WIP: refactor: migrate secrets from agenix to sops-nix #194

Draft

kennethz wants to merge 8 commits from refactor/sops-nix into main

pull from: refactor/sops-nix

merge into: ScottyLabs:main

ScottyLabs:main

ScottyLabs:renovate/lockfiles

ScottyLabs:renovate/kennel

ScottyLabs:fix/vault-agent-file-paths

ScottyLabs:fix/ci-semgrep-aarch64

ScottyLabs:crawler-archive-disk

Conversation 5 Commits 8 Files changed 61 +660 -159

kennethz commented 2026-10-31 21:20:07 +00:00

Member

Copy link

Includes the two CI fixes from #195 (merged in, so CI can run here). They drop out of this diff once #195 is merged.

Closes #129 once deployed. Builds on #193, which has to be deployed first.

WIP until an admin adds the encrypted secrets (step 1 below). Without them no host evaluates, because each one reads secrets/<org>/<host>.yaml.

What changes

1. feat: decrypt secrets with sops-nix alongside agenix. Each of the 30 agenix secrets gets a sops-nix twin with the same name, owner, group and mode. Services still read the agenix copies, so deploying this commit restarts nothing and lets the two copies be compared on each host.
   • Files: secrets/<org>/<host>.yaml (readable by that host), secrets/common.yaml (every NixOS host: cloudflare token, pgadmin), secrets/nixbuild.yaml (every host including infra-02). Recipients match today's secrets.nix exactly.
   • Recipients: admins keep their users.nix SSH keys. Hosts are listed in keys/hosts/<org>/<host>/age.pub, converted from the SSH host keys sops-nix decrypts with. devenv.nix builds SOPS_CONFIG from both, the same way occ does.
   • The host table moves from modules/systems.nix to hosts.nix, so devenv can tell darwin hosts apart. The table is unchanged.
   • scripts/migrate-agenix-to-sops.sh and scripts/compare-agenix-sops.sh are one-offs, to be removed together with agenix.
2. refactor: read secrets from sops-nix. Every consumer reads config.sops.secrets.<name>.path, with restartUnits per secret. Secrets read on each use set noRestartReason instead (renovate, pgadmin, and the nixbuild and infra-02 builder SSH keys).
   • modules/global/sops.nix fails the build when a restart unit doesn't exist on the host (sops-nix would skip it silently), and warns about a secret with no restart behaviour.
   • The Forgejo signing key moves to sops-nix at its old path, as a symlink. Its agenix copy moves to /run/agenix so the two don't overwrite each other.
   • sops-install-secrets is added to the systemd exporter's whitelist, with a critical alert when it fails.
3. docs: describe secrets in sops-nix. Rewrites docs/src/concepts/secrets.md and adds docs/src/troubleshooting/secrets.md. The docs-old guides are updated, including the new-host steps.

agenix itself, secrets.nix and the .age files stay until a follow-up PR, so reverting commit 2 is a full rollback.

Rollout

1. Encrypt the secrets (an admin, on this branch, inside devenv shell):

   bash scripts/migrate-agenix-to-sops.sh
   

   It decrypts each .age file with ~/.ssh/id_ed25519 (or IDENTITY=...), writes the 9 sops files, then decrypts every value back and compares it byte for byte. Plaintext only lives in shell memory. It needs bash 4+ (on macOS: nix shell nixpkgs#bash -c bash scripts/...), and a passphrase-protected key prompts twice per file. Commit the 9 files with the script's output in the commit message.
2. Deploy commit 1 (git checkout <commit 1>, colmena apply). Start with signage-01, snoopy, elect-01, tartan-01 and infra-03, then deploy-01, infra-01 and infra-02. Nothing restarts. On each host run sudo bash scripts/compare-agenix-sops.sh. It must print only ok lines; it checks contents, owner, group and mode for every secret.
3. Deploy commit 2 and the docs. infra-01 needs a short window: every service whose secret path changes restarts once (Keycloak, Forgejo, Synapse and both bridges, Vaultwarden, Atlantis, Garage, Caddy, LiteLLM, cliproxyapi, snot, umvpn, nixbot, the vault agents). Then check:
   • systemctl status sops-install-secrets is active (exited) on every host
   • Forgejo still signs: a commit made in the web UI shows as signed by cmu.dev
   • Grafana alert contact points test fine
4. Acceptance test for #129: change one value, for example sops secrets/scottylabs/infra-01.yaml with a new snot-webhook-secret, then deploy. journalctl -u sops-install-secrets should show modifying secret: snot-webhook-secret, and only snot.service restarts. Update the webhook on the Forgejo side to match.
5. After a few quiet days, a follow-up PR removes agenix, secrets.nix, the .age files and the two scripts.

How this was checked

The sandbox this was written in can't decrypt the real secrets, so every host was evaluated against sops files with the same key names, encrypted to a throwaway key (GitHub inputs were fetched over git, pinned to the same revisions and NAR hashes):

• All 7 NixOS hosts and infra-02 evaluate on both commits. Commit 2 has no warnings and no failed assertions, so every restart unit exists, including snot.service against snot's real module.
• On commit 1, every host's sops-nix declarations match its agenix ones exactly: names, owner, group and mode.
• sops-nix's build-time manifest check passes for infra-01 on both commits, so every declared key is present in the files.
• The migration script round-trips 42 fake secrets byte for byte, including an empty file, values with and without trailing newlines, multi-line env and JSON files, and UTF-8.
• nixfmt, mdformat, gitleaks and mdbook pass on the changed files.

