cleanup: archive stale secrets/ + secrets-issuance/, add Infisical bootstrap script, update SOPS paths to archive/

.sops.yaml

@@ -1,14 +1,12 @@
 # SOPS recipient rules.
 #
-# Each rule pins one or more age public keys as recipients for files matching
-# the path_regex. The build_host_files.py generator doesn't read this file;
-# `sops` does — to encrypt a new secret, run `sops -e secrets/<name>.yaml`
-# from the repo root and SOPS will pick the matching rule below.
+# SOPS is DR-fallback only — Infisical is the active secrets backend.
+# Files live in archive/secrets-sops-backup/ for cold recovery.
+# To encrypt a new DR secret: sops -e archive/secrets-sops-backup/<name>.yaml
 #
-# To grant a secret to a new client: add their age public key (from
+# To grant a DR secret to a new client: add their age public key (from
 # inventory.yaml `hosts.<name>.age_pubkey`) to the relevant rule below, then
-# run `sops updatekeys secrets/<name>.yaml` to re-encrypt without rotating
-# the ciphertext payload.
+# run `sops updatekeys archive/secrets-sops-backup/<name>.yaml` to re-encrypt.
 #
 # To revoke: remove the recipient from the relevant rule and run
 # `sops updatekeys` (this is what `homelab client remove` calls). Past
@@ -16,7 +14,7 @@
 # underlying credential if compromise is suspected.
 
 creation_rules:
-  - path_regex: ^secrets/hello\.yaml$
+  - path_regex: ^archive/secrets-sops-backup/hello\.yaml$
     # The "hello" secret is encrypted to every enrolled client so the bootstrap
     # decrypt test works for everyone. Add each new client's age_pubkey when
     # they enrol; re-key with `sops updatekeys -y secrets/hello.yaml`.
@@ -29,7 +27,7 @@ creation_rules:
       age1rtwvdct6avjkr3cyxv3vue3vqx4d524fjfr3vk7xrnvyrylnry5sm54sn4,
       age1pwtdws2thdh7vzp2dzttl3zxgcs2tgpcsjsqgw3q04nyml4kvuqq467u4x
 
-  - path_regex: ^secrets/gitea-pat\.yaml$
+  - path_regex: archive/secrets-sops-backupgitea-pat\.yaml$
     # Write-scoped Gitea PAT (dtoro user). Same recipient list as hello.yaml
     # since every enrolled client should be able to push (homelab client
     # add/remove, wiki edits, etc.).
@@ -42,17 +40,17 @@ creation_rules:
       age1rtwvdct6avjkr3cyxv3vue3vqx4d524fjfr3vk7xrnvyrylnry5sm54sn4,
       age1pwtdws2thdh7vzp2dzttl3zxgcs2tgpcsjsqgw3q04nyml4kvuqq467u4x
 
-  - path_regex: ^secrets/gitea-tokens\.yaml$
+  - path_regex: archive/secrets-sops-backupgitea-tokens\.yaml$
     # Workstations only.
     age: >-
       # placeholder — fill with age_pubkey of: republic-laptop, mac-mini, strong, hubris
 
-  - path_regex: ^secrets/webhook-hmacs\.yaml$
+  - path_regex: archive/secrets-sops-backupwebhook-hmacs\.yaml$
     # LXCs that run a webhook receiver.
     age: >-
       # placeholder — fill with age_pubkey of: apps, caddy
 
-  - path_regex: ^secrets/turn-shared-secret\.yaml$
+  - path_regex: archive/secrets-sops-backupturn-shared-secret\.yaml$
     # coturn TURN long-term-credential password. Consumed by hubris (which
     # renders /etc/turnserver.conf + /opt/management.json on the VPS via
     # `homelab render-vps-configs`). Other recipients are convenience for
@@ -65,7 +63,7 @@ creation_rules:
       age1s07zs83ehtlg8jtwvr75ltc3c4cdlemfwjuxrwjtwkqxkl9tpggsyrzn2h,
       age1pwtdws2thdh7vzp2dzttl3zxgcs2tgpcsjsqgw3q04nyml4kvuqq467u4x
 
