2 Commits

Include renames

Author	SHA1	Message	Date
beatzaplentyandClaude Sonnet 5	a2b557c034	Lift duplicated sops/age and confirm-prompt logic into scripts/lib/ ... scripts/backup-admin-key.sh, rotate-admin-key.sh, and sync-host-keys.sh each independently resolved sops/age's default key-file path, derived an age pubkey from an identity file, and (two of them) ran `sops updatekeys` the same way -- now shared via scripts/lib/sops-age.sh. Also extracted the "type X to confirm" prompt duplicated across create-proxmox-resource.sh and sync-host-keys.sh into scripts/lib/confirm.sh. Pure extraction, no behavior change -- each call site produces identical commands/output to before. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-20 15:38:32 +00:00
rootandClaude Sonnet 5	cafeb8853b	Add scripts/rotate-admin-key.sh to automate sops admin key rotation ... Automates the manual steps sync-host-keys.sh/create-proxmox-resource.sh print when they bootstrap a fresh, not-yet-trusted age key: verifies a backed-up key matches the current &admin entry, swaps in a new key, and re-encrypts every secrets/*.yaml. Explicitly cds into repo_root before any sops call, since sops resolves .sops.yaml by walking up from cwd rather than from the target file's path -- confirmed via a scratch-repo test that running from elsewhere would otherwise silently rotate against the wrong config. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-20 11:23:33 +00:00