From 329456b402093aacb0a2648a0fbfd3e09229382f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E2=9C=BF=20corey?= Date: Thu, 28 May 2026 11:34:59 -0700 Subject: [PATCH 1/5] feat(lobtop): configure Claude Code to use Bedrock Co-Authored-By: Claude Sonnet 4.6 --- hosts/lobtop/home.nix | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/hosts/lobtop/home.nix b/hosts/lobtop/home.nix index 803a42a7..641ce9eb 100644 --- a/hosts/lobtop/home.nix +++ b/hosts/lobtop/home.nix @@ -1,3 +1,11 @@ {pkgs, ...}: { rc.gpg.enable = true; + + programs.claude-code.settings.env = { + CLAUDE_CODE_USE_BEDROCK = "1"; + AWS_REGION = "us-west-2"; + AWS_PROFILE = "bedrock"; + ANTHROPIC_DEFAULT_SONNET_MODEL = "us.anthropic.claude-sonnet-4-6"; + ANTHROPIC_DEFAULT_HAIKU_MODEL = "us.anthropic.claude-haiku-4-5-20251001-v1:0"; + }; } From aecab402ab4f3fb4b3807e4150be62cb1a80d30b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E2=9C=BF=20corey?= Date: Thu, 28 May 2026 11:53:49 -0700 Subject: [PATCH 2/5] feat(lobtop): add OTEL telemetry env vars for Claude Code Non-secret vars go into settings.env; the OTLP Bearer token is stored in an age secret and exported via zsh sessionVariables at activation time. Co-Authored-By: Claude Sonnet 4.6 --- hosts/lobtop/home.nix | 21 ++++++++++++++++++++- hosts/lobtop/secrets/otel-token.age | 7 +++++++ lib/secrets.nix | 2 ++ lib/secrets/lobtop.nix | 5 +++++ 4 files changed, 34 insertions(+), 1 deletion(-) create mode 100644 hosts/lobtop/secrets/otel-token.age create mode 100644 lib/secrets/lobtop.nix diff --git a/hosts/lobtop/home.nix b/hosts/lobtop/home.nix index 641ce9eb..e89cb06a 100644 --- a/hosts/lobtop/home.nix +++ b/hosts/lobtop/home.nix @@ -1,11 +1,30 @@ -{pkgs, ...}: { +{ + config, + pkgs, + ... +}: { rc.gpg.enable = true; + age.secrets.otel-token = { + file = ./secrets/otel-token.age; + }; + programs.claude-code.settings.env = { CLAUDE_CODE_USE_BEDROCK = "1"; AWS_REGION = "us-west-2"; AWS_PROFILE = "bedrock"; ANTHROPIC_DEFAULT_SONNET_MODEL = "us.anthropic.claude-sonnet-4-6"; ANTHROPIC_DEFAULT_HAIKU_MODEL = "us.anthropic.claude-haiku-4-5-20251001-v1:0"; + CLAUDE_CODE_ENABLE_TELEMETRY = "1"; + OTEL_RESOURCE_ATTRIBUTES = "user.email=corey.johns@lob.com,user.name=Corey_Johns"; + OTEL_EXPORTER_OTLP_ENDPOINT = "https://lob.getdx.net/api/otel"; + OTEL_EXPORTER_OTLP_PROTOCOL = "http/json"; + OTEL_LOGS_EXPORTER = "otlp"; + OTEL_METRICS_EXPORTER = "otlp"; + OTEL_METRIC_EXPORT_INTERVAL = "60000"; + }; + + programs.zsh.sessionVariables = { + OTEL_EXPORTER_OTLP_HEADERS = "Authorization=Bearer $(cat ${config.age.secrets.otel-token.path})"; }; } diff --git a/hosts/lobtop/secrets/otel-token.age