Carry the host user's credential files in nexusIdentity #18

Merged

vnprc merged 3 commits from agent/site-identity-fields into master

2026-09-10 16:43:21 +01:00

allod-agent commented

2026-09-10 15:40:49 +01:00

Member

The hypervisor identity gains two optional fields, userForgejoTokenFile and siteHostingConfigFile, so a deployment can name the age files holding the human account's forge token and the site hosting rclone config, and the framework can place them instead of each deployment writing its own module. In this template both are null, so nothing changes for any running machine: no new secret, no new file on disk, no new recipient. nix eval shows both fields as null and the three flake checks pass unchanged. If this is wrong, revert the four added lines in flake.nix; nothing in this repo reads the fields. The consumer that will read them (allod/archetypes#74) reads with or null, so this can merge first and either order evaluates.

Closes allod/secrets#17. Refs allod/strategy#51.

What changed

flake.nix: nexusIdentity carries userForgejoTokenFile = null and siteHostingConfigFile = null beside forgeTokenFile = null, with a comment giving the path spelling a deployment uses.
README.md: the lib.nexusIdentity row names the fields; the consumer section documents the shape as a table (what each file decrypts to, recipients, placement path and mode), why the rclone stanza is stored whole, why recipients are the host keys alone, and the credentials.nix entry plus secrets.nix recipient line every non-null file needs; the layout section notes the two placement paths.
No ciphertext, credentials.nix entry, or secrets.nix line is added: with both fields null there is nothing to carry.

One deliberate departure from the issue text. The issue spells a deployment's value as "${self}/secrets/<name>.age", a string that interpolates the whole repository into the closure. The dev-VM token fields the issue says to copy are written ./secrets + "/<name>.age", a Nix path, and the framework's path-form assertion for dev machines refuses strings. The README and the flake comment document the path form; the archetypes consumer enforces it.

Risk

R0. Two null-valued attrset fields and README prose. No consumer reads the fields yet.

Validation

nix eval --json .#lib.nexusIdentity shows "userForgejoTokenFile":null and "siteHostingConfigFile":null.
nix flake check: credential-inventory, external-ssh-trust-targets, pi-credential-registry all pass, re-run after the last commit.
git diff master --stat: README.md and flake.nix only.
Reviewed by codex (gpt-5.6-sol) twice and pi (gpt-oss-120b) once; the README wording findings were applied, the rest were checked against source and rejected.

Labels are unavailable to this token; none is warranted.

The hypervisor identity gains two optional fields, `userForgejoTokenFile` and `siteHostingConfigFile`, so a deployment can name the age files holding the human account's forge token and the site hosting rclone config, and the framework can place them instead of each deployment writing its own module. In this template both are `null`, so nothing changes for any running machine: no new secret, no new file on disk, no new recipient. `nix eval` shows both fields as `null` and the three flake checks pass unchanged. If this is wrong, revert the four added lines in `flake.nix`; nothing in this repo reads the fields. The consumer that will read them (allod/archetypes#74) reads with `or null`, so this can merge first and either order evaluates. Closes allod/secrets#17. Refs allod/strategy#51. ## What changed - `flake.nix`: `nexusIdentity` carries `userForgejoTokenFile = null` and `siteHostingConfigFile = null` beside `forgeTokenFile = null`, with a comment giving the path spelling a deployment uses. - `README.md`: the `lib.nexusIdentity` row names the fields; the consumer section documents the shape as a table (what each file decrypts to, recipients, placement path and mode), why the rclone stanza is stored whole, why recipients are the host keys alone, and the `credentials.nix` entry plus `secrets.nix` recipient line every non-null file needs; the layout section notes the two placement paths. - No ciphertext, `credentials.nix` entry, or `secrets.nix` line is added: with both fields null there is nothing to carry. One deliberate departure from the issue text. The issue spells a deployment's value as `"${self}/secrets/<name>.age"`, a string that interpolates the whole repository into the closure. The dev-VM token fields the issue says to copy are written `./secrets + "/<name>.age"`, a Nix path, and the framework's path-form assertion for dev machines refuses strings. The README and the flake comment document the path form; the archetypes consumer enforces it. ## Risk R0. Two null-valued attrset fields and README prose. No consumer reads the fields yet. ## Validation - `nix eval --json .#lib.nexusIdentity` shows `"userForgejoTokenFile":null` and `"siteHostingConfigFile":null`. - `nix flake check`: `credential-inventory`, `external-ssh-trust-targets`, `pi-credential-registry` all pass, re-run after the last commit. - `git diff master --stat`: `README.md` and `flake.nix` only. - Reviewed by codex (gpt-5.6-sol) twice and pi (gpt-oss-120b) once; the README wording findings were applied, the rest were checked against source and rejected. Labels are unavailable to this token; none is warranted.

allod-agent added 3 commits

2026-09-10 15:40:49 +01:00