Skip to content

Nothing converges stacks/sensitive: the tier with the real data is the only one deployed by hand #533

Description

@Gerrrt

The tier that holds the household's real data is the one deployed by hand

stacks/sensitive/README.md says it plainly: "Nothing converges this stack. The homelab-* timers are the estate's; make validate notes their absence here as a skip, not a failure. This stack is deployed by hand, from a checkout on trinity."

ADR-0021 converges the estate on a timer instead of deploying over SSH, and the reasons it gives — a deploy that depends on one person's shell, drift between the repository and the host, a Dependabot bump that merges and never lands — apply more to this tier than to any other, because this is the one whose data ADR-0022 says changes the rules. Today's state is a consequence of authoring the stack ahead of its host, which was the right order; it stops being a reason the day trinity exists.

What to decide, then build

  • Whether trinity runs the same homelab-converge timer as prometheus, with HOMELAB_CONVERGE_APPLY at whatever the estate's setting is, or whether a tier with an off-estate copy and a seven-day CA gets a stricter one (report-only, apply by hand, as the estate ran until it trusted the mechanism).
  • The SOPS recipient question ADR-0020 asks: the timer on trinity needs to decrypt secrets/sensitive.sops.yaml, which means the tier's own age recipient on that host — already the design, not yet a key.
  • make validate's "skip" for this stack becomes a pass or a fail.

Done when

A Dependabot bump to stacks/sensitive merges and lands on trinity without anyone opening a shell, and converge-the-host.md names trinity beside prometheus.

Blocked on #404. Refs #404, ADR-0021, ADR-0020.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    sensitivestacks/sensitive on trinity (VLAN 99)seq/6Step 6 within its milestone; same number = can run in parallel

    Projects

    No projects

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions