[jaspermayone]

Summary

On skein (patchwork_central, prod), the roles weave and selvage had no password, so no app could log in ("no password file for weave; it cannot log in yet").

• New secrets/central-prod-weave.age and secrets/central-prod-selvage.age. Each holds a random 64-hex password, encrypted to jsp and skein. Nobody saw the values.
• skein decrypts them to /run/central-db/patchwork_central/<app>, owned by postgres, and central-db-setup sets each role password. This is the same setup as seam.
• central-db-setup runs again when a password file changes.

No app uses skein yet. When an app connects, add the host that runs it as a recipient, and put the same password in that app's env file.

Deploy

deploy .#skein. This deploy also makes skein tailnet only (#48). Postgres does not restart. Only central-db-setup runs.

Known limits

These come from the review. Both are in modules/central-db from before this change, and both apply to seam too:

• central-db-setup passes the password to psql as an argument. A local user on skein can see it in /proc for a moment. If ALTER ROLE fails, the statement goes to the journal.
• If you remove a secret file, the role keeps its old password. To revoke a password, run ALTER ROLE ... PASSWORD NULL by hand.

Test plan

• nixosConfigurations.skein evaluates. age.secrets has central-prod-weave and central-prod-selvage at /run/central-db/patchwork_central/, owned by postgres.
• hem does not pick up the new files: it reads central-staging-* only.
• After the deploy, journalctl -u central-db-setup has no "no password file" line. In pg_authid, weave and selvage have a password.