fix: harden enrollment against critical failure modes - #173
Merged
Conversation
…are test
- sops.validateSopsFiles = false: prevents activation failure on pass-1
nixos-rebuild when age.key/secrets.yaml don't yet exist
- sourceos-syncd ConditionPathExists gate: service stays inert until the
katello password file is decrypted by sops; no restart spam on pass-1 boot
- enroll.sh: remove || true from both nixos-rebuild calls; failures now log
to /tmp/sourceos-enroll-pass{1,2}-*.log and die with a clear message
- enroll.sh: disk space (100 GB) and network preflight checks added
- enroll.sh: prophet-platform clone is fatal if both SSH and HTTPS fail
- enroll.sh: age key consistency check — if secrets.yaml exists, verify it
decrypts with the current key before proceeding
- enroll.sh: partial harmonia/minisign key state → die immediately rather
than silently regenerate and orphan cache signatures
- enroll.sh: Foreman timeout is configurable (FOREMAN_WAIT_TIMEOUT, default
1800s) with actionable recovery instructions on expiry
- enroll.sh: minisign -W flag for passwordless key generation (no prompt)
- M2_ENROLL.md: Phase B now fails closed if nixos-infect or git clone fails
- M2_ENROLL.md: troubleshooting entries for age key mismatch, partial key
state, and rebuild failure recovery
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Critical fixes before P0 hardware test
Brick-risk eliminations
sops.validateSopsFiles = false: pass-1nixos-rebuild switchno longer fails activation when/etc/sourceos/age.keyandsecrets.yamldon't exist yet. Without this, first boot after pass-1 could be unbootable if sops-nix crashed activation.sourceos-syncd ConditionPathExists: daemon now stays inert on pass-1 boot until the sops-decrypted password file actually exists. Previously it would restart every 30s with a credential load error and fill the journal.nixos-rebuild || trueremoved: both pass-1 and pass-2 now write a full log to/tmp/sourceos-enroll-pass{1,2}-*.logand die with a clear error on failure. Silent pass-through was masking rebuild failures.Idempotency safeguards
secrets.yamlalready exists, enroll.sh now verifies it decrypts with the current age key before proceeding. Catches the "key replaced, old ciphertext orphaned" case at step 3 instead of at first boot.Other preflight/recovery improvements
curl https://api.github.com) added to step 0prophet-platformclone failure is now fatal (was silently swallowed)FOREMAN_WAIT_TIMEOUT(default 1800s) with actionable recovery instructionsminisign -Wflag for passwordless key generation (no interactive prompt)nixos-infectandgit cloneboth fail-closed before reboot