                        "vars"
+                      ];
+                      default = "agenix";
+                    };

@@ -109,2 +109,4 @@
     expected = "/run/agenix/forgejo-runner_forgejo-runner-token";
   };
+
+  # Every secret defaults to the `agenix` provider (#882/#493 Stage 6 keeps the

@@ -209,0 +249,4 @@
+            port = bundleFetchPort;
+          }
+        ];
+        locations."= /${bundleFileName}".root = bundleWebRoot;

@@ -0,0 +6,4 @@
+operator must supply it -- there is no earlier link to derive it from).
+
+The bootstrap ladder brings a fresh provider up along
+`incus -> terraform-backend -> openbao -> valkey -> spire -> netbox`, climbing a

@@ -0,0 +26,4 @@
+| Seed                                         | Where                                                                        | Why irreducible                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| -------------------------------------------- | ---------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Operator SSH access to the bare host         | the deploy runner's SSH agent/key                                            | The very first link: incus is stood up over SSH (`hosting-provider-ssh-incus`) before any of the ladder exists. Nothing precedes it.                                                                                                                                                                                                                                                                                                                                                                          |
+| OpenBao unseal key (`manual-key` nodes only) | `/var/lib/openbao-init/init.json` (0400), `/var/lib/openbao-init/root-token` | `openbao-init` generates these on first boot and they gate all of openbao's contents. Under `unsealMethod = "manual-key"` (the default) the plaintext unseal key persists to disk as the single load-bearing local seed. It is **reducible on a TPM node** via `unsealMethod = "tpm-sealed"` (see the reducible table) -- irreducible only where no usable TPM exists. The root token stays on disk either way, but it is rendered durably into openbao's own KV downstream rather than escrowed out of band. |

@@ -0,0 +28,4 @@
+| Operator SSH access to the bare host         | the deploy runner's SSH agent/key                                            | The very first link: incus is stood up over SSH (`hosting-provider-ssh-incus`) before any of the ladder exists. Nothing precedes it.                                                                                                                                                                                                                                                                                                                                                                          |
+| OpenBao unseal key (`manual-key` nodes only) | `/var/lib/openbao-init/init.json` (0400), `/var/lib/openbao-init/root-token` | `openbao-init` generates these on first boot and they gate all of openbao's contents. Under `unsealMethod = "manual-key"` (the default) the plaintext unseal key persists to disk as the single load-bearing local seed. It is **reducible on a TPM node** via `unsealMethod = "tpm-sealed"` (see the reducible table) -- irreducible only where no usable TPM exists. The root token stays on disk either way, but it is rendered durably into openbao's own KV downstream rather than escrowed out of band. |
+| agenix recipient public keys                 | `keys/` (`contributors`, `cd`, per-system)                                   | The operator controls decryption authority for any `.age`-sourced secret. A fresh external team either owns these recipients or routes those secrets to the `vars` provider instead (see the agenix->vars migration below).                                                                                                                                                                                                                                                                                   |
+| Deployment SSH key (`api-ssh-key`)           | `src/resources/secrets/api-ssh-key.age`                                      | The key the API/deployer uses to reach target nodes. It authorizes the deploy itself, so it cannot be sourced from a service the deploy brings up. Stays agenix.                                                                                                                                                                                                                                                                                                                                              |

@@ -0,0 +25,4 @@
+
+| Seed                                         | Where                                                                        | Why irreducible                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| -------------------------------------------- | ---------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Operator SSH access to the bare host         | the deploy runner's SSH agent/key                                            | The very first link: incus is stood up over SSH (`hosting-provider-ssh-incus`) before any of the ladder exists. Nothing precedes it.                                                                                                                                                                                                                                                                                                                                                                          |

