dtoro
2084a1583e
New kernel modules, all wired into `homelab` CLI + tested against live
production where reachable:
- oikos/scheduler.py — Observe stage: HTTP health probes for every
service, disk-usage probes on hubris/strong, writes oikos/state.json
(gitignored — regenerates every run). `homelab service <name> health`
is now cache-first; `--live` forces a fresh probe. Deploys via
oikos/systemd/oikos-scheduler.{timer,service} on LXC 105.
- oikos/drift.py — SOPS-recipient-vs-inventory and lifecycle-consistency
detectors (fully local, no SSH) plus pct-list and Caddy-backend
detectors (best-effort SSH, degrade to an info finding when
unreachable rather than a false drift alarm). Found real, currently-
true drift on first run: republic-laptop's age key granted on every
secret but missing from inventory.yaml, grimmory missing from
hello.yaml's recipients, and an undocumented pve_id 131 on hubris —
recorded in OIKOS.md for the operator, not auto-fixed (each is a
config_mutation/destructive decision).
- oikos/signal.py — the attention layer: raised -> acknowledged ->
acting -> resolved|muted lifecycle, severity-based routing, dedup via
open_signal_for(). `homelab signal list|raise|ack|resolve|mute`.
- oikos/decide.py — the Decide-stage classifier: risk class x blast
radius x ledger-history confidence -> auto-act/escalate. Adds an
action-alias layer (oikos/policy.py ACTION_ALIASES) and auto-infers
service_name from the entity for per-service policy overrides.
`homelab decide <action> <entity>`.
- oikos/approve.py — the escalate route. No dedicated Matrix bot exists
in this homelab, so this is the repo-side half only: request/reply/
grant lifecycle with short-TTL HMAC-signed tokens (new secret
secrets/oikos-approval-hmac.yaml, recipients apps+hubris). Matrix
delivery is Hermes's existing @dtoro:avispero send path (documented
integration contract in the module docstring), not a new bot.
`homelab restart` now mechanically refuses config_mutation/destructive
services without a valid --approval-id, regardless of -y/interactivity.
- oikos/report.py — daily brief + weekly report from signal/approval/
ledger state (no Prometheus yet, so point-in-time counts only).
- plans/2026-07-05-oikos-prometheus-lxc.md — Prometheus is `planned`,
not provisioned: no pve_id is guessed here since Proxmox assigns real
IDs at creation time, and drift already found an unclaimed ID (131) to
investigate first.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
127 lines
6.5 KiB
YAML
127 lines
6.5 KiB
YAML
# SOPS recipient rules.
|
|
#
|
|
# Each rule pins one or more age public keys as recipients for files matching
|
|
# the path_regex. The build_host_files.py generator doesn't read this file;
|
|
# `sops` does — to encrypt a new secret, run `sops -e secrets/<name>.yaml`
|
|
# from the repo root and SOPS will pick the matching rule below.
|
|
#
|
|
# To grant a secret to a new client: add their age public key (from
|
|
# inventory.yaml `hosts.<name>.age_pubkey`) to the relevant rule below, then
|
|
# run `sops updatekeys secrets/<name>.yaml` to re-encrypt without rotating
|
|
# the ciphertext payload.
|
|
#
|
|
# To revoke: remove the recipient from the relevant rule and run
|
|
# `sops updatekeys` (this is what `homelab client remove` calls). Past
|
|
# ciphertext the client already decrypted is not affected — rotate the
|
|
# underlying credential if compromise is suspected.
|
|
|
|
creation_rules:
