cleanup: archive stale secrets/ + secrets-issuance/, add Infisical bootstrap script, update SOPS paths to archive/

.sops.yaml

@@ -1,14 +1,12 @@
 # SOPS recipient rules.
 #
-# Each rule pins one or more age public keys as recipients for files matching
-# the path_regex. The build_host_files.py generator doesn't read this file;
-# `sops` does — to encrypt a new secret, run `sops -e secrets/<name>.yaml`
-# from the repo root and SOPS will pick the matching rule below.
+# SOPS is DR-fallback only — Infisical is the active secrets backend.
+# Files live in archive/secrets-sops-backup/ for cold recovery.
+# To encrypt a new DR secret: sops -e archive/secrets-sops-backup/<name>.yaml
 #
-# To grant a secret to a new client: add their age public key (from
+# To grant a DR secret to a new client: add their age public key (from
 # inventory.yaml `hosts.<name>.age_pubkey`) to the relevant rule below, then
-# run `sops updatekeys secrets/<name>.yaml` to re-encrypt without rotating
-# the ciphertext payload.
+# run `sops updatekeys archive/secrets-sops-backup/<name>.yaml` to re-encrypt.
 #
 # To revoke: remove the recipient from the relevant rule and run
 # `sops updatekeys` (this is what `homelab client remove` calls). Past
@@ -16,7 +14,7 @@
 # underlying credential if compromise is suspected.
 
 creation_rules:
-  - path_regex: ^secrets/hello\.yaml$
+  - path_regex: ^archive/secrets-sops-backup/hello\.yaml$
     # The "hello" secret is encrypted to every enrolled client so the bootstrap
     # decrypt test works for everyone. Add each new client's age_pubkey when
     # they enrol; re-key with `sops updatekeys -y secrets/hello.yaml`.
@@ -29,7 +27,7 @@ creation_rules:
       age1rtwvdct6avjkr3cyxv3vue3vqx4d524fjfr3vk7xrnvyrylnry5sm54sn4,
       age1pwtdws2thdh7vzp2dzttl3zxgcs2tgpcsjsqgw3q04nyml4kvuqq467u4x
 
-  - path_regex: ^secrets/gitea-pat\.yaml$
+  - path_regex: archive/secrets-sops-backupgitea-pat\.yaml$
     # Write-scoped Gitea PAT (dtoro user). Same recipient list as hello.yaml
     # since every enrolled client should be able to push (homelab client
     # add/remove, wiki edits, etc.).
@@ -42,17 +40,17 @@ creation_rules:
       age1rtwvdct6avjkr3cyxv3vue3vqx4d524fjfr3vk7xrnvyrylnry5sm54sn4,
       age1pwtdws2thdh7vzp2dzttl3zxgcs2tgpcsjsqgw3q04nyml4kvuqq467u4x
 
-  - path_regex: ^secrets/gitea-tokens\.yaml$
+  - path_regex: archive/secrets-sops-backupgitea-tokens\.yaml$
     # Workstations only.
     age: >-
       # placeholder — fill with age_pubkey of: republic-laptop, mac-mini, strong, hubris
 
-  - path_regex: ^secrets/webhook-hmacs\.yaml$
+  - path_regex: archive/secrets-sops-backupwebhook-hmacs\.yaml$
     # LXCs that run a webhook receiver.
     age: >-
       # placeholder — fill with age_pubkey of: apps, caddy
 
-  - path_regex: ^secrets/turn-shared-secret\.yaml$
+  - path_regex: archive/secrets-sops-backupturn-shared-secret\.yaml$
     # coturn TURN long-term-credential password. Consumed by hubris (which
     # renders /etc/turnserver.conf + /opt/management.json on the VPS via
     # `homelab render-vps-configs`). Other recipients are convenience for
@@ -65,7 +63,7 @@ creation_rules:
       age1s07zs83ehtlg8jtwvr75ltc3c4cdlemfwjuxrwjtwkqxkl9tpggsyrzn2h,
       age1pwtdws2thdh7vzp2dzttl3zxgcs2tgpcsjsqgw3q04nyml4kvuqq467u4x
 
