Adopt the *.sops.yaml suffix convention for encrypted files (rename secrets.yaml, retarget nvim rule and tooling) #319

New issue

Closed

opened 2026-08-10 16:42:40 +02:00 by dominik.polakovics · 0 comments

dominik.polakovics commented

2026-08-10 16:42:40 +02:00

Owner

Motivation

The nvim sops rule (utils/modules/development/nvim/config/sops.lua) matches */secrets.yaml. Name-based matching fails in both directions:

False negatives: encrypted files not named secrets.yaml get no decrypt/encrypt handling — e.g. ansible/inventory/host_vars/ipa-cloonar.sops.yaml, and every future per-server ansible secrets file.
False positives: the nvim config is global across repos. A plaintext secrets.yaml in any other project triggers a decrypt error on open, and the BufWriteCmd save-hook tries to encrypt it — if no creation rule matches, the file cannot be saved from nvim.

The fix: the filename itself becomes the contract. Files ending in .sops.yaml are sops-encrypted; nothing else is touched. The repo already uses this convention on the ansible side.

Changes — one atomic PR

Rename all 17 secrets.yaml → secrets.sops.yaml via git mv (preserves history). Ansible keeps its existing <server>.sops.yaml naming.
nvim rule (utils/modules/development/nvim/config/sops.lua): change the pattern to *.sops.yaml, and add a mandatory basename guard skipping files named exactly .sops.yaml — without it the rule would try to decrypt the creation-rules config and, on save, encrypt it.
Creation rules (.sops.yaml): tighten every [^/]+\.yaml$ to [^/]+\.sops\.yaml$. This also stops the root rule from matching the config file itself. Do not touch stale rules for retired hosts (gpd-win4, fw-new, netboot, web-02, ldap-server-arm) — separate cleanup, separate PR.
scripts/update-secrets-keys: convention-based discovery — find -name "*.sops.yaml" ! -name ".sops.yaml" — bringing ansible secrets into key rotation and covering future encrypted files with no script edits.
Nix references: update all sopsFile / defaultSopsFile paths referencing secrets.yaml (~23 .nix files).
Docs: new ADR (next free number — check docs/adr/ on origin/main at implementation time) titled roughly "Encrypted files carry the .sops.yaml suffix", recording the marker-suffix contract, both failure modes above, and the config-file exclusion guard. Update CLAUDE.md's mentions of secrets.yaml. Historical ADRs 0002/0005/0021 stay untouched — they were accurate when written.

Safety / verification

Everything is build-time: sopsFile paths are baked by nix, hosts pull the whole tree and rebuild, so rename + reference updates in one commit cannot leave a host pointing at a missing file.
The pre-commit hook dry-builds all affected hosts (do not run scripts/test-configuration manually).
After tightening the rules, run ./scripts/update-secrets-keys (sops updatekeys) to verify every renamed file still matches its creation rule.
Files stay encrypted throughout — this is a rename plus reference updates; no secrets content is modified or re-encrypted by hand.

## Motivation The nvim sops rule (`utils/modules/development/nvim/config/sops.lua`) matches `*/secrets.yaml`. Name-based matching fails in both directions: - **False negatives:** encrypted files not named `secrets.yaml` get no decrypt/encrypt handling — e.g. `ansible/inventory/host_vars/ipa-cloonar.sops.yaml`, and every future per-server ansible secrets file. - **False positives:** the nvim config is global across repos. A plaintext `secrets.yaml` in any other project triggers a decrypt error on open, and the `BufWriteCmd` save-hook tries to encrypt it — if no creation rule matches, the file **cannot be saved** from nvim. The fix: the filename itself becomes the contract. Files ending in `.sops.yaml` are sops-encrypted; nothing else is touched. The repo already uses this convention on the ansible side. ## Changes — one atomic PR 1. **Rename** all 17 `secrets.yaml` → `secrets.sops.yaml` via `git mv` (preserves history). Ansible keeps its existing `<server>.sops.yaml` naming. 2. **nvim rule** (`utils/modules/development/nvim/config/sops.lua`): change the pattern to `*.sops.yaml`, and add a **mandatory basename guard** skipping files named exactly `.sops.yaml` — without it the rule would try to decrypt the creation-rules config and, on save, encrypt it. 3. **Creation rules** (`.sops.yaml`): tighten every `[^/]+\.yaml$` to `[^/]+\.sops\.yaml$`. This also stops the root rule from matching the config file itself. Do **not** touch stale rules for retired hosts (`gpd-win4`, `fw-new`, `netboot`, `web-02`, `ldap-server-arm`) — separate cleanup, separate PR. 4. **`scripts/update-secrets-keys`**: convention-based discovery — `find -name "*.sops.yaml" ! -name ".sops.yaml"` — bringing ansible secrets into key rotation and covering future encrypted files with no script edits. 5. **Nix references**: update all `sopsFile` / `defaultSopsFile` paths referencing `secrets.yaml` (~23 `.nix` files). 6. **Docs**: new ADR (next free number — check `docs/adr/` on origin/main at implementation time) titled roughly "Encrypted files carry the .sops.yaml suffix", recording the marker-suffix contract, both failure modes above, and the config-file exclusion guard. Update CLAUDE.md's mentions of `secrets.yaml`. Historical ADRs 0002/0005/0021 stay untouched — they were accurate when written. ## Safety / verification - Everything is build-time: `sopsFile` paths are baked by nix, hosts pull the whole tree and rebuild, so rename + reference updates in one commit cannot leave a host pointing at a missing file. - The pre-commit hook dry-builds all affected hosts (do not run `scripts/test-configuration` manually). - After tightening the rules, run `./scripts/update-secrets-keys` (`sops updatekeys`) to verify every renamed file still matches its creation rule. - Files stay encrypted throughout — this is a rename plus reference updates; **no secrets content is modified or re-encrypted by hand**.

dominik.polakovics added the

ready-for-agent

label

2026-08-10 16:42:40 +02:00

dominik.polakovics referenced this issue from a pull request that will close it,

2026-08-10 17:06:17 +02:00

refactor(sops): encrypted files carry the .sops.yaml suffix #320

dominik.polakovics referenced this issue

2026-08-10 17:06:43 +02:00

Encrypted files that match no sops creation rule, and stale rules for retired hosts #321

dominik.polakovics closed this issue

2026-08-10 17:19:12 +02:00