[jaspermayone]

Summary

This is the Selvage go-live branch (README "Selvage on twill", "Go live"). It holds the production secrets that bin/new-selvage-secrets wrote. Do not merge it yet. The lab hosts follow main, so the merge is the deploy: seam sets the selvage role password, and twill starts Selvage.

File	Recipients
secrets/selvage-env.age	jsp, twill
secrets/selvage-ghcr-token.age	jsp, twill
secrets/restricted-prod-selvage.age	jsp, seam
secrets/ad-join.age	the lab hosts, now with twill

secrets.nix also adds twill to selvage-staging-env.age. That file does not exist yet: bin/new-selvage-staging-secrets writes it.

bin/new-selvage-secrets reported no missing required key, so selvage-env.age has the database URLs, SECRET_KEY_BASE, WEAVE_ISSUER, the weave client, the Slack signing secret, the bot and admin tokens, and SELVAGE_AUDIT_CHANNEL. The browser token and cookie are optional and the script does not report them. Nobody decrypted the file to check.

Before the merge (README "Go live")

• 1. jaspermayone/infra#84 (tailnet grants) merged.
• 2. feat: add selvage record, proxied to alastor dns#20 merged.
• 3. patchworklabsorg/selvage#98 (production boot fix) and fix(secrets): set the new weave staging master key #63 (admin UI) merged, and image.yml pushed ghcr.io/patchworklabsorg/selvage:main.
• 3b. feat(selvage): pass the admin web ui paths through nginx on twill #100 (admin paths in nginx) merged.
• 4. VMID 363 and 10.100.90.63 free, 3 GiB spare on pve01.
• 5. AD: .\converge.ps1, then ansible-playbook ad.yml -t host-groups.
• 6. bin/install-host twill.
• 7. On twill: sudo tailscale up --advertise-tags=tag:patchwork,tag:patchwork-selvage.
• 8. ssh-keyscan -t ed25519 10.100.90.63, add twill to secrets/secrets.nix and to selvage-env.age, selvage-ghcr-token.age and ad-join.age.
• 10. Re-encrypt ad-join.age, selvage-env.age and selvage-ghcr-token.age alone, with the age -d | age -e -R command from the README. The secrets were written before step 8, so all three need it. Do not run agenix -r.
• Register https://selvage.patchworklabs.org/auth/callback on the Selvage app in weave.

Steps 9 and 11 (write the secrets, fill in Slack and weave) are done in the first commit.

Twill build (2026-11-13)

• tofu plan, targeted to twill: 1 to add, 0 to change, 0 to destroy. Applied.
• nixos-anywhere --flake .#twill exited 0. twill answers on 10.100.90.63.
• AD: ansible-playbook ad.yml -t host-groups and -t converge (infra#105) made lnx-twill-* and twill-admins.
• The host key is from ssh-keyscan -t ed25519 10.100.90.63.
• The three files were re-encrypted with age -d | age -e -R. For each one, the recipient stanza count matches secrets.nix, and the sha256 of the plaintext is the same as before. Nothing was printed.
• nix flake check --no-build --all-systems passes. nix fmt -- --ci fails only on tests/ad-org.nix, which is already unformatted on main.
• Not done yet: step 7 (tailscale up on twill) and the weave redirect URI.

Review

An adversarial review checked the files without decrypting them. Only the three files change. Each one is an age file with no plaintext. The recipient stanzas match secrets/secrets.nix. The file names match the readers on twill and seam. It found one order risk: a merge now would set the role password on seam before twill exists. That is why this PR waits.