-  - path_regex: ^secrets/netbird-authentik-oidc\.yaml$
+  - path_regex: archive/secrets-sops-backupnetbird-authentik-oidc\.yaml$
     # Authentik OIDC client secret for the netbird-dashboard provider.
     # Consumed by hubris to render /opt/management.json on the VPS
     # (PKCEAuthorizationFlow.ProviderConfig.ClientSecret).
@@ -77,7 +75,7 @@ creation_rules:
       age1s07zs83ehtlg8jtwvr75ltc3c4cdlemfwjuxrwjtwkqxkl9tpggsyrzn2h,
       age1pwtdws2thdh7vzp2dzttl3zxgcs2tgpcsjsqgw3q04nyml4kvuqq467u4x
 
-  - path_regex: ^secrets/netbird-pat\.yaml$
+  - path_regex: archive/secrets-sops-backupnetbird-pat\.yaml$
     # NetBird API Personal Access Token. Consumed by the dns-sync job on the
     # `dns` LXC (107) to reconcile Technitium -> NetBird managed DNS zone.
     # (When 107 is enrolled, add its age_pubkey here and updatekeys.)
@@ -87,7 +85,7 @@ creation_rules:
       age1vf8h7s8mqsn2q5eadgpdupsj4mwn8zguc77d85ws3xj40sl9rgksx2rxw6,
       age1z62ff2ak9zj5ctcvaxwyyhedwjvlwgm2dkn9nk3wrwk8fkavcpmsqwc2vs
 
-  - path_regex: ^secrets/openrouter-api-key\.yaml$
+  - path_regex: archive/secrets-sops-backupopenrouter-api-key\.yaml$
     # OpenRouter API key consumed by the `hermes` wrapper (bin/hermes) when
     # spawning a Goose session. Recipients are any host that should run a
     # Nous-Hermes agent. Add a host's age_pubkey here, then
@@ -99,7 +97,7 @@ creation_rules:
       age1z62ff2ak9zj5ctcvaxwyyhedwjvlwgm2dkn9nk3wrwk8fkavcpmsqwc2vs,
       age1s07zs83ehtlg8jtwvr75ltc3c4cdlemfwjuxrwjtwkqxkl9tpggsyrzn2h
 
-  - path_regex: ^secrets/yuvomi-api-token\.yaml$
+  - path_regex: archive/secrets-sops-backupyuvomi-api-token\.yaml$
     # Named Bearer token for the Yuvomi REST API, consumed by yuvomi-mcp on
     # LXC 129 (house).
     age: >-
@@ -108,7 +106,7 @@ creation_rules:
       age1z62ff2ak9zj5ctcvaxwyyhedwjvlwgm2dkn9nk3wrwk8fkavcpmsqwc2vs,
       age1s07zs83ehtlg8jtwvr75ltc3c4cdlemfwjuxrwjtwkqxkl9tpggsyrzn2h
 
-  - path_regex: ^secrets/hermes-house-users\.yaml$
+  - path_regex: archive/secrets-sops-backuphermes-house-users\.yaml$
     # Signal number → Yuvomi user_id mapping (PII). Consumed by hermesd on LXC 129.
     age: >-
       age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6,
@@ -116,7 +114,7 @@ creation_rules:
       age1z62ff2ak9zj5ctcvaxwyyhedwjvlwgm2dkn9nk3wrwk8fkavcpmsqwc2vs,
       age1s07zs83ehtlg8jtwvr75ltc3c4cdlemfwjuxrwjtwkqxkl9tpggsyrzn2h
 
-  - path_regex: ^secrets/oikos-approval-hmac\.yaml$
+  - path_regex: archive/secrets-sops-backupoikos-approval-hmac\.yaml$
     # HMAC signing key for Oikos approval-grant tokens (oikos/approve.py).
     # Recipients: apps (105, runs the approval engine alongside homelab-mcp)
     # and hubris (admin/debug decrypt). See OIKOS.md "Approval engine".
@@ -124,7 +122,7 @@ creation_rules:
       age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6,
       age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0
 
-  - path_regex: ^secrets/oikos-console-deploy-secret\.yaml$
+  - path_regex: archive/secrets-sops-backupoikos-console-deploy-secret\.yaml$
     # Shared HMAC secret for the Gitea deploy webhook (id 14) ->
     # oikos-console-deploy.service on apps (105). Generated + registered
     # with Gitea before the apps-side install ran (see

cmd/oikos/main.go

@@ -299,7 +299,7 @@ func runSecret(ctx context.Context, cfg config.Config) {
 	sub := os.Args[2]
 	secretsDir := cfg.SecretsDir
 	if secretsDir == "" {
-		secretsDir = "secrets"
+		secretsDir = "archive/secrets-sops-backup"
 	}
 	sopsBackend := secrets.NewSOPSBackend(secretsDir)
 

