From 45fb316c87243d0a86e25d5121aa4f725516d0e9 Mon Sep 17 00:00:00 2001
From: Jasper Mayone <jasper@patchworklabs.org>
Date: Wed, 21 Oct 2026 13:49:32 -0400
Subject: [PATCH 1/3] feat(secrets): add the quilt staging env and role
 password

---
 secrets/quilt-staging-env.age        | 9 +++++++++
 secrets/restricted-staging-quilt.age | 5 +++++
 2 files changed, 14 insertions(+)
 create mode 100644 secrets/quilt-staging-env.age
 create mode 100644 secrets/restricted-staging-quilt.age

diff --git a/secrets/quilt-staging-env.age b/secrets/quilt-staging-env.age
new file mode 100644
index 0000000..73efd05
--- /dev/null
+++ b/secrets/quilt-staging-env.age
@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 1uIO/w l69v0v3SiBpfFprWtrJLNp3oXzRVZX5c6tMI3jgGU3Q
+qZUWZ/fL/iJLoQHvzVD/3FCswxWaAR471OX/zczHqlY
+-> ssh-ed25519 U0D80g C6kuv3x4od0SbopyJgqWul7U0aaCWbonunK+vStJhy0
+hlaXL+hi0tc3jP+Fu9QfkNJwVX3TaOE2iIjhPzUtmy0
+--- n+lbKTh4SE84rST4FS+jm1zFvlS5gsjyD8zcCEPRV+Q
+����mu߄����	��n�r0�m����`��r�gڞQ\��d������X��#�=w�a�L��
	������O.]��UmYS�� ����? {����X&߄�7a�p������_ы����X*,���WƾR����mB$sϷ��C�X?��O��O��iq�SUK��Һžp����б��I���ɹ���������y��y޽"ϔl�	�kH� Қ��⡓.G�Qn��M
+o�_6}eD���ڲ;�8�V�,�v��n�h"o7f �r�͝�;9h�Os��y��1�H4��ܚ�п�#�-؀5��-�Ue�+&����Fe�X��tcy���Ca�
��J�WM>�9څ`������t�N��L��
+�`������t����Z
<�]ڣl�'"�G:}P������4%��ʢ}b���yS�*�:�}�DKfF�p����g����7g��
\ No newline at end of file
diff --git a/secrets/restricted-staging-quilt.age b/secrets/restricted-staging-quilt.age
new file mode 100644
index 0000000..32c59b9
--- /dev/null
+++ b/secrets/restricted-staging-quilt.age
@@ -0,0 +1,5 @@
+age-encryption.org/v1
+-> ssh-ed25519 1uIO/w 64cKQMw+iw86itEW0MExUXV5T5o0vug32Mr2jL+qKTs
+hqBN9eSan4fSDnk8A1ddNNSRkARitvVE+bGxg7z5oWE
+--- ErgaW2LTiusdPUOIVjyOqOtrYORen3n2T+i/OKcuYmA
+��:B�~25��l��uz�L��Gz�|�8�(W�Y���=z��+�Τ|V�i�`�*�Z���gTF�$�r0|?�n+�ӻU	,(�\��C؍��4&
\ No newline at end of file

From e2c3e1e60961c2d71d9b355073a535bde9c433ec Mon Sep 17 00:00:00 2001
From: Jasper Mayone <jasper@patchworklabs.org>
Date: Wed, 21 Oct 2026 13:51:45 -0400
Subject: [PATCH 2/3] docs(secrets): note the quilt staging rotation and hem
 order

---
 secrets/secrets.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 1ec6baa..8a55657 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -108,8 +108,11 @@ in
   # Quilt's role password in patchwork_central_restricted on hem:5433 (the
   # restricted staging cluster). Password only. hem decrypts it into the
   # restricted-staging container (hosts/hem/configuration.nix). alastor does
-  # not get this file: the same password is in quilt-staging-env.age.
-  # TODO: add hem after its install, then `agenix -r`.
+  # not get this file: the same password is in quilt-staging-env.age, so a
+  # rotation must change both files.
+  # Add hem here and run `agenix -r` BEFORE the first hem deploy. The file
+  # exists now, so hem's config already asks for it, and the decrypt fails
+  # while hem is not a recipient.
   "restricted-staging-quilt.age".publicKeys = [ jsp ];
 
   # svc-lnx-join password only (modules/ad-join, ansible/sync-join-password.yml).

From 3de4b3697fc627bed9fead9de285eee0b4c8bd53 Mon Sep 17 00:00:00 2001
From: Jasper Mayone <jasper@patchworklabs.org>
Date: Wed, 21 Oct 2026 13:57:43 -0400
Subject: [PATCH 3/3] feat(secrets): fill in the quilt staging tokens

