Re-encrypt secrets with SSH recipients (not age recipients)
...
age encrypts differently for age vs SSH recipients. agenix passes
raw SSH host keys as identities, which can only decrypt SSH-recipient
stanzas. Previously used ssh-to-age conversion which created
age-recipient stanzas, causing "no identity matched" errors.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
Re-encrypt secrets with correct full host public key
...
The xlab-gateway SSH public key was previously truncated
(missing AAAAC3NzaC1lZDI1NTE5 type prefix), causing agenix
decryption failures. Re-encrypted all .age files with the
correct full key. Verified decryption succeeds on target host.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
Unified NixOS configuration for skydick (storage server) and
xlab-gateway (lab router). Flat module structure with shared
common/users/ssh modules, agenix secrets, disko, and deploy-rs.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