@@ -0,0 +27,4 @@
+| -------------------------------------------- | ---------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Operator SSH access to the bare host         | the deploy runner's SSH agent/key                                            | The very first link: incus is stood up over SSH (`hosting-provider-ssh-incus`) before any of the ladder exists. Nothing precedes it.                                                                                                                                                                                                                                                                                                                                                                          |
+| OpenBao unseal key (`manual-key` nodes only) | `/var/lib/openbao-init/init.json` (0400), `/var/lib/openbao-init/root-token` | `openbao-init` generates these on first boot and they gate all of openbao's contents. Under `unsealMethod = "manual-key"` (the default) the plaintext unseal key persists to disk as the single load-bearing local seed. It is **reducible on a TPM node** via `unsealMethod = "tpm-sealed"` (see the reducible table) -- irreducible only where no usable TPM exists. The root token stays on disk either way, but it is rendered durably into openbao's own KV downstream rather than escrowed out of band. |
+| agenix recipient public keys                 | `keys/` (`contributors`, `cd`, per-system)                                   | The operator controls decryption authority for any `.age`-sourced secret. A fresh external team either owns these recipients or routes those secrets to the `vars` provider instead (see the agenix->vars migration below).                                                                                                                                                                                                                                                                                   |

@@ -0,0 +38,4 @@
+| Former seed                                | Mechanism                                                                                                                                                                                                                                                                                                                                                                                                                                 | Stage                             |
+| ------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------- |
+| `terraform-backend` HTTP state backend     | local-then-migrate under `BOOTSTRAP=1` (`bootstrap-apply.sh`)                                                                                                                                                                                                                                                                                                                                                                             | 1                                 |
+| `KMS_KEY_FILE` (terraform-backend)         | `generateFiles` (`openssl rand -base64 32`) bridged into openbao KV via `vars`; `generate-vars` seeds it on first boot, `openbao-agent-default` renders it back durably -- the "migrate the boot-generated key into openbao, then read it back" self-heal                                                                                                                                                                                 | 6 (structurally already in place) |

@@ -0,0 +39,4 @@
+| ------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------- |
+| `terraform-backend` HTTP state backend     | local-then-migrate under `BOOTSTRAP=1` (`bootstrap-apply.sh`)                                                                                                                                                                                                                                                                                                                                                                             | 1                                 |
+| `KMS_KEY_FILE` (terraform-backend)         | `generateFiles` (`openssl rand -base64 32`) bridged into openbao KV via `vars`; `generate-vars` seeds it on first boot, `openbao-agent-default` renders it back durably -- the "migrate the boot-generated key into openbao, then read it back" self-heal                                                                                                                                                                                 | 6 (structurally already in place) |
+| OpenBao unseal key (on a TPM node)         | `unsealMethod = "tpm-sealed"`: `openbao-init` seals the `bao operator init` unseal key to the node's (v)TPM (`tpm2_create`/`load`/`unseal` under a persistent primary), writing only inert `tpm-sealed.pub`/`.priv` and stripping every plaintext key field from `init.json`; auto-unseals from the TPM on every boot. Reuses the same vTPM SPIRE attests against (`spiffe-tpm`/#633). `manual-key` stays the default for TPM-less nodes. | 2                                 |

@@ -0,0 +63,4 @@
+The `.age` secrets under `src/resources/secrets/` are all **dev-group** and
+pre-date the ladder -- the forgejo host _is_ the CI runner that later brings
+openbao/SPIRE online, so its own bootstrap secrets cannot be sourced from a
+service it has not deployed yet. They stay agenix by necessity, not by omission.

@@ -0,0 +67,4 @@
+
+To let an **external** team deploy over SSH without owning Fediversity agenix
+recipients, the `secrets` resource now exposes a per-secret `provider` choice
+(`src/resources/secrets/default.nix`):

@@ -0,0 +94,4 @@
+fetches in the self-fetch oneshots, and the irreducible floor in `keys/` +
+`openbao-init`). The irreducible rows above are the real, minimal seed set --
+three unconditional (operator SSH access, agenix recipients, deployment SSH key)
+plus the openbao unseal key on TPM-less nodes; everything else the ladder derives. Keeping the catalog here -- next to the ladder

