From e5d6b5bc8df9a5b716cab94a17aa12873fe4e672 Mon Sep 17 00:00:00 2001 From: lyrathorpe Date: Mon, 6 Jul 2026 13:57:30 +0100 Subject: [PATCH] chore(secrets): placeholder for the LDAP bind secret --- secrets/ldap-bind.age.PLACEHOLDER | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 secrets/ldap-bind.age.PLACEHOLDER diff --git a/secrets/ldap-bind.age.PLACEHOLDER b/secrets/ldap-bind.age.PLACEHOLDER new file mode 100644 index 0000000..19d2870 --- /dev/null +++ b/secrets/ldap-bind.age.PLACEHOLDER @@ -0,0 +1,21 @@ +THIS IS A PLACEHOLDER, NOT A REAL AGE SECRET. + +The real secrets/ldap-bind.age is produced by the repo owner with `agenix -e` +(see secrets/README.md) and is a binary age-encrypted blob. It is intentionally +NOT committed here because: + * the real host age recipients are not available to the author of this change + (they are each host's /etc/ssh/ssh_host_ed25519_key.pub), and + * fabricating an encrypted blob or fake host keys would be misleading. + +Committing this file as `ldap-bind.age` would let modules/sssd.nix reference +`../secrets/ldap-bind.age` and evaluate, but SSSD would fail to decrypt it at +runtime. Do ONE of the following before deploying: + + 1. Preferred: generate the real secret (secrets/README.md), commit it as + secrets/ldap-bind.age, and delete this .PLACEHOLDER file. + +The decrypted plaintext must be a valid sssd.conf drop-in (NOT the bare +password): + + [domain/default] + ldap_default_authtok =