---
 secrets/quilt-staging-env.age | Bin 750 -> 1029 bytes
 1 file changed, 0 insertions(+), 0 deletions(-)

diff --git a/secrets/quilt-staging-env.age b/secrets/quilt-staging-env.age
index 73efd0556303b93e3426adccb0c9020409a97a4b..97b416e92f939feff5f47dd3461547dcaaa4a42a 100644
GIT binary patch
delta 999
zcmV<D0~q}71%(KZEPpm;bTl<{X=!m;d1g#SMrkuKZ8u>?Q)O~uV`wl{H%Uw|LU>kp
zHZWRgZwhXBQY&UcN_JC6ZCE!~ZbC9vH*;8ZRyZqlcu7P!IY?J+L34R;LN;h(Sqd#a
zAaiqQEoEdfH8n9gAXP9#I51}*OH6cDG-Fq1G-Ov+Hcw+vMSo*>L3K%LYHdn&VNEr0
zQ!zq9Fi2BnR5nv%3VLiScTib#Zdq4RG<H%?Y+6oCN^N3FT3SkaHcB%zO>c8+RaG&0
zLt1ll3N0-yATdsOaydqFM|U?kW;9G{bVfmJWlBs*Z(~wYV^%U{Lw9jlOK3_-XfbwU
z3h&}hglAtgkAF)e>xQk|Y-7Bqi^j`LFZRa3g>;{YH3WW}b2fq3u<do|`MwgyzN+!#
zhzV7gP)R;V6iEzki_j?r1|N5lliBYh1vm0u04k#wza5h9q<PJ`3jd5OY;FL&7GV{B
z<!ix^>@`^^z|dgWR~)1TBDvhUB<E1!l%oE>M&L`^o`0XX*_!wIHPaa;8(|R;9U~5q
z!XMgHg%B{K2LAqA&hF*aqg)iLrU6!7y5U?;K9-!Ydf~z~=&BIeiOA+!>KlQD7g*Iu
zRwf)`aiG?`yxSYX-<0&Xz(Aq87s3;;m=*XnAhpJ&&W2-4XG(Cp5ubLmw};rTyd#`;
z+dHl5NPj_NDUrZ9C4@YGEybts$OR8-Up#1^@BDk*qxG@AmgKoGF~R$jN`1_ow@k8y
z@(DtAVm5mWoj?kL(JsEd0Pq2m`Z}_dPjKq3)M3oTCnAxelKR+pYoGj@&G*~u0D!G9
zg>s*vX=`;H>yle}?*~&QYP7~!K5D<bn-fXQgnz9tHT_ftnA04@VEW;8W6X*BEC8ih
z@G|N3Vjdy*)Y?%z>sSBltbg>`a8lYR`jF=z?!%kMUhY?y`^z~D(s~05EQ;9TEXvs!
z1eJJSClM^Hux_8;WR33HE6m2=SQ8S-oV(_=@rH+}!G&HLV!ryPl8Qkg#nyB!`-KH>
z6@QVyZJ=IsH^Nez0|0^G=EJLh31m%|3`-(vUy<C1bvT4Y!C%5?ZJ#Wf2H<Mc)Fm0z
zWwZ>van>PJbh=%qj$&cWU3rfVXdtd_F9Z(*@G1HdKQm?YSRM3xmUN+U(gsm^SBjen
z{ZO?UA}4T>=J#E4Iejd3m@r+<>5R1+3}8EuSo5Ft#voQOY2STkq+q4an`iH5vfr!0
z-7oX0W>}+BlUoLGZ{$6w%{as$FRv(Gn;2&^?C0WM5i}C&fjDuSA~W^k9XrMI@|bT;
V*Wd4xvCp^_!8Ul#leB%m<i#_{&?o=^

delta 718
zcmV;<0x|uC2<`=tEPre^Id(91GgE0oaArnua#wV6N=#00GjCXWQdU}6HDfk(O-VCq
zXGc{tQ3`QdRaaUsW=t<>N=$E2NOpQwL@zT&Lvwd{S7AX?G&eC%STA~GdPs3>Sqd#a
zAaiqQEoEdfH8n9gAXP9#I51}*LpE!5b~AW1Z)7l2VsCJHN`Gf@S9NSRRWM;;Lsw#N
zZgp-;D|S<KN@#g73TSL$SWGKuX)ttSGip#PMs+z+W@}DLcUD+4RAEm=GHFR_Xi$1p
zbZvPs3N0-yAZ{ycVoOwLG*d-5G;&i^G)7Y^YHcxkMs{pdHD_~bc|<sRV?#wyQdTQb
z3ZC^DjFA@}ZGUy&g!GW2&<Um(*>1~nFz#)I{i38`yN7c6XWE`oT*@2i7G$m%9J1lf
z%i>s>=Oc?fca~xAOqd9>0SO5BwTs%?9OO?f99<jx!&PlrQ>PD=Af?Rg**_qAi=MHg
zSOg~Dguypqs&MA>*!Y#MU(t(&rklH1DlEZ=s8`0mQh%_di24R?LL_s~x3v621^-w-
zgosb1gBDNuyJ>NrQ&mga&(gZWo^a&U1OJ!Mu?)DmNr@4nxXHPZw8rHA$mILWdH%?G
z-n}Bvlx*sv9|^f@NXQ@^(weE5;-Ql+M}<*tndwam8*j>AHhpChM5@p3xZ1Ki#yH4U
zge=c?5r2+`7j6ULXd-VnW+1k5x6Pg0J2`0gPjlV|uX&}^F~vwU&=KR@n)%Sbi6gu%
z1lWKz-_0!)uT^D>D<+W!@yFvvW#m|bv2++?d4l!4Lj?q3fDO{^O7mAue?GlA+J#{4
z!_xczzY}zXPWPisjieh2n_!Bsgrw=!bRLGgnn$8q4LsFd+M{fgCnBB<M>>5_5xj!_
zf5+1gk~AfS;>x0ZV!(*dc~b=aDx^B4eFXd-L`!Byy>Q$4xw~h=((B6%H)pEJ9GPN7
Aa{vGU