Not checked here: an actual activation on a host, and the Forgejo signing behaviour through a symlink. Steps 2 and 3 above cover both.

CI's check, check-1 and build jobs already fail on main (runs 243 and 244), so their status here doesn't reflect this change.

> Includes the two CI fixes from https://git.cmu.dev/ScottyLabs/infrastructure/pulls/195 (merged in, so CI can run here). They drop out of this diff once #195 is merged. Closes https://git.cmu.dev/ScottyLabs/infrastructure/issues/129 once deployed. Builds on https://git.cmu.dev/ScottyLabs/infrastructure/pulls/193, which has to be deployed first. **WIP until an admin adds the encrypted secrets** (step 1 below). Without them no host evaluates, because each one reads `secrets/<org>/<host>.yaml`. ## What changes 1. **feat: decrypt secrets with sops-nix alongside agenix.** Each of the 30 agenix secrets gets a sops-nix twin with the same name, owner, group and mode. Services still read the agenix copies, so deploying this commit restarts nothing and lets the two copies be compared on each host. - Files: `secrets/<org>/<host>.yaml` (readable by that host), `secrets/common.yaml` (every NixOS host: cloudflare token, pgadmin), `secrets/nixbuild.yaml` (every host including infra-02). Recipients match today's `secrets.nix` exactly. - Recipients: admins keep their `users.nix` SSH keys. Hosts are listed in `keys/hosts/<org>/<host>/age.pub`, converted from the SSH host keys sops-nix decrypts with. `devenv.nix` builds `SOPS_CONFIG` from both, the same way occ does. - The host table moves from `modules/systems.nix` to `hosts.nix`, so devenv can tell darwin hosts apart. The table is unchanged. - `scripts/migrate-agenix-to-sops.sh` and `scripts/compare-agenix-sops.sh` are one-offs, to be removed together with agenix. 2. **refactor: read secrets from sops-nix.** Every consumer reads `config.sops.secrets.<name>.path`, with `restartUnits` per secret. Secrets read on each use set `noRestartReason` instead (renovate, pgadmin, and the nixbuild and infra-02 builder SSH keys). - `modules/global/sops.nix` fails the build when a restart unit doesn't exist on the host (sops-nix would skip it silently), and warns about a secret with no restart behaviour. - The Forgejo signing key moves to sops-nix at its old path, as a symlink. Its agenix copy moves to `/run/agenix` so the two don't overwrite each other. - `sops-install-secrets` is added to the systemd exporter's whitelist, with a critical alert when it fails. 3. **docs: describe secrets in sops-nix.** Rewrites `docs/src/concepts/secrets.md` and adds `docs/src/troubleshooting/secrets.md`. The `docs-old` guides are updated, including the new-host steps. agenix itself, `secrets.nix` and the `.age` files stay until a follow-up PR, so reverting commit 2 is a full rollback. ## Rollout 1. **Encrypt the secrets** (an admin, on this branch, inside `devenv shell`): ```bash bash scripts/migrate-agenix-to-sops.sh ``` It decrypts each `.age` file with `~/.ssh/id_ed25519` (or `IDENTITY=...`), writes the 9 sops files, then decrypts every value back and compares it byte for byte. Plaintext only lives in shell memory. It needs bash 4+ (on macOS: `nix shell nixpkgs#bash -c bash scripts/...`), and a passphrase-protected key prompts twice per file. Commit the 9 files with the script's output in the commit message. 2. **Deploy commit 1** (`git checkout <commit 1>`, `colmena apply`). Start with signage-01, snoopy, elect-01, tartan-01 and infra-03, then deploy-01, infra-01 and infra-02. Nothing restarts. On each host run `sudo bash scripts/compare-agenix-sops.sh`. It must print only `ok` lines; it checks contents, owner, group and mode for every secret. 3. **Deploy commit 2 and the docs.** infra-01 needs a short window: every service whose secret path changes restarts once (Keycloak, Forgejo, Synapse and both bridges, Vaultwarden, Atlantis, Garage, Caddy, LiteLLM, cliproxyapi, snot, umvpn, nixbot, the vault agents). Then check: - `systemctl status sops-install-secrets` is active (exited) on every host - Forgejo still signs: a commit made in the web UI shows as signed by cmu.dev - Grafana alert contact points test fine 4. **Acceptance test for #129:** change one value, for example `sops secrets/scottylabs/infra-01.yaml` with a new `snot-webhook-secret`, then deploy. `journalctl -u sops-install-secrets` should show `modifying secret: snot-webhook-secret`, and only `snot.service` restarts. Update the webhook on the Forgejo side to match. 5. After a few quiet days, a follow-up PR removes agenix, `secrets.nix`, the `.age` files and the two scripts. ## How this was checked The sandbox this was written in can't decrypt the real secrets, so every host was evaluated against sops files with the same key names, encrypted to a throwaway key (GitHub inputs were fetched over git, pinned to the same revisions and NAR hashes): - All 7 NixOS hosts and infra-02 evaluate on both commits. Commit 2 has no warnings and no failed assertions, so every restart unit exists, including `snot.service` against snot's real module. - On commit 1, every host's sops-nix declarations match its agenix ones exactly: names, owner, group and mode. - sops-nix's build-time manifest check passes for infra-01 on both commits, so every declared key is present in the files. - The migration script round-trips 42 fake secrets byte for byte, including an empty file, values with and without trailing newlines, multi-line env and JSON files, and UTF-8. - nixfmt, mdformat, gitleaks and mdbook pass on the changed files. Not checked here: an actual activation on a host, and the Forgejo signing behaviour through a symlink. Steps 2 and 3 above cover both. CI's `check`, `check-1` and `build` jobs already fail on `main` (runs 243 and 244), so their status here doesn't reflect this change.

