From 0138dd376cd686a1d83812c749be8a971c187c41 Mon Sep 17 00:00:00 2001 From: Anish Lakhwara Date: Sun, 1 Nov 2026 15:04:26 -0700 Subject: [PATCH] docs: clarify server checkout preparation for cutover --- TANGLED-MIGRATION.md | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) diff --git a/TANGLED-MIGRATION.md b/TANGLED-MIGRATION.md index 3fd7f6a..437137e 100644 --- a/TANGLED-MIGRATION.md +++ b/TANGLED-MIGRATION.md @@ -115,10 +115,23 @@ Do not garbage-collect the server store between staging and activation. The signature exception applies to this one root-authorized import, not to persistent Nix configuration. Importing and rooting paths do not activate them. -After committing the encrypted secret on the server if necessary, pull the -configuration with `git pull --ff-only` in `/etc/commonscomputing-nix`. Do not -overwrite unrelated DNS edits. Activation below uses the exact built path, -not a fresh flake evaluation or update. +The encrypted secret and recipient rule are already committed upstream. +The server currently has the same edits locally, including a staged new file. +Preserve those edits in a path-limited stash before pulling; do not create +another secret commit and diverge the server branch again: + +```sh +git -C /etc/commonscomputing-nix stash push \ + -m 'pre-cutover encrypted secret backup' -- secrets/knot-env.age secrets/secrets.nix +git -C /etc/commonscomputing-nix pull --ff-only +sha256sum /etc/commonscomputing-nix/secrets/knot-env.age +``` + +The encrypted file's SHA-256 should remain +`b26f36d098a337a98217aa4e73d2f39eb4e8864337dfcface937093f5557f0ac`. +Keep the stash until cutover is verified; do not pop it over the incoming +identical secret. The path-limited stash leaves unrelated DNS edits alone. +Activation below uses the exact built path, not a new flake evaluation/update. ## Decrypt And Rehearse With The Persistent Key