2 Commits

Include renames

Author	SHA1	Message	Date
jakman85andClaude Opus 5	8059297036	fix(devcontainer): bake wg + qrencode into the image instead of splitting the VPN procedure across host and container ... Operator correction: "sop, wg, and any other tool requirement is supposed to be baked into the devcontainer." My previous commit discovered that `wg` existed only on the host, `sops` only in the container, and `qrencode` on neither -- and fixed it the wrong way, by splitting every step of the key procedure across the boundary and telling the operator to `dnf install qrencode` on their workstation. That breaks CLAUDE.md §5 and the devcontainer README's "Don't install the toolchain on the host", produces a procedure that cannot be reproduced in CI, and is miserable to follow. wireguard-tools + qrencode are now distro packages in the Containerfile. Both are in Fedora 44's repos (wireguard-tools 1.0.20260223 -- the same upstream version as the image this component runs -- and qrencode 4.1.1), unpinned like every other dnf package there: the pinned thing is the Fedora base, and neither is a gate tool whose version changes what green means. Three things got SIMPLER rather than merely relocated, which is the tell that the rule was right: * Step 2 is one pipeline in one shell -- `sops set ... "$(wg genkey)"` writes the key straight into the already-encrypted document. No staged copy in .cache, no `*.key`-suffix warning, no sha256 comparison to prove the right bytes landed. * new-peer.sh derives the server public key from wg-server-key.sops.yaml itself (`sops -d --extract | wg pubkey`), so there is no local key copy to keep in step with the encrypted one, and no magic host path it must live at. * `.cache/` is gitignored at the repo root (mirroring infra/ansible/.gitignore), giving the container a persistent non-committable scratch dir. new-peer.sh writes profiles to .cache/wg-peers/ -- necessary because the repo bind-mount is the container's only persistent read-write mount, so a profile in /tmp there is gone before it can reach a desktop. Its blanket "refuse to write inside the checkout" guard is now a `git check-ignore` test of the real property. Verified by execution, not reasoning: the image rebuilds; wg/qrencode/sops all resolve in it; `sops -d | wg pubkey` runs in one shell; new-peer.sh refuses the REPLACE-ME placeholder with an actionable message; and a full run with a throwaway server key renders a correct profile at 0600 under a 0700 gitignored dir, prints the QR, and refuses a non-ignored destination inside the repo. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>	2026-10-06 00:48:32 -05:00
jakman85andClaude Opus 5	e35612dc7e	fix(vpn-ingress): keep the server key in source through SOPS, not as an out-of-band Secret ... Operator correction: secrets are kept in source through sops. #55 shipped the WireGuard server private key as a Secret to `kubectl create` by hand. Two real costs, not just a convention break: * R-SEC-01 / spec docs/07 -- secrets live in source, SOPS-encrypted, and reach the cluster only through Flux. * It broke DR for the one credential that cannot be re-derived. A rebuild restores everything in git; it does not restore a hand-made Secret, and losing this key means re-enrolling EVERY device, because each client profile pins its public half. #55 papered over that with "keep a copy in your password manager". (Note secret-provenance did NOT forbid the original shape -- it scopes to app-namespace=true and vpn-ingress is deliberately a platform namespace. The rule broken was the written requirement, not an enforced control.) An agent still must not mint a long-lived private key (CLAUDE.md §6), so the file is committed ALREADY ENCRYPTED with `privatekey: REPLACE-ME`. That makes the wiring complete and green from the first commit -- resource line plus both overlay decryption patches -- leaving the operator exactly one act: replace the value. A commented-out resource to uncomment later is the "in git, no generator entry, reviewed, merged, still broken" shape this repo keeps hitting. The init guard is now a validation rather than an emptiness check: the value is piped through `wg pubkey`, which accepts only a real curve25519 private key, and the pod names which case it hit -- placeholder, empty, mangled, or (the silent one) still `ENC[` ciphertext because an overlay is missing its decryption patch, which otherwise applies cleanly with every Flux condition green. Second, independent finding that also fixes #55's step 2: `wg` is on the HOST only and `sops` is in the CONTAINER only, so `sops -d | wg pubkey` cannot run in one shell -- the command #55 documented could not have worked. Every step is now split by where it runs, and the written key is verified by comparing sha256 digests rather than printing anything. `qrencode` is on neither, so the QR step says so and gives the install command. Touches clusters/** and adds a **/*.sops.yaml, so approval-policy will block pending the operator's /approve-override. Deliberately not posted by me. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>	2026-10-05 23:55:29 -05:00