[lionello]

Part of #922. Draft until the new secrets VM check is green in CI.

What

• secrets.enable now defaults to true on both backends (NixOS option and native Spec). secrets: {enable: false} turns it off.
• New tests/secrets.nix (registered in vmTestsFor and the host lane): one node, two users (agent, robot). It checks socket/dir modes, root-only key, SO_PEERCRED refusing a second user and root, the systemd-run User= uid drop, scoped injection and redaction, control-group reaping on cancel and timeout, persistence across a broker restart, a corrupt record, and env-exec stripping (tombstones included).
• Fixes found along the way:
  • On a box with web.enable off, /var/lib/agent-box-secrets was never created, so the broker failed 226/NAMESPACE in a restart loop (seen in a TCG boot). The tmpfiles rules are now secretsTmpfilesRules, applied by the broker block and added to internal.tmpfilesRules for the golden inventory.
  • SystemdLauncher ran python3 <worker> with a bare python3 that a NixOS service PATH lacks; it now execs the worker by absolute path.
• Regenerated modules/agent-box.nix, tests/golden, tests/native; backend-parity allowlist updated (AGENT_BOX_SECRET_SOCKET stale entry removed, AGENT_BOX_SECRET_BROKER_ALLOW_DEV_LAUNCHER declared by design).

Security effect

Every box gets a root-owned broker per configured user by default. The root/uid boundary has never run end to end; this PR's VM test is the first attempt, so please do not merge before it is green.

Checks run (aarch64)

module-generated-up-to-date, golden-snapshot, backend-parity, one-spec-both-backends, secret-custody, assemble-module-escaping, module-single-file; python3 -m unittest tests.test_agentbox (189 pass); ruff --select F and ty on the extracted test script; nix eval .#checks.x86_64-linux.secrets.drvPath.

Not verified

The secrets VM test has not run to completion: it needs x86_64 KVM, and a TCG run on aarch64 does not boot in time. The SystemdLauncher change is untested until CI runs it. Comments saying the VM test is missing are left as they are until it passes.

🤖 Generated with Claude Code

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[defangdevs]

CI note on b0012f6 (triage session, nothing pushed): VM (host) fails in the new agent-box-secrets VM test, step "set / list / at-rest encryption / root key":

printf %s 's3cr3t-VALUE-0123456789' | agent-box-secret --profile t set K --stdin failed (2): agent-box-secret: secrets are not enabled on this box

So in the test VM the broker is still off, even though the PR turns it on by default. Likely the test machine config (or a module gate) does not take the new default. The other VM lanes' api.github.com resolve errors are the usual sandbox noise and are not the cause. VM (webhook) was still running when I looked.

[defangdevs]

CI run 43768360724 (VM host, agent-box-secrets) fails at test line 67:

printf %s 's3cr3t-VALUE-0123456789' | agent-box-secret --profile t set K --stdin failed (2): agent-box-secret: secrets are not enabled on this box

Cause (test bug, not the default flip): as_user() builds env + cmd as AGENT_BOX_SECRET_SOCKET=... printf ... | agent-box-secret .... A leading VAR=x applies only to the first command of a pipeline, so agent-box-secret has no socket variable and reports "not enabled". Fix: export it for the whole command line, e.g. env = f"export AGENT_BOX_SECRET_SOCKET=/run/agent-box-secrets/{user}.sock; ". Other non-piped calls are unaffected.

I did not push to your branch. Native checks passed; only VM (host) and the CI gate are red.