allod secret declare: write a credential's non-secret half in canonical shape #196

New issue

Closed

opened 2026-09-11 00:16:19 +01:00 by allod-agent · 0 comments

allod-agent commented

2026-09-11 00:16:19 +01:00

Member

Give agents a command that writes a credential's non-secret half in the canonical shape, so the PR that declares a new credential is generated rather than hand-edited across three files.

Primary goals:

One command, three entries — allod secret declare <name> --kind <kind> --owner <owner> --to <machine>,... --format <format> --deployed-path <path> --verify <probe> appends the credentials.nix entry in rotation_state = "pending", the secrets.nix line in the [ hostKey ] ++ vmKeys "<machine>" form, and the registry group with service none or forgejo.
Runs where agents run — untagged, so it exists on dev machines; it writes no ciphertext and reads no identity, and the inventory check validates its output the same way it validates a hand edit.
Refuses a name that exists — an entry, line, or registry credential already present for the name is an error with what was found; the command never edits an existing declaration.

Current state and specifics

allod/tools#182 settled that the host command allod secret create verifies and encrypts and does not author, so the reviewed PR is the only authoring path (see its design comment). That leaves agents writing the three entries by hand from the shapes in the secrets template's README. The credentials.nix entry shape is the agent-pr-token one; secrets.nix lines are "secrets/<name>.age".publicKeys = [ hostKey ] ++ vmKeys "<vm>";; the registry group shape is the one rotate-token's validate_group_metadata accepts. The command should write text, not regenerate files, so the diff stays one block per file.

Scope

In: the three writes, the name-collision refusal, and tests against a fixture checkout. Out: encrypting anything, touching the identity, the consumer module wiring, and the identity export in the secrets flake, which stay hand-written in the same PR.

Give agents a command that writes a credential's non-secret half in the canonical shape, so the PR that declares a new credential is generated rather than hand-edited across three files. Primary goals: - **One command, three entries** — `allod secret declare <name> --kind <kind> --owner <owner> --to <machine>,... --format <format> --deployed-path <path> --verify <probe>` appends the `credentials.nix` entry in `rotation_state = "pending"`, the `secrets.nix` line in the `[ hostKey ] ++ vmKeys "<machine>"` form, and the registry group with `service` `none` or `forgejo`. - **Runs where agents run** — untagged, so it exists on dev machines; it writes no ciphertext and reads no identity, and the inventory check validates its output the same way it validates a hand edit. - **Refuses a name that exists** — an entry, line, or registry credential already present for the name is an error with what was found; the command never edits an existing declaration. ### Current state and specifics allod/tools#182 settled that the host command `allod secret create` verifies and encrypts and does not author, so the reviewed PR is the only authoring path (see its design comment). That leaves agents writing the three entries by hand from the shapes in the secrets template's README. The `credentials.nix` entry shape is the `agent-pr-token` one; `secrets.nix` lines are `"secrets/<name>.age".publicKeys = [ hostKey ] ++ vmKeys "<vm>";`; the registry group shape is the one `rotate-token`'s `validate_group_metadata` accepts. The command should write text, not regenerate files, so the diff stays one block per file. ### Scope In: the three writes, the name-collision refusal, and tests against a fixture checkout. Out: encrypting anything, touching the identity, the consumer module wiring, and the identity export in the secrets flake, which stay hand-written in the same PR.

allod-agent referenced this issue

2026-09-11 00:16:39 +01:00

allod command to save an encrypted credential into a secrets repo #182

allod-agent referenced this issue from a pull request that will close it,

2026-09-11 21:05:41 +01:00

allod secret declare: write a credential's non-secret half in canonical shape #206

allod-agent referenced this issue from a commit

2026-09-11 21:05:42 +01:00

allod secret declare: write a credential's non-secret half in canonical shape

allod-agent referenced this issue from a commit

2026-09-11 21:05:42 +01:00

allod secret declare: read target machine kind from the inventory flake