-  - path_regex: ^secrets/netbird-authentik-oidc\.yaml$
+  - path_regex: archive/secrets-sops-backupnetbird-authentik-oidc\.yaml$
     # Authentik OIDC client secret for the netbird-dashboard provider.
     # Consumed by hubris to render /opt/management.json on the VPS
     # (PKCEAuthorizationFlow.ProviderConfig.ClientSecret).
@@ -77,7 +75,7 @@ creation_rules:
       age1s07zs83ehtlg8jtwvr75ltc3c4cdlemfwjuxrwjtwkqxkl9tpggsyrzn2h,
       age1pwtdws2thdh7vzp2dzttl3zxgcs2tgpcsjsqgw3q04nyml4kvuqq467u4x
 
-  - path_regex: ^secrets/netbird-pat\.yaml$
+  - path_regex: archive/secrets-sops-backupnetbird-pat\.yaml$
     # NetBird API Personal Access Token. Consumed by the dns-sync job on the
     # `dns` LXC (107) to reconcile Technitium -> NetBird managed DNS zone.
     # (When 107 is enrolled, add its age_pubkey here and updatekeys.)
@@ -87,7 +85,7 @@ creation_rules:
       age1vf8h7s8mqsn2q5eadgpdupsj4mwn8zguc77d85ws3xj40sl9rgksx2rxw6,
       age1z62ff2ak9zj5ctcvaxwyyhedwjvlwgm2dkn9nk3wrwk8fkavcpmsqwc2vs
 
-  - path_regex: ^secrets/openrouter-api-key\.yaml$
+  - path_regex: archive/secrets-sops-backupopenrouter-api-key\.yaml$
     # OpenRouter API key consumed by the `hermes` wrapper (bin/hermes) when
     # spawning a Goose session. Recipients are any host that should run a
     # Nous-Hermes agent. Add a host's age_pubkey here, then
@@ -99,7 +97,7 @@ creation_rules:
       age1z62ff2ak9zj5ctcvaxwyyhedwjvlwgm2dkn9nk3wrwk8fkavcpmsqwc2vs,
       age1s07zs83ehtlg8jtwvr75ltc3c4cdlemfwjuxrwjtwkqxkl9tpggsyrzn2h
 
-  - path_regex: ^secrets/yuvomi-api-token\.yaml$
+  - path_regex: archive/secrets-sops-backupyuvomi-api-token\.yaml$
     # Named Bearer token for the Yuvomi REST API, consumed by yuvomi-mcp on
     # LXC 129 (house).
     age: >-
@@ -108,7 +106,7 @@ creation_rules:
       age1z62ff2ak9zj5ctcvaxwyyhedwjvlwgm2dkn9nk3wrwk8fkavcpmsqwc2vs,
       age1s07zs83ehtlg8jtwvr75ltc3c4cdlemfwjuxrwjtwkqxkl9tpggsyrzn2h
 
-  - path_regex: ^secrets/hermes-house-users\.yaml$
+  - path_regex: archive/secrets-sops-backuphermes-house-users\.yaml$
     # Signal number → Yuvomi user_id mapping (PII). Consumed by hermesd on LXC 129.
     age: >-
       age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6,
@@ -116,7 +114,7 @@ creation_rules:
       age1z62ff2ak9zj5ctcvaxwyyhedwjvlwgm2dkn9nk3wrwk8fkavcpmsqwc2vs,
       age1s07zs83ehtlg8jtwvr75ltc3c4cdlemfwjuxrwjtwkqxkl9tpggsyrzn2h
 
-  - path_regex: ^secrets/oikos-approval-hmac\.yaml$
+  - path_regex: archive/secrets-sops-backupoikos-approval-hmac\.yaml$
     # HMAC signing key for Oikos approval-grant tokens (oikos/approve.py).
     # Recipients: apps (105, runs the approval engine alongside homelab-mcp)
     # and hubris (admin/debug decrypt). See OIKOS.md "Approval engine".
@@ -124,7 +122,7 @@ creation_rules:
       age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6,
       age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0
 
-  - path_regex: ^secrets/oikos-console-deploy-secret\.yaml$
+  - path_regex: archive/secrets-sops-backupoikos-console-deploy-secret\.yaml$
     # Shared HMAC secret for the Gitea deploy webhook (id 14) ->
     # oikos-console-deploy.service on apps (105). Generated + registered
     # with Gitea before the apps-side install ran (see