fix/forgejo-ci-secrets-rekey #825

Merged

kiara merged 4 commits from kiara/fediversity:fix/forgejo-ci-secrets-rekey into main 2026-04-20 21:37:34 +02:00

Conversation 1 Commits 4 Files changed 7 +43 -12

kiara commented 2026-04-14 23:32:53 +02:00

Owner

Copy link

this restores functionality stripped out in #597, which optimistically presumed we would not need to redo secrets stuff until figuring out a better way

this restores functionality stripped out in #597, which optimistically presumed we would not need to redo secrets stuff until figuring out a better way

Toast was assigned by kiara 2026-04-14 23:32:53 +02:00

kiara added 2 commits 2026-04-14 23:32:54 +02:00

Add secrets.nix for agenix rekeying ... 07e5a15346

WIP

Signed-off-by: Kiara Grouwstra <kiara@procolix.eu>

fix: rekey secrets with system host keys as recipients ... 34cbfc5c5a

The `secrets.nix` on `secrets-nix` branch was missing the per-machine
system keys and the `cd` key as recipients. This meant secrets could
only be decrypted by contributors, not by the target machines themselves,
causing agenix decryption failures on deployment (e.g. `forgejo-ci`
could not decrypt `forgejo-runner-token`).

Restore the system key mappings from the pre-data-model `secrets.nix`
and export `systems` from `keys/default.nix`.

kiara added 1 commit 2026-04-14 23:49:01 +02:00

retry CI d2272a5274

kiara referenced this pull request 2026-04-14 23:51:34 +02:00

WIP: readd secrets.nix for agenix rekeying #819

kiara requested review from developers 2026-04-16 18:49:11 +02:00

Toast was unassigned by kiara 2026-04-16 18:49:22 +02:00

kiara added 1 commit 2026-04-16 21:54:40 +02:00

retry CI 220b67151c

Toast approved these changes 2026-04-20 17:19:11 +02:00

kiara merged commit 398a817468 into main 2026-04-20 21:37:34 +02:00

kiara referenced this pull request from a commit 2026-04-20 21:37:35 +02:00

fix/forgejo-ci-secrets-rekey (#825)

Sign in to join this conversation.

Reviewers

No reviewers

Toast

Labels

Clear labels   

ambition

application-offering

  

ambition

configure-applications

  

ambition

front-end

  

ambition/install-applications

  

ambition

security

  

ambition

switch-host

  

ambition

update-applications

  

ambition

user-management

  

blocked

  

component

api-service

features related to the API service

  

component

fediversity-panel

  

component

nixops4

  

documentation

  

points

0

fibonacci complexity: 0 points

  

points

0.5

fibonacci complexity: 0.5 points

  

points

1

fibonacci complexity: 1 point

  

points

13

fibonacci complexity: 13 points

  

points

2

fibonacci complexity: 2 points

  

points

21

fibonacci complexity: 21 points

  

points

3

fibonacci complexity: 3 points

  

points

34

fibonacci complexity: 34 points

  

points

5

fibonacci complexity: 5 points

  

points

55

fibonacci complexity: 55 points

  

points

8

fibonacci complexity: 8 points

  

points

infinite

fibonacci complexity: infinite points

  

productisation

features out-scoped with the decoupling of the productisation effort

  

project-management

Project management related tasks

  

question

  

role

application-developer

  

role

application-operator

  

role

hosting-provider

  

role

maintainer

  

security

  

technical debt

  

testing

  

type

bug

Anything that doesn't work as advertised

  

type

deliverable

  

type

key-result

  

type

objective

  

type

task

  

type

unclear

  

type

user-story

  

user experience

No labels

ambition

application-offering

ambition

configure-applications

ambition

front-end

ambition/install-applications

ambition

security

ambition

switch-host

ambition

update-applications

ambition

user-management

blocked

component

api-service

component

fediversity-panel

component

nixops4

documentation

points

0

points

0.5

points

1

points

13

points

2

points

21

points

3

points

34

points

5

points

55

points

8

points

infinite

productisation

project-management

question

role

application-developer

role

application-operator

role

hosting-provider

role

maintainer

security

technical debt

testing

type

bug

type

deliverable

type

key-result

type

objective

type

task

type

unclear

type

user-story

user experience

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

fediversity/fediversity!825

No description provided.