kennethz added 4 commits 2026-10-31 21:20:07 +00:00

fix: render vault-agent files outside /run/secrets ... e76c67c8cd

sops-nix replaces /run/secrets with a symlink to its own generation
directory and removes anything already there, so the alert webhook URLs
and the cliproxyapi key would disappear once it is enabled (#129).

feat: decrypt secrets with sops-nix alongside agenix ... d07124406a

Every agenix secret gets a sops-nix twin with the same name, owner, group
and mode, read from secrets/<org>/<host>.yaml, secrets/common.yaml or
secrets/nixbuild.yaml. Services still read the agenix copies, so deploying
this changes nothing they see and lets each host's two copies be compared
before switching over (#129).

Host recipients live in keys/hosts/<org>/<host>/age.pub, converted from
the SSH host keys sops-nix decrypts with. Admins stay on their users.nix
SSH keys. devenv.nix builds SOPS_CONFIG from both, so every file keeps
exactly the recipients it has today. The host table moves to hosts.nix so
devenv can tell darwin hosts apart.

scripts/migrate-agenix-to-sops.sh writes the sops files from the agenix
ones and checks each value round-trips. scripts/compare-agenix-sops.sh
compares the decrypted copies on a host.

refactor: read secrets from sops-nix ... aa10f824a2

Every service now reads its secret from sops-nix, and restarts when that
secret changes (#129). Secrets read on each use say why with
noRestartReason instead.

modules/global/sops.nix fails the build when a restartUnits or reloadUnits
entry names a unit the host does not define, since sops-nix would skip it
silently, and warns about a secret that sets none of the three.

The Forgejo signing key moves to sops-nix at its old path, as a symlink,
and its agenix copy moves back to /run/agenix so the two do not overwrite
each other until agenix is removed.

sops-install-secrets joins the systemd exporter's whitelist, with an
alert when it fails.

docs: describe secrets in sops-nix ... b2e507cb1d

Rewrites the secrets concepts page around sops-nix, its file layout and
recipients, restartUnits, and day-to-day sops use, and adds a
troubleshooting page for the failures the migration makes possible: a
host that is not a recipient, a service that kept an old secret, sops
outside devenv, and merge conflicts in encrypted files (#129).

The older guides now give sops commands, put the new-host steps in the
order a host needs them, and point at the new troubleshooting page.

scottylabs-bot commented 2026-10-31 21:20:11 +00:00

Owner

Copy link

Ran Plan for 22 projects:

1. project: garage-webadmin dir: . workspace: garage-webadmin
2. project: governance dir: . workspace: governance
3. project: headscale dir: . workspace: headscale
4. project: nixbot dir: . workspace: nixbot
5. project: observability dir: . workspace: observability
6. project: keycloak dir: . workspace: keycloak
7. project: occ dir: . workspace: occ
8. project: cloudflare-tokens dir: . workspace: cloudflare-tokens
9. project: atlantis dir: . workspace: atlantis
10. project: kennel dir: . workspace: kennel
11. project: mail dir: . workspace: mail
12. project: forgejo dir: . workspace: forgejo
13. project: matrix dir: . workspace: matrix
14. project: webhook dir: . workspace: webhook
15. project: ricochet dir: . workspace: ricochet
16. project: posthog dir: . workspace: posthog
17. project: snot dir: . workspace: snot
18. project: vaultwarden dir: . workspace: vaultwarden
19. project: openbao dir: . workspace: openbao
20. project: litellm dir: . workspace: litellm
21. project: search-console dir: . workspace: search-console
22. project: hosts dir: . workspace: hosts

---

1. project: garage-webadmin dir: . workspace: garage-webadmin

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

2. project: governance dir: . workspace: governance

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

3. project: headscale dir: . workspace: headscale

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

4. project: nixbot dir: . workspace: nixbot

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

5. project: observability dir: . workspace: observability

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

6. project: keycloak dir: . workspace: keycloak

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

7. project: occ dir: . workspace: occ

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

8. project: cloudflare-tokens dir: . workspace: cloudflare-tokens

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

9. project: atlantis dir: . workspace: atlantis

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

10. project: kennel dir: . workspace: kennel

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

11. project: mail dir: . workspace: mail

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

12. project: forgejo dir: . workspace: forgejo

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

13. project: matrix dir: . workspace: matrix

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

14. project: webhook dir: . workspace: webhook

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

15. project: ricochet dir: . workspace: ricochet

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

16. project: posthog dir: . workspace: posthog

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

17. project: snot dir: . workspace: snot

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

18. project: vaultwarden dir: . workspace: vaultwarden

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

19. project: openbao dir: . workspace: openbao

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

20. project: litellm dir: . workspace: litellm

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

21. project: search-console dir: . workspace: search-console

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

22. project: hosts dir: . workspace: hosts

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

Plan Summary

22 projects, 0 with changes, 0 with no changes, 22 failed

• ⏩ To apply all unapplied plans from this Pull Request, comment:

  atlantis apply
  

• 🚮 To delete all plans and locks from this Pull Request, comment:

