From 1ae328f04dc5255461893e271a6c0e57ace6e736 Mon Sep 17 00:00:00 2001
From: root <root@hubris.local>
Date: Wed, 20 May 2026 16:38:44 +0200
Subject: [PATCH] inventory: record age pubkeys for hubris + apps (Phase 3a)

First two clients have age keys issued by secrets-issuance.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 hosts/apps.yaml   | 3 +++
 hosts/hubris.yaml | 1 +
 inventory.yaml    | 8 +++++---
 3 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/hosts/apps.yaml b/hosts/apps.yaml
index daef02b..9a80b4e 100644
--- a/hosts/apps.yaml
+++ b/hosts/apps.yaml
@@ -11,6 +11,8 @@ lan_ip: 192.168.8.205
 mesh:
   netbird:
     fqdn: apps.netbird.selfhosted
+  tailscale:
+    ip: 100.121.171.122
 mesh_globals:
   primary: netbird
   accepted:
@@ -44,6 +46,7 @@ services_hosted:
   netbird_host: apps.netbird.selfhosted
   endpoint: http://apps.netbird.selfhosted:9820/issue
   note: Issues per-client age private keys. Mesh-only.
+age_pubkey: age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0
 see_also:
 - containers/105-apps.md
 mcp_endpoint: http://apps.netbird.selfhosted:9810/sse
diff --git a/hosts/hubris.yaml b/hosts/hubris.yaml
index bc507db..99e3f55 100644
--- a/hosts/hubris.yaml
+++ b/hosts/hubris.yaml
@@ -27,6 +27,7 @@ services_hosted:
   url: https://proxmox.hubris.network
   backend: hubris
   port: 8006
+age_pubkey: age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6
 see_also:
 - hosts/hubris.md
 mcp_endpoint: http://apps.netbird.selfhosted:9810/sse
diff --git a/inventory.yaml b/inventory.yaml
index 6a1fa6e..20440b3 100644
--- a/inventory.yaml
+++ b/inventory.yaml
@@ -131,7 +131,7 @@ hosts:
       netbird_port: 22022      # see infrastructure/ssh-access.md
     mounts:
       - /mnt/library           # shared lvmthin
-    age_pubkey: ""             # filled by issuance on first bootstrap
+    age_pubkey: age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6
 
   # ----- LXC containers (all on hubris) -----
   jellyfin:
@@ -191,14 +191,16 @@ hosts:
     role: docker-apps
     lan_ip: 192.168.8.205
     public_hosts: [artifacto.hubris.network]
-    mesh: {netbird: {fqdn: apps.netbird.selfhosted}}
+    mesh:
+      netbird: {fqdn: apps.netbird.selfhosted}
+      tailscale: {ip: 100.121.171.122}
     mounts: [/mnt/library]
     runs:
       - artifacto
       - plantuml
       - homelab-mcp           # introduced by this plan
       - secrets-issuance      # introduced by this plan
-    age_pubkey: ""
+    age_pubkey: age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0
 
   nextcloud:
     kind: lxc