scripts/bootstrap-infisical.sh

@@ -0,0 +1,138 @@
+#!/bin/bash
+# Bootstrap Infisical from zero.
+# Run after: docker compose up -d postgres
+# Produces: .env with all OIKOS_INFISICAL_* values, admin creds in .infisical-credentials
+set -euo pipefail
+
+INFISICAL_URL="${INFISICAL_URL:-http://localhost:8080}"
+ADMIN_EMAIL="${ADMIN_EMAIL:-oikos@hubris.network}"
+ADMIN_PASS="${ADMIN_PASS:-oikos-admin-$(openssl rand -hex 4)}"
+PROJECT_NAME="${PROJECT_NAME:-oikos}"
+ORG_NAME="${ORG_NAME:-Oikos}"
+
+# ── 1. Generate keys ───────────────────────────────────────────────
+echo "=== [1/6] Generating keys ==="
+ENCRYPTION_KEY=$(python3 -c "import secrets, string; print(''.join(secrets.choice(string.ascii_letters+string.digits) for _ in range(32)))")
+JWT_SIGNUP=$(openssl rand -hex 32)
+JWT_REFRESH=$(openssl rand -hex 32)
+JWT_AUTH=$(openssl rand -hex 32)
+JWT_SERVICE=$(openssl rand -hex 32)
+JWT_MFA=$(openssl rand -hex 32)
+JWT_PROVIDER=$(openssl rand -hex 32)
+
+# ── 2. Write .env ──────────────────────────────────────────────────
+cat > .env <<EOF
+INFISICAL_ENCRYPTION_KEY=$ENCRYPTION_KEY
+INFISICAL_JWT_SIGNUP_SECRET=$JWT_SIGNUP
+INFISICAL_JWT_REFRESH_SECRET=$JWT_REFRESH
+INFISICAL_JWT_AUTH_SECRET=$JWT_AUTH
+INFISICAL_JWT_SERVICE_SECRET=$JWT_SERVICE
+INFISICAL_JWT_MFA_SECRET=$JWT_MFA
+INFISICAL_JWT_PROVIDER_SECRET=$JWT_PROVIDER
+INFISICAL_SITE_URL=$INFISICAL_URL
+EOF
+
+# ── 3. Create DB + start services ──────────────────────────────────
+echo "=== [2/6] Creating infisical database ==="
+docker compose exec -T postgres psql -U oikos -d postgres -v ON_ERROR_STOP=1 <<SQL 2>/dev/null || true
+DROP DATABASE IF EXISTS infisical;
+CREATE DATABASE infisical;
+SQL
+
+echo "=== [3/6] Starting Infisical + Redis ==="
+docker compose --profile infisical up infisical redis -d --wait 2>&1 | tail -2
+
+# Wait for healthy
+for i in $(seq 1 30); do
+    if curl -sf "$INFISICAL_URL/api/status" > /dev/null 2>&1; then break; fi
+    sleep 2
+done
+echo "Infisical ready"
+
+# ── 4. Create admin ────────────────────────────────────────────────
+echo "=== [4/6] Creating admin account ==="
+SIGNUP=$(curl -s -X POST "$INFISICAL_URL/api/v1/admin/signup" \
+    -H "Content-Type: application/json" \
+    -d "{\"email\":\"$ADMIN_EMAIL\",\"password\":\"$ADMIN_PASS\",\"firstName\":\"Oikos\",\"lastName\":\"Admin\",\"organizationName\":\"$ORG_NAME\"}")
+ORG_ID=$(echo "$SIGNUP" | python3 -c "import sys,json; print(json.load(sys.stdin)['organization']['id'])")
+USER_TOKEN=$(echo "$SIGNUP" | python3 -c "import sys,json; print(json.load(sys.stdin)['token'])")
+echo "Admin created, org=$ORG_ID"
+
+# ── 5. Get org-scoped token ────────────────────────────────────────
+ORG_TOKEN=$(curl -s -X POST "$INFISICAL_URL/api/v3/auth/select-organization" \
+    -H "Authorization: Bearer $USER_TOKEN" \
+    -H "Content-Type: application/json" \
+    -d "{\"organizationId\":\"$ORG_ID\"}" | python3 -c "import sys,json; print(json.load(sys.stdin)['token'])")
+
+# ── 6. Create project + identity ───────────────────────────────────
+echo "=== [5/6] Creating project + machine identity ==="
+PROJECT=$(curl -s -X POST "$INFISICAL_URL/api/v1/projects" \