  atlantis unlock
  

Ran Plan for 22 projects: 1. project: `garage-webadmin` dir: `.` workspace: `garage-webadmin` 1. project: `governance` dir: `.` workspace: `governance` 1. project: `headscale` dir: `.` workspace: `headscale` 1. project: `nixbot` dir: `.` workspace: `nixbot` 1. project: `observability` dir: `.` workspace: `observability` 1. project: `keycloak` dir: `.` workspace: `keycloak` 1. project: `occ` dir: `.` workspace: `occ` 1. project: `cloudflare-tokens` dir: `.` workspace: `cloudflare-tokens` 1. project: `atlantis` dir: `.` workspace: `atlantis` 1. project: `kennel` dir: `.` workspace: `kennel` 1. project: `mail` dir: `.` workspace: `mail` 1. project: `forgejo` dir: `.` workspace: `forgejo` 1. project: `matrix` dir: `.` workspace: `matrix` 1. project: `webhook` dir: `.` workspace: `webhook` 1. project: `ricochet` dir: `.` workspace: `ricochet` 1. project: `posthog` dir: `.` workspace: `posthog` 1. project: `snot` dir: `.` workspace: `snot` 1. project: `vaultwarden` dir: `.` workspace: `vaultwarden` 1. project: `openbao` dir: `.` workspace: `openbao` 1. project: `litellm` dir: `.` workspace: `litellm` 1. project: `search-console` dir: `.` workspace: `search-console` 1. project: `hosts` dir: `.` workspace: `hosts` --- ### 1. project: `garage-webadmin` dir: `.` workspace: `garage-webadmin` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 2. project: `governance` dir: `.` workspace: `governance` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 3. project: `headscale` dir: `.` workspace: `headscale` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 4. project: `nixbot` dir: `.` workspace: `nixbot` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 5. project: `observability` dir: `.` workspace: `observability` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 6. project: `keycloak` dir: `.` workspace: `keycloak` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 7. project: `occ` dir: `.` workspace: `occ` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 8. project: `cloudflare-tokens` dir: `.` workspace: `cloudflare-tokens` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 9. project: `atlantis` dir: `.` workspace: `atlantis` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 10. project: `kennel` dir: `.` workspace: `kennel` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 11. project: `mail` dir: `.` workspace: `mail` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 12. project: `forgejo` dir: `.` workspace: `forgejo` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 13. project: `matrix` dir: `.` workspace: `matrix` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 14. project: `webhook` dir: `.` workspace: `webhook` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 15. project: `ricochet` dir: `.` workspace: `ricochet` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 16. project: `posthog` dir: `.` workspace: `posthog` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 17. project: `snot` dir: `.` workspace: `snot` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 18. project: `vaultwarden` dir: `.` workspace: `vaultwarden` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 19. project: `openbao` dir: `.` workspace: `openbao` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 20. project: `litellm` dir: `.` workspace: `litellm` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 21. project: `search-console` dir: `.` workspace: `search-console` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 22. project: `hosts` dir: `.` workspace: `hosts` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### Plan Summary 22 projects, 0 with changes, 0 with no changes, 22 failed * :fast_forward: To **apply** all unapplied plans from this Pull Request, comment: ```shell atlantis apply ``` * :put_litter_in_its_place: To **delete** all plans and locks from this Pull Request, comment: ```shell atlantis unlock ```

scottylabs-bot commented 2026-10-31 21:20:20 +00:00

Owner

Copy link

Ran Plan for 22 projects:

1. project: matrix dir: . workspace: matrix
2. project: mail dir: . workspace: mail
3. project: atlantis dir: . workspace: atlantis
4. project: headscale dir: . workspace: headscale
5. project: observability dir: . workspace: observability
6. project: nixbot dir: . workspace: nixbot
7. project: occ dir: . workspace: occ
8. project: keycloak dir: . workspace: keycloak
9. project: governance dir: . workspace: governance
10. project: litellm dir: . workspace: litellm
11. project: posthog dir: . workspace: posthog
12. project: garage-webadmin dir: . workspace: garage-webadmin
13. project: forgejo dir: . workspace: forgejo
14. project: vaultwarden dir: . workspace: vaultwarden
15. project: openbao dir: . workspace: openbao
16. project: kennel dir: . workspace: kennel
17. project: cloudflare-tokens dir: . workspace: cloudflare-tokens
18. project: search-console dir: . workspace: search-console
19. project: snot dir: . workspace: snot
20. project: hosts dir: . workspace: hosts
21. project: ricochet dir: . workspace: ricochet
22. project: webhook dir: . workspace: webhook

---

1. project: matrix dir: . workspace: matrix

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

2. project: mail dir: . workspace: mail

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

3. project: atlantis dir: . workspace: atlantis

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

4. project: headscale dir: . workspace: headscale

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

5. project: observability dir: . workspace: observability

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

6. project: nixbot dir: . workspace: nixbot

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

7. project: occ dir: . workspace: occ

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

8. project: keycloak dir: . workspace: keycloak

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

9. project: governance dir: . workspace: governance

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

10. project: litellm dir: . workspace: litellm

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

11. project: posthog dir: . workspace: posthog

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

12. project: garage-webadmin dir: . workspace: garage-webadmin

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

13. project: forgejo dir: . workspace: forgejo

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

14. project: vaultwarden dir: . workspace: vaultwarden

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

15. project: openbao dir: . workspace: openbao

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

16. project: kennel dir: . workspace: kennel

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

17. project: cloudflare-tokens dir: . workspace: cloudflare-tokens

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

18. project: search-console dir: . workspace: search-console

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

19. project: snot dir: . workspace: snot

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

20. project: hosts dir: . workspace: hosts

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

21. project: ricochet dir: . workspace: ricochet

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

22. project: webhook dir: . workspace: webhook

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

Plan Summary

22 projects, 0 with changes, 0 with no changes, 22 failed

• ⏩ To apply all unapplied plans from this Pull Request, comment:

