[codex] normalize module entrypoints

.sops.yaml

@@ -0,0 +1,12 @@
+keys:
+  users:
+    - &rap_zion age1y8vwxjyzhftr8n0mry5zkq34ra5g69z927p9s3qrj04gzqwasc8q3fqlgf
+    - &kubex age1qmfyk82lve992tvzw82d4dgr3ek77xx9m7uez3uq55mgqu6r5eys40evkr
+    - &firefly age13ps3kkzfn3eyaqc50reudytr5ws80ssamzh09kj6878a6lgxususuu58wp
+creation_rules:
+  - path_regex: secrets/common/ssh.yaml$
+    key_groups:
+      - age:
+          - *rap_zion
+          - *kubex
+          - *firefly

README.md

@@ -45,9 +45,9 @@ nh home switch -c nix@firefly .
 # nix build installer iso
 nix build .#nixosConfigurations.vinox.config.system.build.isoImage
 
-# nh remote switch
-nh os switch --hostname kubex . -d always --target-host kubex
-nh os switch --hostname nixberry . -d always --target-host <IP>
+# nh remote switch / update
+nh os boot --hostname kubex . -d always --target-host kubex
+nh os boot --hostname nixberry . -d always --target-host <IP>
 
 # nix remote switch
 nixos-rebuild switch --flake .#kubex --target-host 192.168.55.10 --sudo

docs/k3s.md

@@ -31,6 +31,13 @@ sudo zpool create -f \
     raidz2 /dev/sda /dev/sdb /dev/sdc /dev/sdd
 ```
 
+The `k3s` role includes a `wait-for-zfs-pool.service` unit that imports `kubex-main`
+if needed, then loads its encryption key from `rap@nixberry` before `k3s.service`
+starts.
+
+Because the unit runs non-interactively, `kubex` is configured for passwordless sudo
+for members of the `wheel` group.
+
 ## Copy kubeconfig
 
 ```bash

docs/new-host.md

@@ -8,13 +8,18 @@ option.
 In order to access secrets via `sops-nix`, the `age-key` which is autogenerated for every host needs to be copied
 over to the `.sops.yaml` config.
 
+This repo keeps the SSH-related secrets in `secrets/common/ssh.yaml` and deploys them into `~/.ssh/`:
+
+- NixOS hosts get them from `modules/nixos/system/sops.nix`
+- standalone Home Manager hosts get them from `modules/home/services/sops.nix`
+- hybrid hosts should let only one layer own `~/.ssh` to avoid duplicate files
+
 ```
 # Connect to the new host, and copy the public key of the autogenerated age-key.
 sudo cat /home/rap/.config/sops/age/keys.txt | grep "public key"
 
-# Add recipient in .sops.yaml and paste public key, assign it to a creaton_rule.
-# Then a rekey for the secrets.yaml is necessary.
-sops updatekeys secrets/secrets.yaml
+# Add recipient in `.sops.yaml` and paste the public key, then update the secret file.
+sops updatekeys secrets/common/ssh.yaml
 ```
 
 ## Github action