+    -H "Authorization: Bearer $ORG_TOKEN" \
+    -H "Content-Type: application/json" \
+    -d "{\"projectName\":\"$PROJECT_NAME\",\"slug\":\"$PROJECT_NAME\"}")
+PROJECT_ID=$(echo "$PROJECT" | python3 -c "import sys,json; print(json.load(sys.stdin)['project']['id'])")
+echo "Project: $PROJECT_NAME ($PROJECT_ID)"
+
+# Create machine identity
+IDENTITY=$(curl -s -X POST "$INFISICAL_URL/api/v1/identities" \
+    -H "Authorization: Bearer $ORG_TOKEN" \
+    -H "Content-Type: application/json" \
+    -d "{\"name\":\"$PROJECT_NAME-api\",\"role\":\"admin\",\"organizationId\":\"$ORG_ID\",\"projectIds\":[\"$PROJECT_ID\"]}")
+IDENTITY_ID=$(echo "$IDENTITY" | python3 -c "import sys,json; print(json.load(sys.stdin)['identity']['id'])")
+echo "Identity: $PROJECT_NAME-api ($IDENTITY_ID)"
+
+# Attach Universal Auth
+UA=$(curl -s -X POST "$INFISICAL_URL/api/v1/auth/universal-auth/identities/$IDENTITY_ID" \
+    -H "Authorization: Bearer $ORG_TOKEN" \
+    -H "Content-Type: application/json" \
+    -d '{"clientIdTtl":0,"clientSecretTtl":0,"accessTokenTtl":2592000,"accessTokenMaxTtl":2592000,"accessTokenNumUsesLimit":0}')
+CLIENT_ID=$(echo "$UA" | python3 -c "import sys,json; print(json.load(sys.stdin)['identityUniversalAuth']['clientId'])")
+echo "UA attached, clientId=$CLIENT_ID"
+
+# Create client secret
+SECRET=$(curl -s -X POST "$INFISICAL_URL/api/v1/auth/universal-auth/identities/$IDENTITY_ID/client-secrets" \
+    -H "Authorization: Bearer $ORG_TOKEN" \
+    -H "Content-Type: application/json" \
+    -d '{"description":"default","clientSecretTtl":0,"clientSecretNumUsesLimit":0}')
+CLIENT_SECRET=$(echo "$SECRET" | python3 -c "import sys,json; print(json.load(sys.stdin)['clientSecret'])")
+echo "Client secret created"
+
+# Add identity to project
+curl -s -X POST "$INFISICAL_URL/api/v1/projects/$PROJECT_ID/memberships/identities/$IDENTITY_ID" \
+    -H "Authorization: Bearer $ORG_TOKEN" \
+    -H "Content-Type: application/json" \
+    -d '{"roles":[{"role":"admin","isTemporary":false}]}' > /dev/null
+echo "Identity added to project"
+
+# ── 7. Write credentials ──────────────────────────────────────────
+echo "=== [6/6] Writing credentials ==="
+cat >> .env <<EOF
+OIKOS_INFISICAL_SITE_URL=http://infisical:8080
+OIKOS_INFISICAL_CLIENT_ID=$CLIENT_ID
+OIKOS_INFISICAL_CLIENT_SECRET=$CLIENT_SECRET
+OIKOS_INFISICAL_PROJECT_ID=$PROJECT_ID
+OIKOS_INFISICAL_ENV=dev
+OIKOS_SECRET_BACKEND=infisical
+EOF
+
+cat > .infisical-credentials <<EOF
+# Infisical admin credentials (generated $(date -Iseconds))
+URL: $INFISICAL_URL
+Admin: $ADMIN_EMAIL / $ADMIN_PASS
+Organization: $ORG_ID
+Project: $PROJECT_NAME ($PROJECT_ID)
+Identity: $PROJECT_NAME-api ($IDENTITY_ID)
+Client ID: $CLIENT_ID
+Client Secret: $CLIENT_SECRET
+EOF
+
+echo ""
+echo "============================================"
+echo "Infisical bootstrapped."
+echo "Admin:   $ADMIN_EMAIL / $ADMIN_PASS"
+echo "Project: $PROJECT_NAME ($PROJECT_ID)"
+echo "UA:      $CLIENT_ID"
+echo ""
+echo ".env and .infisical-credentials written."
+echo "Next: oikos secret migrate  (if SOPS secrets exist)"
+echo "============================================"