Viktor Barzin
a1dfe195c6
state(immich): update encrypted state
2026-04-16 09:57:23 +00:00
Viktor Barzin
bb2731256b
state(immich): update encrypted state
2026-04-14 11:19:06 +00:00
Viktor Barzin
99e2bc1bef
state(immich): update encrypted state
2026-04-14 11:19:00 +00:00
Viktor Barzin
04eae139c6
state(immich): update encrypted state
2026-04-13 14:41:52 +00:00
Viktor Barzin
50ab67b5f7
state(immich): update encrypted state
2026-04-13 14:41:52 +00:00
Viktor Barzin
340e04de9c
state(immich): update encrypted state
2026-04-11 10:22:51 +01:00
Viktor Barzin
54dd6071d2
state(immich): update encrypted state
2026-04-11 10:15:41 +01:00
Viktor Barzin
37dbad47e9
state(immich): update encrypted state
2026-04-06 22:11:17 +03:00
Viktor Barzin
a486bbd66c
state(immich): update encrypted state
2026-04-06 10:50:34 +03:00
Viktor Barzin
58e698c647
state(immich): update encrypted state
2026-04-06 10:38:43 +03:00
Viktor Barzin
44a1c3a155
state(immich): update encrypted state
2026-03-27 13:54:19 +02:00
Viktor Barzin
a5e03f6673
state(immich): update encrypted state
2026-03-25 02:58:25 +02:00
Viktor Barzin
3ca259ffe0
state(immich): update encrypted state
2026-03-25 02:48:02 +02:00
Viktor Barzin
cef0092162
state(immich): update encrypted state
2026-03-25 02:10:21 +02:00
Viktor Barzin
b2b036ffd4
state(immich): update encrypted state
2026-03-24 19:40:03 +02:00
Viktor Barzin
3130a5f9e0
state(immich): update encrypted state
2026-03-22 15:18:25 +02:00
Viktor Barzin
2b2bf08e67
state(immich): update encrypted state
2026-03-21 11:25:22 +00:00
Viktor Barzin
89bb74c4ee
state(immich): update encrypted state
2026-03-19 22:47:32 +00:00
Viktor Barzin
c7dc63f923
state(immich): update encrypted state
2026-03-19 20:39:18 +00:00
Viktor Barzin
77143dfd6b
state: per-stack Transit keys for namespace-owner access control
...
- Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>)
- state-sync passes per-stack Transit URI + age keys on encrypt
- Vault policies scope namespace-owners to their stacks only:
- sops-admin: wildcard access to all transit keys
- sops-user-<name>: access only to owned stack keys
- Anca (plotting-book) can only decrypt plotting-book state
- Admin can decrypt everything (via admin Transit policy or age fallback)
- External group sops-plotting-book maps Authentik group to Vault policy
- Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
Viktor Barzin
4e7ca1ad61
state: add Vault Transit as primary SOPS backend, age as fallback
...
- .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state
- state-sync: try Vault Transit first, fall back to age key on disk
- Re-encrypted all 101 state files with both Vault Transit + age
- Normal workflow: vault login → decrypt via Transit (no key files)
- Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
Viktor Barzin
9f80eb7ba0
state: add devvm as SOPS recipient
...
Add devvm age public key to .sops.yaml and re-encrypt all 101 state
files with both laptop and devvm keys.
2026-03-17 22:41:19 +00:00
Viktor Barzin
b6faa24349
state: add SOPS-encrypted terraform state to git
...
- SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted)
- scripts/state-sync: encrypt/decrypt/commit wrapper
- scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy
- terragrunt.hcl: -backup=- prevents backup file accumulation
- .gitignore: track .tfstate.enc, ignore plaintext .tfstate
- Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
