allod secret rotate: resolve the deploy checkout through the registry #212

Merged

vnprc merged 1 commit from agent/secret-rotate-deploy-checkout into master

2026-09-13 02:33:52 +01:00

allod-agent commented

2026-09-13 00:42:51 +01:00

Member

Summary

allod secret rotate now prints its two deploy-flake steps (the cd before nix flake update secrets, and the nixos-rebuild switch --flake line) against the deploy checkout named by the inventory's repository registry, ~/work/<checkout> from its deploy entry, instead of a hardcoded ~/work/allod/deploy. When the registry names no deploy entry the printed path is ~/work/allod/deploy, exactly as before. Nothing a machine runs changes: this command only prints steps for the operator, and the secrets checkout, group, targets, and verify lines are untouched. A new test points the registry at another checkout and pins that both printed lines follow it; the existing dry-run test keeps pinning the fallback. If it is wrong, revert this one commit; the printed path returns to the template one.

Closes allod/tools#211

Change

deployCheckoutRelative() in cmd/allod/secret_common.go, the same shape as secretsCheckoutRelative(): registry aliases deploy then allod/deploy, fallback allod/deploy.
printDeploySteps resolves it once and hands the value to printRebuildCommand, so both printed lines read one value.
docs/allod-secret.md says rotate resolves the deploy checkout the same way.

Risk

R1. The change is confined to two printed strings in one command, pinned by a caller-level test, with a straight revert. No secrets, host commands, or state are touched.

Validation

Run in the worktree under nix develop: gofmt -l ./cmd printed nothing; go vet and go test for ./..., -tags secret, -tags site, and -tags site,secret all passed (every package ok).

## Summary `allod secret rotate` now prints its two deploy-flake steps (the `cd` before `nix flake update secrets`, and the `nixos-rebuild switch --flake` line) against the deploy checkout named by the inventory's repository registry, `~/work/<checkout>` from its `deploy` entry, instead of a hardcoded `~/work/allod/deploy`. When the registry names no deploy entry the printed path is `~/work/allod/deploy`, exactly as before. Nothing a machine runs changes: this command only prints steps for the operator, and the secrets checkout, group, targets, and verify lines are untouched. A new test points the registry at another checkout and pins that both printed lines follow it; the existing dry-run test keeps pinning the fallback. If it is wrong, revert this one commit; the printed path returns to the template one. Closes allod/tools#211 ## Change - `deployCheckoutRelative()` in `cmd/allod/secret_common.go`, the same shape as `secretsCheckoutRelative()`: registry aliases `deploy` then `allod/deploy`, fallback `allod/deploy`. - `printDeploySteps` resolves it once and hands the value to `printRebuildCommand`, so both printed lines read one value. - `docs/allod-secret.md` says `rotate` resolves the deploy checkout the same way. ## Risk R1. The change is confined to two printed strings in one command, pinned by a caller-level test, with a straight revert. No secrets, host commands, or state are touched. ## Validation Run in the worktree under `nix develop`: `gofmt -l ./cmd` printed nothing; `go vet` and `go test` for `./...`, `-tags secret`, `-tags site`, and `-tags site,secret` all passed (every package `ok`).

allod-agent added 1 commit

2026-09-13 00:42:51 +01:00