Viktor Barzin
cd2d00703c
state(vault): update encrypted state
2026-04-06 12:40:54 +03:00
Viktor Barzin
9f91a3db88
state: update encrypted terraform state
2026-04-06 11:26:45 +03:00
Viktor Barzin
f48e400087
state(vault): update encrypted state
2026-04-04 16:10:25 +03:00
Viktor Barzin
e65647edb4
state(vault): add vabbit81 user resources
2026-03-26 17:32:34 +02:00
Viktor Barzin
b6ac68d7f2
state(vault): update encrypted state
2026-03-26 12:21:23 +02:00
Viktor Barzin
45cb49416e
state(vault): update encrypted state
2026-03-25 02:48:15 +02:00
Viktor Barzin
41f53a0f3e
state(vault): update encrypted state
2026-03-25 02:24:45 +02:00
Viktor Barzin
ab95e0ab2f
state(vault): update encrypted state
2026-03-22 15:18:03 +02:00
Viktor Barzin
527bfb1c9e
state(vault): update encrypted state
2026-03-22 01:13:02 +02:00
Viktor Barzin
03f55d969f
state(vault): update encrypted state
2026-03-18 21:30:59 +00:00
Viktor Barzin
5b29cfc73a
state(vault): update encrypted state
2026-03-17 23:46:56 +00:00
Viktor Barzin
4d40c51a97
state(vault): update encrypted state
2026-03-17 23:14:24 +00:00
Viktor Barzin
7a8452e4c7
state(vault): update encrypted state
2026-03-17 23:14:16 +00:00
Viktor Barzin
0215d81622
state(vault): update encrypted state
2026-03-17 23:13:57 +00:00
Viktor Barzin
750cfcce7c
state(vault): update encrypted state
2026-03-17 23:13:55 +00:00
Viktor Barzin
e54ad33315
state(vault): update encrypted state
2026-03-17 23:13:19 +00:00
Viktor Barzin
02d0291797
state(vault): update encrypted state
2026-03-17 23:12:58 +00:00
Viktor Barzin
468df3c5c4
state(vault): update encrypted state
2026-03-17 23:12:35 +00:00
Viktor Barzin
cf570c3d3b
state(vault): update encrypted state
2026-03-17 23:12:03 +00:00
Viktor Barzin
4277b41c28
state(vault): update encrypted state
2026-03-17 23:11:55 +00:00
Viktor Barzin
77143dfd6b
state: per-stack Transit keys for namespace-owner access control
...
- Each stack gets its own Vault Transit key (transit/keys/sops-state-<stack>)
- state-sync passes per-stack Transit URI + age keys on encrypt
- Vault policies scope namespace-owners to their stacks only:
- sops-admin: wildcard access to all transit keys
- sops-user-<name>: access only to owned stack keys
- Anca (plotting-book) can only decrypt plotting-book state
- Admin can decrypt everything (via admin Transit policy or age fallback)
- External group sops-plotting-book maps Authentik group to Vault policy
- Updated CLAUDE.md with state sync documentation
2026-03-17 23:08:18 +00:00
Viktor Barzin
4e7ca1ad61
state: add Vault Transit as primary SOPS backend, age as fallback
...
- .sops.yaml: add hc_vault_transit_uri for transit/keys/sops-state
- state-sync: try Vault Transit first, fall back to age key on disk
- Re-encrypted all 101 state files with both Vault Transit + age
- Normal workflow: vault login → decrypt via Transit (no key files)
- Bootstrap/DR: age key at ~/.config/sops/age/keys.txt
2026-03-17 22:56:33 +00:00
Viktor Barzin
9f80eb7ba0
state: add devvm as SOPS recipient
...
Add devvm age public key to .sops.yaml and re-encrypt all 101 state
files with both laptop and devvm keys.
2026-03-17 22:41:19 +00:00
Viktor Barzin
b6faa24349
state: add SOPS-encrypted terraform state to git
...
- SOPS + age encrypts all 101 .tfstate files (JSON-aware: keys visible, values encrypted)
- scripts/state-sync: encrypt/decrypt/commit wrapper
- scripts/tg: auto-decrypt before ops, auto-encrypt+commit after apply/destroy
- terragrunt.hcl: -backup=- prevents backup file accumulation
- .gitignore: track .tfstate.enc, ignore plaintext .tfstate
- Cleaned 964MB of stale backups (state/backups/, .backup files)
2026-03-17 22:37:56 +00:00
