store signing keys for nodens #86

nerf · 2025-06-20T17:57:46Z

nerf commented

2025-06-20 17:57:46 +00:00

This adds signing keys to nodens that all the other machines trust, so nodens can sign builds and we can deploy from there directly.
This is a first step towards CI

This adds signing keys to nodens that all the other machines trust, so nodens can sign builds and we can deploy from there directly. This is a first step towards CI

nerf added 1 commit 2025-06-20 17:57:47 +00:00

added keys so nodens can sign builds 5c09cb3cdc

nerf changed title from ~~store signing keys for nodens~~ to WIP: store signing keys for nodens

2025-06-20 18:01:01 +00:00

nerf changed title from ~~WIP: store signing keys for nodens~~ to store signing keys for nodens

2025-06-20 18:02:20 +00:00

nerf referenced this pull request

2025-06-20 18:05:01 +00:00

CI for all of this #87

Gonne requested changes 2025-06-21 16:22:40 +00:00

Dismissed

nixos/roles/default.nix Outdated

					
				@ -32,1 +32,4 @@

				  # additional trusted keys for substituters for every machine

				  # right now it is only nodens so nodens can build system configs

				  # and we can deploy them from nodens.

Gonne commented

2025-06-21 16:21:33 +00:00

Please describe somewhere how this is used (probably in the Readme.md where we also described building locally).

Please describe somewhere how this is used (probably in the `Readme.md` where we also described building locally).

Gonne marked this conversation as resolved

nixos/roles/default.nix Outdated

					
				@ -33,0 +34,4 @@

				  # right now it is only nodens so nodens can build system configs

				  # and we can deploy them from nodens.

				  # For security reasons we might want to move this to the vm part, as

				  # someone who can get controll of nodens and get hold of the build process

Gonne commented

2025-06-21 16:20:14 +00:00

controll -> control

Gonne marked this conversation as resolved

nixos/roles/default.nix Outdated

					
				@ -33,0 +36,4 @@

				  # For security reasons we might want to move this to the vm part, as

				  # someone who can get controll of nodens and get hold of the build process

				  # can gain control of the other machines. While this is very handy

				  # and a step towards CI, we might not want this for backups.

Gonne commented

2025-06-21 16:22:02 +00:00

I think its fine for backups as well.

Gonne marked this conversation as resolved

nixos/roles/default.nix Outdated

					
				@ -33,0 +37,4 @@

				  # someone who can get controll of nodens and get hold of the build process

				  # can gain control of the other machines. While this is very handy

				  # and a step towards CI, we might not want this for backups.

				  # (This is a tradeof between security and convinience)