  atlantis apply
  

• 🚮 To delete all plans and locks from this Pull Request, comment:

  atlantis unlock
  

Ran Plan for 22 projects: 1. project: `matrix` dir: `.` workspace: `matrix` 1. project: `mail` dir: `.` workspace: `mail` 1. project: `atlantis` dir: `.` workspace: `atlantis` 1. project: `headscale` dir: `.` workspace: `headscale` 1. project: `observability` dir: `.` workspace: `observability` 1. project: `nixbot` dir: `.` workspace: `nixbot` 1. project: `occ` dir: `.` workspace: `occ` 1. project: `keycloak` dir: `.` workspace: `keycloak` 1. project: `governance` dir: `.` workspace: `governance` 1. project: `litellm` dir: `.` workspace: `litellm` 1. project: `posthog` dir: `.` workspace: `posthog` 1. project: `garage-webadmin` dir: `.` workspace: `garage-webadmin` 1. project: `forgejo` dir: `.` workspace: `forgejo` 1. project: `vaultwarden` dir: `.` workspace: `vaultwarden` 1. project: `openbao` dir: `.` workspace: `openbao` 1. project: `kennel` dir: `.` workspace: `kennel` 1. project: `cloudflare-tokens` dir: `.` workspace: `cloudflare-tokens` 1. project: `search-console` dir: `.` workspace: `search-console` 1. project: `snot` dir: `.` workspace: `snot` 1. project: `hosts` dir: `.` workspace: `hosts` 1. project: `ricochet` dir: `.` workspace: `ricochet` 1. project: `webhook` dir: `.` workspace: `webhook` --- ### 1. project: `matrix` dir: `.` workspace: `matrix` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 2. project: `mail` dir: `.` workspace: `mail` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 3. project: `atlantis` dir: `.` workspace: `atlantis` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 4. project: `headscale` dir: `.` workspace: `headscale` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 5. project: `observability` dir: `.` workspace: `observability` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 6. project: `nixbot` dir: `.` workspace: `nixbot` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 7. project: `occ` dir: `.` workspace: `occ` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 8. project: `keycloak` dir: `.` workspace: `keycloak` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 9. project: `governance` dir: `.` workspace: `governance` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 10. project: `litellm` dir: `.` workspace: `litellm` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 11. project: `posthog` dir: `.` workspace: `posthog` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 12. project: `garage-webadmin` dir: `.` workspace: `garage-webadmin` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 13. project: `forgejo` dir: `.` workspace: `forgejo` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 14. project: `vaultwarden` dir: `.` workspace: `vaultwarden` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 15. project: `openbao` dir: `.` workspace: `openbao` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 16. project: `kennel` dir: `.` workspace: `kennel` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 17. project: `cloudflare-tokens` dir: `.` workspace: `cloudflare-tokens` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 18. project: `search-console` dir: `.` workspace: `search-console` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 19. project: `snot` dir: `.` workspace: `snot` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 20. project: `hosts` dir: `.` workspace: `hosts` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 21. project: `ricochet` dir: `.` workspace: `ricochet` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 22. project: `webhook` dir: `.` workspace: `webhook` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### Plan Summary 22 projects, 0 with changes, 0 with no changes, 22 failed * :fast_forward: To **apply** all unapplied plans from this Pull Request, comment: ```shell atlantis apply ``` * :put_litter_in_its_place: To **delete** all plans and locks from this Pull Request, comment: ```shell atlantis unlock ```

scottylabs-bot commented 2026-10-31 21:20:43 +00:00

Owner

Copy link

Kennel Deployments

Service	URL
docs	https://infrastructure-docs-pr-194.scottylabs.net

Last updated for commit 40c0f55.

<!-- kennel-deployment --> ### Kennel Deployments | Service | URL | | --- | --- | | docs | https://infrastructure-docs-pr-194.scottylabs.net | Last updated for commit `40c0f55`.

kennethz added 4 commits 2026-11-01 15:23:50 +00:00

fix: skip semgrep in the devenv shell on aarch64-linux ... 76fc2b6350

8842761 moved the devenv nixpkgs to semgrep 1.180.0, whose semgrep-core
aarch64 binary makes patchelf 0.19.2 abort (Assertion `splitIndex == -1'
in shiftFile, exit 134). The shell can't be built on the aarch64 runner,
so every CI job has failed since. Other platforms keep semgrep.

fix: expose flake outputs for aarch64-linux ... 34078d5134

The CI build job runs on the aarch64 runner and builds each kennel site
for its own system, so `nix build .#docs` failed with no
packages.aarch64-linux.docs once the devenv shell built again.