b/hosts/lobtop/secrets/otel-token.age new file mode 100644 index 00000000..12054439 --- /dev/null +++ b/hosts/lobtop/secrets/otel-token.age @@ -0,0 +1,7 @@ +age-encryption.org/v1 +-> ssh-ed25519 2apDeA KFdClH797EkFCYd/hAgjGJ27shhf4hbp55kCpiqg70c +PTkEMjmUz5R3wMT+mwziU1oaaWHDhUDQ2VQjgKaxUvs +-> ssh-ed25519 +LEAUA fjeLrWogHsxqtwkGbp/bLjwl7d8w60zKUmA+n3BVf3c +G2s5yYQq0Lr6FL4fQUSPWxgjMZ8ohQl4iYNnsY0Bplk +--- K7gXwE/hawRSUaN+WvRWHNIk4sHDs+AS/S86iZEy4hQ +vy>`]{'bLɠza \ No newline at end of file diff --git a/lib/secrets.nix b/lib/secrets.nix index ad8bf93d..52cb6e1c 100644 --- a/lib/secrets.nix +++ b/lib/secrets.nix @@ -3,12 +3,14 @@ let globalSecrets = import ./secrets/default.nix; glyphSecrets = import ./secrets/glyph.nix; + lobtopSecrets = import ./secrets/lobtop.nix; sporeSecrets = import ./secrets/spore.nix; zetaSecrets = import ./secrets/zeta.nix; homeSecrets = import ./secrets/home.nix; in globalSecrets // glyphSecrets + // lobtopSecrets // sporeSecrets // zetaSecrets // homeSecrets diff --git a/lib/secrets/lobtop.nix b/lib/secrets/lobtop.nix new file mode 100644 index 00000000..aafa3d7f --- /dev/null +++ b/lib/secrets/lobtop.nix @@ -0,0 +1,5 @@ +let + keys = with (import ../keys.nix); [lobtop deploy]; +in { + "hosts/lobtop/secrets/otel-token.age".publicKeys = keys; +} From cac3a48465cab1cef475a3eab9d1d14d32ed13ba Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E2=9C=BF=20corey?= Date: Thu, 28 May 2026 11:55:02 -0700 Subject: [PATCH 3/5] feat(lobtop): populate otel-token --- hosts/lobtop/secrets/otel-token.age | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/hosts/lobtop/secrets/otel-token.age b/hosts/lobtop/secrets/otel-token.age index 12054439..f336c3c5 100644 --- a/hosts/lobtop/secrets/otel-token.age +++ b/hosts/lobtop/secrets/otel-token.age @@ -1,7 +1,7 @@ age-encryption.org/v1 --> ssh-ed25519 2apDeA KFdClH797EkFCYd/hAgjGJ27shhf4hbp55kCpiqg70c -PTkEMjmUz5R3wMT+mwziU1oaaWHDhUDQ2VQjgKaxUvs --> ssh-ed25519 +LEAUA fjeLrWogHsxqtwkGbp/bLjwl7d8w60zKUmA+n3BVf3c -G2s5yYQq0Lr6FL4fQUSPWxgjMZ8ohQl4iYNnsY0Bplk ---- K7gXwE/hawRSUaN+WvRWHNIk4sHDs+AS/S86iZEy4hQ -vy>`]{'bLɠza \ No newline at end of file +-> ssh-ed25519 2apDeA TFDLcqsK03MxDyrCqu2kFS9nZuXg779sSHncDHxT9g0 +F/OaFlV1xAwyEwFKItG5wnjlJvfI/smlk0XEDhPfXX0 +-> ssh-ed25519 +LEAUA 4lcsLTDCJUfzkTic3HDjnlb9xeF0X757W9l4+7BDTS0 +z295byH59ROO8nh2/PImxCBFsc35HomH8JQZZu0leWo +--- wOoX8gKJh1gjGqa2UrP7k9w/2vtNm4l2GIvO6klBo5M +MV\DkRU߯4r|Ց? W-k2k2+4v^tۛ \ No newline at end of file From 3b5317148f236ce40d825765f28f1d9793687f50 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E2=9C=BF=20corey?