secret declare: write two files, no secrets.nix line #278

New issue

Closed

opened 2026-10-19 04:53:00 +01:00 by allod-agent · 0 comments

allod-agent commented

2026-10-19 04:53:00 +01:00

Member

allod secret declare writes two files instead of three: the credentials.nix entry and the rotation-registry.json group, and no secrets.nix line, because secrets.nix now derives a declared credential's recipients from the registry (allod/secrets#46, landed as allod/secrets#47, and adopted by the deployment fork per the owner's report). A fork's own name for its hypervisor keys never reaches the tool again, and declare works on the template, which has no hand-written recipient line for it to insert after.

Primary goals:

Two insertions — declare builds, validates and writes credentials.nix and rotation-registry.json; it reads secrets.nix for nothing, and the collision check, the balanced-brace check and the same-bytes re-read for that file go with the insertion. The printed list of written paths names two files.
create is the consumer that proves it — create reads recipients by evaluating secrets.nix for the credential's path; a fixture whose secrets.nix imports a registry-derived map, with a declare followed by create against it, lands the ciphertext to the derived recipients. The existing fixture that hand-writes [ hostKey ] ++ vmKeys "dev-a" is replaced by that shape.
Words match — the declare help text, docs/allod-secret.md and the public memory age.md paragraph that lists three insertions all say two; the memory edit is a separate PR on allod/memory that lands with this one.
Order already holds — the fork step of allod/secrets#46 is done, so the host binary built from this change meets a secrets.nix that derives; a create on a fork that had not adopted would refuse with secrets.nix in <checkout> does not declare '<path>', never write to wrong recipients.

Current state and specifics

cmd/allod/secret_declare.go reads three files, runs declareCollisions over all three (declareSecretsHasLine for the secrets.nix half), inserts with declareInsertSecretsLine, which requires an existing line to insert after and writes [ hostKey ] ++ vmKeys "<vm>" (allod/tools#271, closed in favour of the derivation), checks declareNixBalanced on the result, and writes the three files with a same-bytes guard each. The template's secrets.nix has had no such line since its entries became derived, so declare fails there today with secrets.nix: no existing publicKeys line to insert after.

Scope

In: cmd/allod/secret_declare.go and its tests, the help text, docs/allod-secret.md; the age.md paragraph in allod/memory as a companion PR. Out: create, rekey and rotate, which evaluate secrets.nix and are unchanged; the derivation itself, which is allod/secrets#47.

Part of allod/secrets#46

`allod secret declare` writes two files instead of three: the `credentials.nix` entry and the `rotation-registry.json` group, and no `secrets.nix` line, because `secrets.nix` now derives a declared credential's recipients from the registry (allod/secrets#46, landed as allod/secrets#47, and adopted by the deployment fork per the owner's report). A fork's own name for its hypervisor keys never reaches the tool again, and `declare` works on the template, which has no hand-written recipient line for it to insert after. Primary goals: - **Two insertions** — `declare` builds, validates and writes `credentials.nix` and `rotation-registry.json`; it reads `secrets.nix` for nothing, and the collision check, the balanced-brace check and the same-bytes re-read for that file go with the insertion. The printed list of written paths names two files. - **`create` is the consumer that proves it** — `create` reads recipients by evaluating `secrets.nix` for the credential's path; a fixture whose `secrets.nix` imports a registry-derived map, with a `declare` followed by `create` against it, lands the ciphertext to the derived recipients. The existing fixture that hand-writes `[ hostKey ] ++ vmKeys "dev-a"` is replaced by that shape. - **Words match** — the `declare` help text, `docs/allod-secret.md` and the public memory `age.md` paragraph that lists three insertions all say two; the memory edit is a separate PR on `allod/memory` that lands with this one. - **Order already holds** — the fork step of allod/secrets#46 is done, so the host binary built from this change meets a `secrets.nix` that derives; a `create` on a fork that had not adopted would refuse with `secrets.nix in <checkout> does not declare '<path>'`, never write to wrong recipients. ### Current state and specifics `cmd/allod/secret_declare.go` reads three files, runs `declareCollisions` over all three (`declareSecretsHasLine` for the `secrets.nix` half), inserts with `declareInsertSecretsLine`, which requires an existing line to insert after and writes `[ hostKey ] ++ vmKeys "<vm>"` (allod/tools#271, closed in favour of the derivation), checks `declareNixBalanced` on the result, and writes the three files with a same-bytes guard each. The template's `secrets.nix` has had no such line since its entries became derived, so `declare` fails there today with `secrets.nix: no existing publicKeys line to insert after`. ### Scope In: `cmd/allod/secret_declare.go` and its tests, the help text, `docs/allod-secret.md`; the `age.md` paragraph in `allod/memory` as a companion PR. Out: `create`, `rekey` and `rotate`, which evaluate `secrets.nix` and are unchanged; the derivation itself, which is allod/secrets#47. Part of allod/secrets#46

allod-agent referenced this issue from allod/memory

2026-10-19 04:58:42 +01:00

age.md: declare writes two insertions, secrets.nix derives the recipients #84

allod-agent referenced this issue from a pull request that will close it,

2026-10-19 05:02:31 +01:00

secret declare: write two files, no secrets.nix line #279

allod-agent referenced this issue from a commit

2026-10-19 05:02:31 +01:00

secret declare: write two files, no secrets.nix line