Merge remote-tracking branch 'origin/fix/ci-semgrep-aarch64' into fix/vault-agent-file-paths 4c3ff6f000

Merge branch 'fix/vault-agent-file-paths' into refactor/sops-nix 40c0f55dd4

scottylabs-bot commented 2026-11-01 15:24:01 +00:00

Owner

Copy link

Ran Plan for 22 projects:

1. project: headscale dir: . workspace: headscale
2. project: garage-webadmin dir: . workspace: garage-webadmin
3. project: litellm dir: . workspace: litellm
4. project: hosts dir: . workspace: hosts
5. project: occ dir: . workspace: occ
6. project: nixbot dir: . workspace: nixbot
7. project: matrix dir: . workspace: matrix
8. project: cloudflare-tokens dir: . workspace: cloudflare-tokens
9. project: keycloak dir: . workspace: keycloak
10. project: mail dir: . workspace: mail
11. project: kennel dir: . workspace: kennel
12. project: observability dir: . workspace: observability
13. project: forgejo dir: . workspace: forgejo
14. project: atlantis dir: . workspace: atlantis
15. project: governance dir: . workspace: governance
16. project: ricochet dir: . workspace: ricochet
17. project: posthog dir: . workspace: posthog
18. project: webhook dir: . workspace: webhook
19. project: openbao dir: . workspace: openbao
20. project: snot dir: . workspace: snot
21. project: search-console dir: . workspace: search-console
22. project: vaultwarden dir: . workspace: vaultwarden

---

1. project: headscale dir: . workspace: headscale

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

2. project: garage-webadmin dir: . workspace: garage-webadmin

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

3. project: litellm dir: . workspace: litellm

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

4. project: hosts dir: . workspace: hosts

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

5. project: occ dir: . workspace: occ

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

6. project: nixbot dir: . workspace: nixbot

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

7. project: matrix dir: . workspace: matrix

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

8. project: cloudflare-tokens dir: . workspace: cloudflare-tokens

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

9. project: keycloak dir: . workspace: keycloak

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

10. project: mail dir: . workspace: mail

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

11. project: kennel dir: . workspace: kennel

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

12. project: observability dir: . workspace: observability

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

13. project: forgejo dir: . workspace: forgejo

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

14. project: atlantis dir: . workspace: atlantis

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

15. project: governance dir: . workspace: governance

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

16. project: ricochet dir: . workspace: ricochet

Plan Failed: Pull request must be mergeable before running plan.

---

17. project: posthog dir: . workspace: posthog

Plan Failed: Pull request must be mergeable before running plan.

---

18. project: webhook dir: . workspace: webhook

Plan Failed: Pull request must be mergeable before running plan.

---

19. project: openbao dir: . workspace: openbao

Plan Failed: Pull request must be mergeable before running plan.

---

20. project: snot dir: . workspace: snot

Plan Failed: Pull request must be mergeable before running plan.

---

21. project: search-console dir: . workspace: search-console

Plan Failed: Pull request must be mergeable before running plan.

---

22. project: vaultwarden dir: . workspace: vaultwarden

Plan Failed: Pull request must be mergeable before running plan.

---

Plan Summary

22 projects, 0 with changes, 0 with no changes, 22 failed

• ⏩ To apply all unapplied plans from this Pull Request, comment:

  atlantis apply
  

• 🚮 To delete all plans and locks from this Pull Request, comment:

  atlantis unlock
  

Ran Plan for 22 projects: 1. project: `headscale` dir: `.` workspace: `headscale` 1. project: `garage-webadmin` dir: `.` workspace: `garage-webadmin` 1. project: `litellm` dir: `.` workspace: `litellm` 1. project: `hosts` dir: `.` workspace: `hosts` 1. project: `occ` dir: `.` workspace: `occ` 1. project: `nixbot` dir: `.` workspace: `nixbot` 1. project: `matrix` dir: `.` workspace: `matrix` 1. project: `cloudflare-tokens` dir: `.` workspace: `cloudflare-tokens` 1. project: `keycloak` dir: `.` workspace: `keycloak` 1. project: `mail` dir: `.` workspace: `mail` 1. project: `kennel` dir: `.` workspace: `kennel` 1. project: `observability` dir: `.` workspace: `observability` 1. project: `forgejo` dir: `.` workspace: `forgejo` 1. project: `atlantis` dir: `.` workspace: `atlantis` 1. project: `governance` dir: `.` workspace: `governance` 1. project: `ricochet` dir: `.` workspace: `ricochet` 1. project: `posthog` dir: `.` workspace: `posthog` 1. project: `webhook` dir: `.` workspace: `webhook` 1. project: `openbao` dir: `.` workspace: `openbao` 1. project: `snot` dir: `.` workspace: `snot` 1. project: `search-console` dir: `.` workspace: `search-console` 1. project: `vaultwarden` dir: `.` workspace: `vaultwarden` --- ### 1. project: `headscale` dir: `.` workspace: `headscale` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 2. project: `garage-webadmin` dir: `.` workspace: `garage-webadmin` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 3. project: `litellm` dir: `.` workspace: `litellm` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 4. project: `hosts` dir: `.` workspace: `hosts` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 5. project: `occ` dir: `.` workspace: `occ` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 6. project: `nixbot` dir: `.` workspace: `nixbot` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 7. project: `matrix` dir: `.` workspace: `matrix` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 8. project: `cloudflare-tokens` dir: `.` workspace: `cloudflare-tokens` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 9. project: `keycloak` dir: `.` workspace: `keycloak` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 10. project: `mail` dir: `.` workspace: `mail` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 11. project: `kennel` dir: `.` workspace: `kennel` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 12. project: `observability` dir: `.` workspace: `observability` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 13. project: `forgejo` dir: `.` workspace: `forgejo` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 14. project: `atlantis` dir: `.` workspace: `atlantis` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 15. project: `governance` dir: `.` workspace: `governance` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 16. project: `ricochet` dir: `.` workspace: `ricochet` **Plan Failed**: Pull request must be mergeable before running plan. --- ### 17. project: `posthog` dir: `.` workspace: `posthog` **Plan Failed**: Pull request must be mergeable before running plan. --- ### 18. project: `webhook` dir: `.` workspace: `webhook` **Plan Failed**: Pull request must be mergeable before running plan. --- ### 19. project: `openbao` dir: `.` workspace: `openbao` **Plan Failed**: Pull request must be mergeable before running plan. --- ### 20. project: `snot` dir: `.` workspace: `snot` **Plan Failed**: Pull request must be mergeable before running plan. --- ### 21. project: `search-console` dir: `.` workspace: `search-console` **Plan Failed**: Pull request must be mergeable before running plan. --- ### 22. project: `vaultwarden` dir: `.` workspace: `vaultwarden` **Plan Failed**: Pull request must be mergeable before running plan. --- ### Plan Summary 22 projects, 0 with changes, 0 with no changes, 22 failed * :fast_forward: To **apply** all unapplied plans from this Pull Request, comment: ```shell atlantis apply ``` * :put_litter_in_its_place: To **delete** all plans and locks from this Pull Request, comment: ```shell atlantis unlock ```

