From dc833335260fa9ad713406a483553fae2d205439 Mon Sep 17 00:00:00 2001 From: beatzaplenty Date: Tue, 28 Jul 2026 16:30:29 +1000 Subject: [PATCH] feat(ha): pre-stage IPA enrollment for ha-server-1 and ha-server-2 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Add stub keytab files (secrets/ha-server-{1,2}.keytab) so modules/ipa/client.nix activates for both nodes — IPA security.ipa.enable = true confirmed by eval - Add .sops.yaml creation rules for both keytabs (admin-only until sync-host-keys.sh registers the host age keys) Eval: both proxmox-ha-server-1 and proxmox-ha-server-2 build cleanly with IPA enabled, beszel agent enabled, corosync authkey + beszel-token + ipa-host-keytab all wired via sops-nix. Bootstrap order before first deploy: 1. bash scripts/secrets/sync-host-keys.sh proxmox-ha-server-1 2. bash scripts/secrets/sync-host-keys.sh proxmox-ha-server-2 3. sops updatekeys secrets/common.yaml 4. bash scripts/ipa/create-nixos-ipa-host-account.sh --ip 192.168.2.228 ha-server-1 5. bash scripts/ipa/create-nixos-ipa-host-account.sh --ip 192.168.2.227 ha-server-2 6. sops secrets/ha-server-1.yaml (set beszel-token) 7. sops secrets/ha-server-2.yaml (set beszel-token) 8. On node1 after first boot: corosync-keygen, then sops -e --input-type binary /etc/corosync/authkey > secrets/ha-corosync-authkey 9. Set services.beszel.agent.environment.KEY in each host.nix after hub pairing 10. git add/commit the real secrets, then nixos-rebuild switch on both nodes Co-Authored-By: Claude Sonnet 4.6 Claude-Session: https://claude.ai/code/session_01HaH1cSGvhogRP5ExoF6nD8 --- .sops.yaml | 16 ++++++++++++++++ secrets/ha-server-1.keytab | 1 + secrets/ha-server-2.keytab | 1 + 3 files changed, 18 insertions(+) create mode 100644 secrets/ha-server-1.keytab create mode 100644 secrets/ha-server-2.keytab diff --git a/.sops.yaml b/.sops.yaml index c62ba58..2b4aaa1 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -195,3 +195,19 @@ creation_rules: - *lxc-minimal - *proxmox-minimal - *linode-minimal + + # Host keytab for ha-server-1 FreeIPA enrollment (binary sops file). + # Generated by scripts/ipa/create-nixos-ipa-host-account.sh. + - path_regex: secrets/ha-server-1\.keytab$ + key_groups: + - age: + - *admin + # proxmox-ha-server-1 added by sync-host-keys.sh + + # Host keytab for ha-server-2 FreeIPA enrollment (binary sops file). + # Generated by scripts/ipa/create-nixos-ipa-host-account.sh. + - path_regex: secrets/ha-server-2\.keytab$ + key_groups: + - age: + - *admin + # proxmox-ha-server-2 added by sync-host-keys.sh diff --git a/secrets/ha-server-1.keytab b/secrets/ha-server-1.keytab new file mode 100644 index 0000000..ca4b2f8 --- /dev/null +++ b/secrets/ha-server-1.keytab @@ -0,0 +1 @@ +STUB: not yet enrolled — run: bash scripts/ipa/create-nixos-ipa-host-account.sh --ip 192.168.2.228 ha-server-1 diff --git a/secrets/ha-server-2.keytab b/secrets/ha-server-2.keytab new file mode 100644 index 0000000..964c357 --- /dev/null +++ b/secrets/ha-server-2.keytab @@ -0,0 +1 @@ +STUB: not yet enrolled — run: bash scripts/ipa/create-nixos-ipa-host-account.sh --ip 192.168.2.227 ha-server-2