allod/nexus
2
0
Fork 0
Code Issues 2 Pull requests Projects Releases Packages Wiki Activity Actions

Gate host key rotation on external SSH targets #13

Merged
vnprc merged 1 commit from agent/nexus-external-backup-ssh-rotation-gates into master 2026-07-16 20:38:58 +01:00
Conversation 1 Commits 1 Files changed 5 +817 -12
allod-agent commented 2026-07-16 20:14:55 +01:00
Member
Copy link

Closes allod/nexus#4
Refs allod/secrets#6

Summary

  • Resolve externalSshTrustTargets from the secrets identity registry and join each target to its sshHosts connection data.
  • Add stage setup output, activate/retire external SSH gates, host-key failure classification, and typed per-target override confirmations.
  • Expand the nexus-host-key fixture suite and add the host-key rotation runbook.

Risk

R3 High: this changes the host-key rotation state machine around activation and retirement. The gates run before ~/.ssh/host is swapped and before retire promotes/re-encrypts state, so failures block visibly before destructive rotation steps.

Validation

  • bash tests/nexus-host-key.sh
  • nix flake check
  • nix flake check in allod/secrets

Depends on: allod/secrets#6

Closes allod/nexus#4 Refs allod/secrets#6 ## Summary - Resolve `externalSshTrustTargets` from the secrets identity registry and join each target to its `sshHosts` connection data. - Add stage setup output, activate/retire external SSH gates, host-key failure classification, and typed per-target override confirmations. - Expand the `nexus-host-key` fixture suite and add the host-key rotation runbook. ## Risk R3 High: this changes the host-key rotation state machine around activation and retirement. The gates run before `~/.ssh/host` is swapped and before retire promotes/re-encrypts state, so failures block visibly before destructive rotation steps. ## Validation - `bash tests/nexus-host-key.sh` - `nix flake check` - `nix flake check` in allod/secrets Depends on: allod/secrets#6
vnprc approved these changes 2026-07-16 20:38:49 +01:00
vnprc merged commit 0283d10322 into master 2026-07-16 20:38:58 +01:00
vnprc deleted branch agent/nexus-external-backup-ssh-rotation-gates 2026-07-16 20:38:58 +01:00
Sign in to join this conversation.
Reviewers
No reviewers
vnprc
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
allod/nexus!13
No description provided.