# Secrets (agenix)

Encrypted secrets for the fleet, managed with [agenix](https://github.com/ryantm/agenix).

Each secret is an age-encrypted file (`*.age`) encrypted to a set of recipient
public keys declared in [`secrets.nix`](./secrets.nix). A host decrypts its
secrets at activation using its SSH **host** key
(`/etc/ssh/ssh_host_ed25519_key`), so every host that must read a secret has to
be listed as a recipient for it.

`secrets.nix` is read only by the `agenix` CLI. It is never imported into the
NixOS evaluation.

## Secrets in this repo

| File            | Purpose                                                                 | Recipients                          |
| --------------- | ----------------------------------------------------------------------- | ----------------------------------- |
| `ldap-bind.age` | SSSD → Authentik LDAP bind credential, as an `sssd.conf` drop-in snippet | all SSSD-enabled hosts (not EDaaS)  |

Consumed by [`modules/sssd.nix`](../modules/sssd.nix) via
`age.secrets.ldap-bind.path`, which places the decrypted snippet at
`/etc/sssd/conf.d/01-ldap-authtok.conf`.

> **`ldap-bind.age` is not committed yet.** Only `ldap-bind.age.PLACEHOLDER`
> ships in this change (real host recipient keys and the real password were not
> available when it was written). Follow the steps below to create the real
> secret, then delete the `.PLACEHOLDER`.

## Owner setup checklist

Run these once (per new host or when the bind password rotates):

### 1. Collect host recipient keys

On each SSSD-enabled host (all Linux hosts **except** EDaaS):

```sh
cat /etc/ssh/ssh_host_ed25519_key.pub
```

Paste each value into the matching placeholder in `secrets.nix`, replacing the
`AAAA_PLACEHOLDER_REPLACE_ME_*` strings. (Optionally uncomment and set `admin`
to an operator user key so the secret can be edited off-host.)

### 2. Encrypt the bind password

The plaintext must be a **full sssd.conf drop-in snippet**, because SSSD cannot
read `ldap_default_authtok` from a separate file — it only merges `conf.d/*.conf`.
The content is exactly:

```ini
[domain/default]
ldap_default_authtok = <the sssd-bind service-account password>
```

Use the password of the `sssd-bind` (Terraform: `sssd-bind`) Authentik LDAP
service account. Then, from the repo root:

```sh
# Requires the agenix CLI: `nix run github:ryantm/agenix -- -e secrets/ldap-bind.age`
cd secrets
agenix -e ldap-bind.age
```

An `$EDITOR` opens; paste the two-line snippet above, save, quit. agenix writes
the encrypted `ldap-bind.age`. Commit it and delete `ldap-bind.age.PLACEHOLDER`.

### 3. Rekey after changing recipients

If you add/remove hosts in `secrets.nix`, re-encrypt every secret to the new
recipient set:

```sh
cd secrets
agenix -r
```

### 4. DNS

`ldap.lyrapup.pet` must resolve to the Authentik LDAP outpost and serve LDAPS on
port 636 with a certificate the hosts trust (`ldap_tls_reqcert = demand`). If the
cert is not from a system-trusted CA, add it to the hosts' trust store
(`security.pki.certificateFiles`) or relax `ldap_tls_reqcert` in
`modules/sssd.nix`.

### 5. Rebuild

```sh
sudo nixos-rebuild switch --flake .#<host>
```

Verify with `getent passwd <ldap-user>` and `id <ldap-user>`.