dtoro
8ef17dba3d
The IONOS netbird VPS held two credentials in plaintext that were the last
holdouts from the homelab's sops+age secrets pattern:
- /root/turn-pass.txt (coturn long-term-credential password)
- PKCEAuthorizationFlow.ProviderConfig.ClientSecret inline in
/opt/management.json (Authentik OIDC client secret)
This commit moves both into sops-encrypted YAML in the repo and adds a render
command that recreates the VPS config files from templates + decrypted secrets:
* secrets/turn-shared-secret.yaml — encrypted `password: <coturn pwd>`
* secrets/netbird-authentik-oidc.yaml — encrypted `client_secret: <...>`
Both recipients = hubris + apps + republic-laptop (same 3 as hello.yaml).
* vps/turnserver.conf.tmpl + vps/management.json.tmpl — templates with
{{TURN_PASSWORD}} + {{AUTHENTIK_CLIENT_SECRET}} placeholders.
* bin/homelab new subcommand `render-vps-configs`:
- Decrypts both secrets locally (works on any recipient).
- Substitutes placeholders into templates.
- Diffs against current VPS state via ssh, prompts, applies atomically
(write `.new` then mv), restarts coturn + netbird-mgmt.
- --dry-run + -y flags. Hops through hubris when not running on hubris
itself, since VPS sshd is locked to hubris's pubkey.
* inventory.yaml adds the VPS as `kind: external` (new kind; reserved for
ssh-managed hosts that aren't homelab clients themselves — no age key,
no /opt/homelab-context). hosts/netbird-vps.yaml regenerated.
* SHARED_SECRETS list includes both new secrets so re-keys on enrollment
changes pick them up automatically.
After this lands + the 5-min sync propagates to hubris, run from hubris PVE
shell (or any client; hubris just skips the extra ssh hop):
homelab render-vps-configs --dry-run # see plan, no changes
homelab render-vps-configs -y # apply + restart services
Once verified working, the plaintext `/root/turn-pass.txt` should be deleted
on the VPS (the rendered /etc/turnserver.conf no longer needs it as a
reference).
30 lines
1.1 KiB
YAML
30 lines
1.1 KiB
YAML
# Generated by mcp/build_host_files.py from inventory.yaml.
|
|
# Do NOT edit by hand — your changes will be overwritten.
|
|
# Source of truth: ../inventory.yaml
|
|
name: netbird-vps
|
|
kind: external
|
|
os: linux
|
|
role: netbird-mgmt
|
|
mesh:
|
|
netbird:
|
|
ip: 100.122.165.149
|
|
fqdn: netbird-ionos.netbird.selfhosted
|
|
mesh_globals:
|
|
primary: netbird
|
|
accepted:
|
|
- netbird
|
|
- tailscale
|
|
ssh:
|
|
user: root
|
|
notes:
|
|
- "Public IONOS VPS \u2014 hosts the vanilla netbird mgmt+signal+relay+dashboard stack + host coturn (see\
|
|
\ infrastructure/vps-hardening.md + infrastructure/mesh.md changelog 2026-05-21)."
|
|
- NOT a homelab client. No /etc/age/key.txt, no /opt/homelab-context clone. Managed via ssh from hubris;
|
|
sshd is locked to hubris's pubkey.
|
|
- Public IPv4 82.165.190.79. Auto-patching via unattended-upgrades.
|
|
- Configs rendered by `homelab render-vps-configs` from vps/turnserver.conf.tmpl + vps/management.json.tmpl,
|
|
with secrets decrypted from secrets/turn-shared-secret.yaml + secrets/netbird-authentik-oidc.yaml on
|
|
hubris.
|
|
mcp_endpoint: https://mcp.hubris.network/sse
|
|
secrets_issuance_endpoint: https://secrets.hubris.network/issue
|