scottylabs-bot commented 2026-11-01 15:24:05 +00:00

Owner

Copy link

Ran Plan for 22 projects:

1. project: cloudflare-tokens dir: . workspace: cloudflare-tokens
2. project: litellm dir: . workspace: litellm
3. project: atlantis dir: . workspace: atlantis
4. project: hosts dir: . workspace: hosts
5. project: headscale dir: . workspace: headscale
6. project: occ dir: . workspace: occ
7. project: forgejo dir: . workspace: forgejo
8. project: nixbot dir: . workspace: nixbot
9. project: matrix dir: . workspace: matrix
10. project: governance dir: . workspace: governance
11. project: ricochet dir: . workspace: ricochet
12. project: mail dir: . workspace: mail
13. project: kennel dir: . workspace: kennel
14. project: garage-webadmin dir: . workspace: garage-webadmin
15. project: keycloak dir: . workspace: keycloak
16. project: openbao dir: . workspace: openbao
17. project: observability dir: . workspace: observability
18. project: vaultwarden dir: . workspace: vaultwarden
19. project: snot dir: . workspace: snot
20. project: posthog dir: . workspace: posthog
21. project: webhook dir: . workspace: webhook
22. project: search-console dir: . workspace: search-console

---

1. project: cloudflare-tokens dir: . workspace: cloudflare-tokens

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

2. project: litellm dir: . workspace: litellm

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

3. project: atlantis dir: . workspace: atlantis

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

4. project: hosts dir: . workspace: hosts

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

5. project: headscale dir: . workspace: headscale

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

6. project: occ dir: . workspace: occ

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

7. project: forgejo dir: . workspace: forgejo

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

8. project: nixbot dir: . workspace: nixbot

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

9. project: matrix dir: . workspace: matrix

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

10. project: governance dir: . workspace: governance

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

11. project: ricochet dir: . workspace: ricochet

Plan Failed: Pull request must be mergeable before running plan.

---

12. project: mail dir: . workspace: mail

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

13. project: kennel dir: . workspace: kennel

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

14. project: garage-webadmin dir: . workspace: garage-webadmin

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

15. project: keycloak dir: . workspace: keycloak

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

16. project: openbao dir: . workspace: openbao

Plan Failed: Pull request must be mergeable before running plan.

---

17. project: observability dir: . workspace: observability

Plan Failed: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request.

Once the lock is released, comment atlantis plan here to re-plan.

---

18. project: vaultwarden dir: . workspace: vaultwarden

Plan Failed: Pull request must be mergeable before running plan.

---

19. project: snot dir: . workspace: snot

Plan Failed: Pull request must be mergeable before running plan.

---

20. project: posthog dir: . workspace: posthog

Plan Failed: Pull request must be mergeable before running plan.

---

21. project: webhook dir: . workspace: webhook

Plan Failed: Pull request must be mergeable before running plan.

---

22. project: search-console dir: . workspace: search-console

Plan Failed: Pull request must be mergeable before running plan.

---

Plan Summary

22 projects, 0 with changes, 0 with no changes, 22 failed

• ⏩ To apply all unapplied plans from this Pull Request, comment:

  atlantis apply
  

• 🚮 To delete all plans and locks from this Pull Request, comment:

