9921a7f9f1
Stage 4b of the clan migration. Declares a clan.inventory.instances.zerotier
instance with sunken-ship as controller and phantom-ship as peer (controller
is also listed as a peer so it joins its own network). Generates the network
ID, controller identity, and per-peer identities via `clan vars generate`;
all secrets are SOPS-encrypted to the user's age key and the per-machine
age keys.
- nixos/sops/ — clan-managed SOPS state (user + per-machine age keys).
- nixos/vars/ — shared + per-machine zerotier vars; *-identity-secret
files are SOPS-encrypted, *.value files are plain public data.
- clan.core.networking.{targetHost,buildHost} = "danny@<host>" on both
servers so `clan machines update` knows where to push and build.
- mac gets `zerotier-one` installed as a homebrew cask; authorization
on the controller happens manually by node-ID in a follow-up step.
Known rough edges (to chase in later stages):
- zerotier-inventory-autoaccept.service races zerotierone.service on
first activation (connection refused against the local API). Retrying
the unit succeeds; clan upstream bug.
- Deployment must go through `clan machines update`, not plain
nixos-rebuild, or the per-host SOPS age key isn't uploaded and
zerotier-one can't decrypt its identity.
14 lines
1.3 KiB
Text
14 lines
1.3 KiB
Text
{
|
|
"data": "ENC[AES256_GCM,data:NO63/4R06iLMuhWl5r6bWnVs9lt3i+yJlzWGV4ZiTqdxLHZdK/RO1cfdrfFr/YsYIrBzIYv1GghzmAjqg3InJsW5hEyYxddPdwxgowmHw44c8jOlCEvcMNuLw+Dh1njX6+mPcO6yPnSFeF3O72l/S4PYuesWUAnVSi4KcvDBsYSAITJkSEbNi8+63QVLPbumCVK/ZmGFWy59fepUe+0hA+IlCQBxKEFpku1bIpDfOlkOkaG9kyH0X3TNuvT5R785q5SBaIr9kez1GpcYtGlY4Mio1zemt9oYxzq7f6i1Ca4i5COUFq0TKtjU87T1fg6fEQ3cA28i57IWu7PMxPoV2Mpnwldg3BiCqGvbNMb3,iv:EcOrTwgJSuuP9suOzA+ZHwOHkX4fqYh77gTtV/W9DAQ=,tag:MSpfI+z5/rM0+cxUfEAAKg==,type:str]",
|
|
"sops": {
|
|
"age": [
|
|
{
|
|
"recipient": "age1g6y8gvcampqj5y3yzdajke2h5n7k6ckdg6a424cghy5325px7cmqjmmd28",
|
|
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNZ2xTdFlaU2JJVFdhM3Rq\nNmFQMEd4NWdwd3RKQUI4dXAxNk0rWnZkRWhnCmFFRXNrUGlRbWpUOXFuU3Z0QndV\nS2NUV2NPVldpWGFPS0NPRm1NNFVSWlUKLS0tIEFhNHE1YndxUXVJbUVDSWU2Qkt5\najI4ajNPN0F3Qmt4Tzhkd3hKY0xpSkEKgaguLuJhrnbPWqeTMFeJD8UET0be46sV\nZNQLyYcINE3mnAQNMGzWFnZ986IrPBI/L/Nsqxni6El764nN6A7hig==\n-----END AGE ENCRYPTED FILE-----\n"
|
|
}
|
|
],
|
|
"lastmodified": "2026-04-19T12:31:43Z",
|
|
"mac": "ENC[AES256_GCM,data:5vmwAXCxmSWh9HZWZGZfFglyDRdrRKiZOnPQrYCzMBYP5hMD9t8sW3xpnmD/2pz5eqP0rIZTE8SCXK4OIJNJ9YJdoRUPDNyTQ5LDIMLbHEcAQrAk3jYN7HnXCa9AUe2nPRQi0KsI0VbxTwIDthqwZSrQAQMZ8m4FYFoBV5tZVpA=,iv:UomaST+33fy6txRq2DpPs+6YUZsvpjC5nwHMfc3ik60=,tag:mQOig05Un2S7UV9nNPKEeQ==,type:str]",
|
|
"version": "3.12.2"
|
|
}
|
|
}
|