|
|
- path_regex: ^secrets/hello\.yaml$
|
|
# The "hello" secret is encrypted to every enrolled client so the bootstrap
|
|
# decrypt test works for everyone. Add each new client's age_pubkey when
|
|
# they enrol; re-key with `sops updatekeys -y secrets/hello.yaml`.
|
|
age: >-
|
|
age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6,
|
|
age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0,
|
|
age1vf8h7s8mqsn2q5eadgpdupsj4mwn8zguc77d85ws3xj40sl9rgksx2rxw6,
|
|
age1z62ff2ak9zj5ctcvaxwyyhedwjvlwgm2dkn9nk3wrwk8fkavcpmsqwc2vs,
|
|
age1s07zs83ehtlg8jtwvr75ltc3c4cdlemfwjuxrwjtwkqxkl9tpggsyrzn2h,
|
|
age1rtwvdct6avjkr3cyxv3vue3vqx4d524fjfr3vk7xrnvyrylnry5sm54sn4,
|
|
age1pwtdws2thdh7vzp2dzttl3zxgcs2tgpcsjsqgw3q04nyml4kvuqq467u4x
|
|
|
|
- path_regex: ^secrets/gitea-pat\.yaml$
|
|
# Write-scoped Gitea PAT (dtoro user). Same recipient list as hello.yaml
|
|
# since every enrolled client should be able to push (homelab client
|
|
# add/remove, wiki edits, etc.).
|
|
age: >-
|
|
age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6,
|
|
age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0,
|
|
age1vf8h7s8mqsn2q5eadgpdupsj4mwn8zguc77d85ws3xj40sl9rgksx2rxw6,
|
|
age1z62ff2ak9zj5ctcvaxwyyhedwjvlwgm2dkn9nk3wrwk8fkavcpmsqwc2vs,
|
|
age1s07zs83ehtlg8jtwvr75ltc3c4cdlemfwjuxrwjtwkqxkl9tpggsyrzn2h,
|
|
age1rtwvdct6avjkr3cyxv3vue3vqx4d524fjfr3vk7xrnvyrylnry5sm54sn4,
|
|
age1pwtdws2thdh7vzp2dzttl3zxgcs2tgpcsjsqgw3q04nyml4kvuqq467u4x
|
|
|
|
- path_regex: ^secrets/gitea-tokens\.yaml$
|
|
# Workstations only.
|
|
age: >-
|
|
# placeholder — fill with age_pubkey of: republic-laptop, mac-mini, strong, hubris
|
|
|
|
- path_regex: ^secrets/webhook-hmacs\.yaml$
|
|
# LXCs that run a webhook receiver.
|
|
age: >-
|
|
# placeholder — fill with age_pubkey of: apps, caddy
|
|
|
|
- path_regex: ^secrets/turn-shared-secret\.yaml$
|
|
# coturn TURN long-term-credential password. Consumed by hubris (which
|
|
# renders /etc/turnserver.conf + /opt/management.json on the VPS via
|
|
# `homelab render-vps-configs`). Other recipients are convenience for
|
|
# operator debugging — only hubris's pubkey is strictly required.
|
|
age: >-
|
|
age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6,
|
|
age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0,
|
|
age1vf8h7s8mqsn2q5eadgpdupsj4mwn8zguc77d85ws3xj40sl9rgksx2rxw6,
|
|
age1z62ff2ak9zj5ctcvaxwyyhedwjvlwgm2dkn9nk3wrwk8fkavcpmsqwc2vs,
|
|
age1s07zs83ehtlg8jtwvr75ltc3c4cdlemfwjuxrwjtwkqxkl9tpggsyrzn2h,
|
|
age1pwtdws2thdh7vzp2dzttl3zxgcs2tgpcsjsqgw3q04nyml4kvuqq467u4x
|
|
|
|
- path_regex: ^secrets/netbird-authentik-oidc\.yaml$
|
|
# Authentik OIDC client secret for the netbird-dashboard provider.
|
|
# Consumed by hubris to render /opt/management.json on the VPS
|
|
# (PKCEAuthorizationFlow.ProviderConfig.ClientSecret).
|
|
age: >-
|
|
age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6,