@@ -0,0 +52,4 @@
+   `BOOTSTRAP=1`:
+
+   ```bash
+   BOOTSTRAP=1 nix run .#hosting-provider-tf-incus-all

@@ -0,0 +41,4 @@
+   (5 starts / 10s), so after a few retries they settle into `failed` rather than
+   looping forever. Once the rest of the ladder is deployed (step 1 brings up
+   openbao + spire), converge them with either a redeploy
+   (`nix run .#hosting-provider-ssh-incus` again) or, on the incus host:

@@ -0,0 +53,4 @@
+
+   ```bash
+   BOOTSTRAP=1 nix run .#hosting-provider-tf-incus-all
+   ```

@@ -0,0 +69,4 @@
+
+   If the backend node never comes up within `BOOTSTRAP_MIGRATE_TIMEOUT`
+   (default 1800s), the run **fails** rather than silently leaving state local --
+   so the operator sees the real problem. The local apply is persisted, so simply

@@ -0,0 +1,355 @@
+# Full fresh-provider bootstrap ladder (#882, #493, #515)

@@ -0,0 +29,4 @@
+   TF-state backends).
+
+2. **Secret-provenance chicken-and-egg** (#493) -- a workload needs a secret
+   (valkey password, netbox token, KMS key) that is _supposed_ to come from

@@ -0,0 +73,4 @@
+
+## Stage 1 -- terraform-backend (DONE)
+
+Local-then-migrate under `BOOTSTRAP=1`. See `notes/bootstrap.md`. The KMS key is

@@ -0,0 +83,4 @@
+
+**Current:** `openbao-init.service` runs `bao operator init` on first boot,
+writes unseal key + root token to `/var/lib/openbao-init/`, unseals. Single-node
+SQLite. Works on a fresh single node with no gap.

@@ -0,0 +15,4 @@
+deploy without owning Fediversity-team secrets.
+
+This note is the _design_. Each stage below is a separable PR; they are ordered
+by dependency, not by priority. Only the terraform-backend stage is done today.

@@ -0,0 +57,4 @@
+    inherit domain;
+    applications = lib.mapAttrs (_: _: { enable = true; }) machines.application;
+  };
+  applications = [ ../../applications/hosting-provider ];

@@ -0,0 +90,4 @@
+| agenix recipient public keys       | `keys/` (`contributors`, `cd`, per-system) | The admin controls decryption authority for any `.age`-sourced secret. Only the **human-team** recipients (`contributors`, `cd`) are truly irreducible -- they are the trust root, so "generating" them would defeat the point (nothing an outside deploy generates is an authority the admin controls). But the recipient set does not have to be a checked-in `keys/` seed: it should move into deploy-time **env-vars / TF-state** the deployer already holds (see "Intended reductions"), so a fresh external team supplies its own recipients at deploy time rather than editing the tree. The **per-system** host keys under `keys/` are moreover _generatable_ at provisioning (a fresh host key minted on the node, its public half registered in the same apply), so they are not an admin seed on the incus path at all. Failing either, a secret that carries no admin-controlled authority can be produced through `generateFiles` -> openbao instead (see the migration note below). |
+| Deployment SSH key (`api-ssh-key`) | `src/resources/secrets/api-ssh-key.age`    | The key the API/deployer uses to reach target nodes. It authorizes the deploy itself, so it cannot be sourced from a service the deploy brings up -- but it need not be a checked-in `.age` file: the deployer could **generate** the keypair at deploy time and push the public half onto the target nodes' `authorized_keys` in the same apply (nothing about the deploy identity requires a long-lived pre-shared key), reducing it from a stored seed to a per-deploy ephemeral. Tracked under "Intended reductions"; until then it stays agenix.                                                                                                                                                                                                                                                                                                                                                                                                                                             |
+
+### Intended reductions (tracked, not yet done)

@@ -0,0 +234,4 @@
+is issued by a `pki/issue` call, which needs the node's SPIRE SVID, which needs
+the trust root -- so a PKI cert can only appear once the node is already up the
+spire rung. That is fine because both listeners degrade gracefully to
+self-signed + trust-on-first-use in the gap:

@@ -342,3 +343,4 @@
   zone = mkZone [
     machines.application
     machines.ancilliary
+    (import ./hypervisor.nix { inherit lib; }).machines.application