= Date: Thu, 28 May 2026 12:04:33 -0700 Subject: [PATCH 4/5] fix(lobtop): defer OTEL token expansion to zshrc init sessionVariables writes with double quotes into .zshenv, causing the $(cat ...) to evaluate before agenix has decrypted the secret. Using initContent writes to .zshrc instead, where the secret is available. Co-Authored-By: Claude Sonnet 4.6 --- hosts/lobtop/home.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/hosts/lobtop/home.nix b/hosts/lobtop/home.nix index e89cb06a..7f091a4a 100644 --- a/hosts/lobtop/home.nix +++ b/hosts/lobtop/home.nix @@ -24,7 +24,7 @@ OTEL_METRIC_EXPORT_INTERVAL = "60000"; }; - programs.zsh.sessionVariables = { - OTEL_EXPORTER_OTLP_HEADERS = "Authorization=Bearer $(cat ${config.age.secrets.otel-token.path})"; - }; + programs.zsh.initContent = '' + export OTEL_EXPORTER_OTLP_HEADERS="Authorization=Bearer $(cat ${config.age.secrets.otel-token.path})" + ''; } From e4cf59c7692444b17a68d37ef7d65b20a5f74d78 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E2=9C=BF=20corey?= Date: Thu, 28 May 2026 12:22:48 -0700 Subject: [PATCH 5/5] fix(lobtop): rekey otel-token secret to home identity The agenix home-manager agent decrypts using ~/.ssh/id_ed25519_agenix (the home key), not the host SSH key. Rekey to home+deploy so the agent can decrypt it on activation. Co-Authored-By: Claude Sonnet 4.6 --- hosts/lobtop/secrets/otel-token.age | 12 ++++++------ lib/secrets/lobtop.nix | 2 +- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/hosts/lobtop/secrets/otel-token.age b/hosts/lobtop/secrets/otel-token.age index f336c3c5..d3c63cbc 100644 --- a/hosts/lobtop/secrets/otel-token.age +++ b/hosts/lobtop/secrets/otel-token.age @@ -1,7 +1,7 @@ age-encryption.org/v1 --> ssh-ed25519 2apDeA TFDLcqsK03MxDyrCqu2kFS9nZuXg779sSHncDHxT9g0 -F/OaFlV1xAwyEwFKItG5wnjlJvfI/smlk0XEDhPfXX0 --> ssh-ed25519 +LEAUA 4lcsLTDCJUfzkTic3HDjnlb9xeF0X757W9l4+7BDTS0 -z295byH59ROO8nh2/PImxCBFsc35HomH8JQZZu0leWo ---- wOoX8gKJh1gjGqa2UrP7k9w/2vtNm4l2GIvO6klBo5M -MV\DkRU߯4r|Ց? W-k2k2+4v^tۛ \ No newline at end of file +-> ssh-ed25519 j0kEgQ ylhGxxvyXw92cD8QYgEb6pXzsEXU5cC5clvxSZ3TKwE +tsi3XqfiqpmPM4uQz0v/+PZj/PUioLrJ2zPaDNxQO0g +-> ssh-ed25519 +LEAUA PgwK13XvqZqov1GsfhVTtJK+vgkhRq5N3s5CUs4MkRk +XhkEbJled2EVoUDsArIb2e2jGKYF4uYvfmTf+5C9Tt8 +--- aCpukO8QTIYKpOwec+MPL18XFa9dmBTnXWvht5Cs68E +SJC~qFqO#0u!?'P.3d10r5K &CcvB>n \ No newline at end of file diff --git a/lib/secrets/lobtop.nix b/lib/secrets/lobtop.nix index aafa3d7f..1e855a5b 100644 --- a/lib/secrets/lobtop.nix +++ b/lib/secrets/lobtop.nix @@ -1,5 +1,5 @@ let - keys = with (import ../keys.nix); [lobtop deploy]; + keys = with (import ../keys.nix); [home deploy]; in { "hosts/lobtop/secrets/otel-token.age".publicKeys = keys; }