notplantsandClaude Fable 5.1 415d530baf cc-ci host: keys generated on the host, nothing copied from another machine ...

Operator: no ssh keys or non-essential secrets from the old orchestrator
box on the cc-ci host. `ssh cc-ci` uses cc-ci-local-ed25519 (generated on
the host, pub in nix/hosts/cc-ci/ssh-keys); pushes to Gitea use
autonomic-bot-cc-ci-ed25519 (generated on the host, registered on the bot
account); root reuses that file for the cc-ci-secrets submodule. README §4:
the /secrets/files inventory shrinks to exactly what cc-ci needs, and §4b
now says to make the host a sops recipient and take the master key away.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz

2026-09-07 21:31:13 +00:00

..

configuration.nix

fail2ban nginx jail: read the journal (NixOS nginx logs errors to stderr, not error.log)

2026-09-07 21:08:22 +00:00

hardware.nix

nix/hosts/cc-ci: real hardware + networking from the box; document the infect fixes

2026-09-07 20:15:16 +00:00

networking.nix

cc-ci host: one resolver set (no Hetzner caches), pin the host's own names

2026-09-07 21:03:00 +00:00

ssh-keys

cc-ci host: keys generated on the host, nothing copied from another machine

2026-09-07 21:31:13 +00:00