|
|
age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0,
|
|
age1vf8h7s8mqsn2q5eadgpdupsj4mwn8zguc77d85ws3xj40sl9rgksx2rxw6,
|
|
age1z62ff2ak9zj5ctcvaxwyyhedwjvlwgm2dkn9nk3wrwk8fkavcpmsqwc2vs,
|
|
age1s07zs83ehtlg8jtwvr75ltc3c4cdlemfwjuxrwjtwkqxkl9tpggsyrzn2h,
|
|
age1pwtdws2thdh7vzp2dzttl3zxgcs2tgpcsjsqgw3q04nyml4kvuqq467u4x
|
|
|
|
- path_regex: ^secrets/netbird-pat\.yaml$
|
|
# NetBird API Personal Access Token. Consumed by the dns-sync job on the
|
|
# `dns` LXC (107) to reconcile Technitium -> NetBird managed DNS zone.
|
|
# (When 107 is enrolled, add its age_pubkey here and updatekeys.)
|
|
age: >-
|
|
age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6,
|
|
age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0,
|
|
age1vf8h7s8mqsn2q5eadgpdupsj4mwn8zguc77d85ws3xj40sl9rgksx2rxw6,
|
|
age1z62ff2ak9zj5ctcvaxwyyhedwjvlwgm2dkn9nk3wrwk8fkavcpmsqwc2vs
|
|
|
|
- path_regex: ^secrets/openrouter-api-key\.yaml$
|
|
# OpenRouter API key consumed by the `hermes` wrapper (bin/hermes) when
|
|
# spawning a Goose session. Recipients are any host that should run a
|
|
# Nous-Hermes agent. Add a host's age_pubkey here, then
|
|
# `sops updatekeys -y secrets/openrouter-api-key.yaml`.
|
|
# See operations/hermes-agent.md.
|
|
age: >-
|
|
age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6,
|
|
age1vf8h7s8mqsn2q5eadgpdupsj4mwn8zguc77d85ws3xj40sl9rgksx2rxw6,
|
|
age1z62ff2ak9zj5ctcvaxwyyhedwjvlwgm2dkn9nk3wrwk8fkavcpmsqwc2vs,
|
|
age1s07zs83ehtlg8jtwvr75ltc3c4cdlemfwjuxrwjtwkqxkl9tpggsyrzn2h
|
|
|
|
- path_regex: ^secrets/yuvomi-api-token\.yaml$
|
|
# Named Bearer token for the Yuvomi REST API, consumed by yuvomi-mcp on
|
|
# LXC 129 (house).
|
|
age: >-
|
|
age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6,
|
|
age1vf8h7s8mqsn2q5eadgpdupsj4mwn8zguc77d85ws3xj40sl9rgksx2rxw6,
|
|
age1z62ff2ak9zj5ctcvaxwyyhedwjvlwgm2dkn9nk3wrwk8fkavcpmsqwc2vs,
|
|
age1s07zs83ehtlg8jtwvr75ltc3c4cdlemfwjuxrwjtwkqxkl9tpggsyrzn2h
|
|
|
|
- path_regex: ^secrets/hermes-house-users\.yaml$
|
|
# Signal number → Yuvomi user_id mapping (PII). Consumed by hermesd on LXC 129.
|
|
age: >-
|
|
age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6,
|
|
age1vf8h7s8mqsn2q5eadgpdupsj4mwn8zguc77d85ws3xj40sl9rgksx2rxw6,
|
|
age1z62ff2ak9zj5ctcvaxwyyhedwjvlwgm2dkn9nk3wrwk8fkavcpmsqwc2vs,
|
|
age1s07zs83ehtlg8jtwvr75ltc3c4cdlemfwjuxrwjtwkqxkl9tpggsyrzn2h
|
|
|
|
- path_regex: ^secrets/oikos-approval-hmac\.yaml$
|
|
# HMAC signing key for Oikos approval-grant tokens (oikos/approve.py).
|
|
# Recipients: apps (105, runs the approval engine alongside homelab-mcp)
|
|
# and hubris (admin/debug decrypt). See OIKOS.md "Approval engine".
|
|
age: >-
|
|
age1xkklkvnk5z0fsnh6cfgv70hy9ksfy8rdprwerzw4yk3p4p7cxcqs2yvpz6,
|
|
age1duyl8mkpgu80uv934dy8q7enqjms6yvdz264hme8uryuxmvvqesq6rusq0
|
|
# webhook noop 2026-05-20T18:16:57+02:00
|