sops: the combined cc-ci host ssh host key is a recipient (secrets submodule bumped) #35

2026-09-07T21:31:33Z

autonomic-bot commented

2026-09-07 21:31:33 +00:00

cc-ci-secrets now also encrypts to the new host (195.201.88.249) via its ssh-host-key-derived age identity (age1tmvg…), like the canonical cc-ci did, so the off-box master recovery key no longer has to live on that box. .sops.yaml here updated to match; submodule pointer bumped to cc-ci-secrets 638c28d.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz

cc-ci-secrets now also encrypts to the new host (195.201.88.249) via its ssh-host-key-derived age identity (`age1tmvg…`), like the canonical cc-ci did, so the off-box master recovery key no longer has to live on that box. `.sops.yaml` here updated to match; submodule pointer bumped to cc-ci-secrets 638c28d. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz

autonomic-bot added 1 commit 2026-09-07 21:31:34 +00:00

sops: the combined cc-ci host's ssh host key is a recipient (secrets submodule bumped)

continuous-integration/drone/push Build is failing

Details

62a927c552

cc-ci-secrets now encrypts to the new host (195.201.88.249) via its own
ssh-host-key-derived age identity, like the canonical cc-ci did, so the
off-box master recovery key no longer has to live on that box —
/var/lib/sops-nix/key.txt there holds the host-derived identity instead.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz

autonomic-bot merged commit 124a1f8585 into main

2026-09-07 21:31:35 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: recipe-maintainers/cc-ci#35