  atlantis unlock
  

Ran Plan for 22 projects: 1. project: `cloudflare-tokens` dir: `.` workspace: `cloudflare-tokens` 1. project: `litellm` dir: `.` workspace: `litellm` 1. project: `atlantis` dir: `.` workspace: `atlantis` 1. project: `hosts` dir: `.` workspace: `hosts` 1. project: `headscale` dir: `.` workspace: `headscale` 1. project: `occ` dir: `.` workspace: `occ` 1. project: `forgejo` dir: `.` workspace: `forgejo` 1. project: `nixbot` dir: `.` workspace: `nixbot` 1. project: `matrix` dir: `.` workspace: `matrix` 1. project: `governance` dir: `.` workspace: `governance` 1. project: `ricochet` dir: `.` workspace: `ricochet` 1. project: `mail` dir: `.` workspace: `mail` 1. project: `kennel` dir: `.` workspace: `kennel` 1. project: `garage-webadmin` dir: `.` workspace: `garage-webadmin` 1. project: `keycloak` dir: `.` workspace: `keycloak` 1. project: `openbao` dir: `.` workspace: `openbao` 1. project: `observability` dir: `.` workspace: `observability` 1. project: `vaultwarden` dir: `.` workspace: `vaultwarden` 1. project: `snot` dir: `.` workspace: `snot` 1. project: `posthog` dir: `.` workspace: `posthog` 1. project: `webhook` dir: `.` workspace: `webhook` 1. project: `search-console` dir: `.` workspace: `search-console` --- ### 1. project: `cloudflare-tokens` dir: `.` workspace: `cloudflare-tokens` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 2. project: `litellm` dir: `.` workspace: `litellm` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 3. project: `atlantis` dir: `.` workspace: `atlantis` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 4. project: `hosts` dir: `.` workspace: `hosts` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 5. project: `headscale` dir: `.` workspace: `headscale` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 6. project: `occ` dir: `.` workspace: `occ` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 7. project: `forgejo` dir: `.` workspace: `forgejo` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 8. project: `nixbot` dir: `.` workspace: `nixbot` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 9. project: `matrix` dir: `.` workspace: `matrix` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 10. project: `governance` dir: `.` workspace: `governance` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 11. project: `ricochet` dir: `.` workspace: `ricochet` **Plan Failed**: Pull request must be mergeable before running plan. --- ### 12. project: `mail` dir: `.` workspace: `mail` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 13. project: `kennel` dir: `.` workspace: `kennel` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 14. project: `garage-webadmin` dir: `.` workspace: `garage-webadmin` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 15. project: `keycloak` dir: `.` workspace: `keycloak` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 16. project: `openbao` dir: `.` workspace: `openbao` **Plan Failed**: Pull request must be mergeable before running plan. --- ### 17. project: `observability` dir: `.` workspace: `observability` **Plan Failed**: This project is currently locked by an unapplied plan from pull #193. To continue, delete the lock from #193 or apply that plan and merge the pull request. Once the lock is released, comment `atlantis plan` here to re-plan. --- ### 18. project: `vaultwarden` dir: `.` workspace: `vaultwarden` **Plan Failed**: Pull request must be mergeable before running plan. --- ### 19. project: `snot` dir: `.` workspace: `snot` **Plan Failed**: Pull request must be mergeable before running plan. --- ### 20. project: `posthog` dir: `.` workspace: `posthog` **Plan Failed**: Pull request must be mergeable before running plan. --- ### 21. project: `webhook` dir: `.` workspace: `webhook` **Plan Failed**: Pull request must be mergeable before running plan. --- ### 22. project: `search-console` dir: `.` workspace: `search-console` **Plan Failed**: Pull request must be mergeable before running plan. --- ### Plan Summary 22 projects, 0 with changes, 0 with no changes, 22 failed * :fast_forward: To **apply** all unapplied plans from this Pull Request, comment: ```shell atlantis apply ``` * :put_litter_in_its_place: To **delete** all plans and locks from this Pull Request, comment: ```shell atlantis unlock ```

Some checks failed

Hide checks

kennel/build build succeeded

Details

kennel/deploy deployment healthy

CI / check-1 (pull_request) Successful in 59s

Details

CI / build (pull_request) Successful in 1m5s

Details

CI / check (pull_request) Successful in 0s

Details

nixbot/nix-eval evaluation succeeded in 0s (1 warning)

Details

nixbot/nix-build 0 attributes built

Details

atlantis/pre_workflow_hook: Fetch flake inputs before parallel plans succeeded.

Details

atlantis/pre_workflow_hook: Generate atlantis.yaml from the flake succeeded.

Details

atlantis/plan: cloudflare-tokens Plan failed.

Details

atlantis/plan: atlantis Plan failed.

Details

atlantis/plan: litellm Plan failed.

Details

atlantis/plan: hosts Plan failed.

Details

atlantis/plan: openbao Plan failed.

Details

atlantis/plan: headscale Plan failed.

Details

atlantis/plan: occ Plan failed.

Details

atlantis/plan: forgejo Plan failed.

Details

atlantis/plan: nixbot Plan failed.

Details

atlantis/plan: matrix Plan failed.

Details

atlantis/plan: governance Plan failed.

Details

atlantis/plan: ricochet Plan failed.

Details

atlantis/plan: mail Plan failed.

Details

atlantis/plan: kennel Plan failed.

Details

atlantis/plan: keycloak Plan failed.

Details

atlantis/plan: garage-webadmin Plan failed.

Details

atlantis/plan: observability Plan failed.

Details

atlantis/plan: vaultwarden Plan failed.

Details

atlantis/plan: snot Plan failed.

Details

atlantis/plan: posthog Plan failed.

Details

atlantis/plan: webhook Plan failed.

Details

atlantis/plan: search-console Plan failed.

Details

atlantis/plan 22/22 projects failed to plan.

This pull request is marked as a work in progress.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin refactor/sops-nix:refactor/sops-nix

git switch refactor/sops-nix

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

  

needs/docs

Must have documentation written

  

needs/research

Discuss the ideal implementation with the tech lead

  

needs/upstream

Needs a contribution to an upstream project

  

type/bug

Something not working as intended

  

type/external

Lives outside of code

  

type/feature

New functionality

  

type/refactor

Improving existing code

  

urgency

high

This is currently causing issues

  

urgency

immediate

This is making a project or feature unusable

  

urgency

low

This can happen whenever

  

urgency

medium

This is expected to cause issues soon

No labels

needs/docs

needs/research

needs/upstream

type/bug

type/external

type/feature

type/refactor

urgency

high

urgency

immediate

urgency

low

urgency

medium

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

ScottyLabs/infrastructure!194

No description provided.