Advance forge rollout, Ethereum rails, and NBC sources

secrets/README.md

@@ -14,10 +14,14 @@ nix develop -c ./scripts/fj-set-age-key-secret.sh ~/.config/every.channel/keys/f
 
 ## Files
 
-- `secrets/secrets.nix`: recipients + secret file mapping
+- `secrets.nix`: recipients + secret file mapping
 - `secrets/cloudflare-api-token.age`: encrypted Cloudflare API token (used by deploy workflow)
-- `secrets/forge-token.age`: encrypted Forgejo API token for admin scripts (optional, preferred)
+- `secrets/forgejo-api-token.age`: encrypted Forgejo API token (preferred) for admin scripts and `ecp-forge` netboot staging
+- `secrets/forge-token.age`: legacy encrypted Forgejo API token path for compatibility
 - `secrets/codeberg-token.age`: encrypted Codeberg token for compatibility/mirror admin scripts (optional)
+- `secrets/netboot-chain-token.age`: encrypted chain token used by `services.every-channel.netboot.chainTokenFile`
+- `secrets/op-stack-sepolia-private-key.age`: encrypted Sepolia operator private key used by `services.every-channel.op-stack.privateKeyFile`
+- `secrets/op-stack-challenger-prestate.bin.gz.age`: encrypted Cannon absolute prestate artifact used by `services.every-channel.op-stack.challengerPrestateFile`
 
 ## Create / edit secrets (local)
 

secrets/forgejo-api-token.age

@@ -0,0 +1,12 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDI5T0o0QSBGa1Er
+QXNoaTRTTWZ0V3RVMEhyd1ZLL0ZpeHU0SHZWU00vT2pZZFNJa0dZCjNkL1FENnNu
+QWtkYVBvZ05BWi9nQnJiS2R4MmFSWEpndlFZbG9XZE8xTG8KLT4gc3NoLWVkMjU1
+MTkgRTZRK0x3IEI3b0R4ZEdhZEUrQ1VTRVdGT3Z6ZVlGS3JaVmsyakJDU01VZDc3
+U0FuRE0KTkpQYWw2aUpaemNqZnl2OTRjdlVrNWdLQ0JrUXRrQzRVeXFMaHd6OGR5
+SQotPiBzc2gtZWQyNTUxOSB1S0hwNHcgR08wZWdnYWtGOWhmNTAxOVZmNnBxVjN4
+cjFGQ1IwdFdmbjFlc2o0MU5DbwpoOG1jblVOOUQrOS9qd1MzdVdKSXRaOTJpSUF6
+SXZJUVNoMEI5SFc2RzRzCi0tLSBlbWJ6SUVJQjlvaU4zb2hkbFZUSmN6OTVGa2dG
+ZmxKd0VHZ3Bpc0kxMnVZCl4tmozvALN44xto0FxpO9XDzzMkKnU+hxvDNCIAbp38
+j/hqviNT1QHSVW4WJLhmVxgqevnEW0PUsWCG2idJRHJ94bPLxUsD9o4=
+-----END AGE ENCRYPTED FILE-----

secrets/netboot-chain-token.age

@@ -0,0 +1,13 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IDI5T0o0QSBHVzJa
+ZTEzbVR6UXczVVlUaGJXUlBINCtxbTV6NHRMdmdZa3BFalhab0hzCkFMQjd0V29D
+eVJaa2RneGRuSFgvZmlRUk94a09HTjZtUlBBUklwYzRvUnMKLT4gc3NoLWVkMjU1
+MTkgRTZRK0x3IGxvZzQ4clpKc3p3Y0doU09BbVJYL1Fmcy83L2dIdjBNalpnRXBW
+RTlhVTQKQWRRYmhBSElPUmhzTVZUNENBdUZReFpWTFhTQVduY0NTVXJxSDRrcmJp
+cwotPiBzc2gtZWQyNTUxOSB1S0hwNHcgTGxpaXNpems0S0pBQ3c4V1lOZStTb2Rz
+Y1ZFSDczZnNRZWNYSE91SHJ5SQpWTDZDYlZxYTliRkFGK0MxNHpLNWxhcGhhUGZB
+em9jVUxKR01wNi9PZEtJCi0tLSBqQWNBU1NPSzlVSHZLYVdDRVBKdUlEVjJ1SGY5
+dHd3bjRTRjBYVjU3ZmFrCv+MVi3tXJP4TVVFRd1BWBtK9a+jxID9MiQg63cNRgRc
+rwkJQTm8W5bc3T0Z4VvmIOBlUVr5dUFpdTTL1ieIELUPc9rUA0dPtGi82jFLKwWg
+3g==
+-----END AGE ENCRYPTED FILE-----

secrets/op-stack-sepolia-private-key.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 29OJ4A ePeU9yk5rIUa4eY6YPZxfJwOm9UuknusEVlDFKjG5yk
+INGbIePGXyq2hVLN0nzWnzQfGc9FTjot/owrtfSb14g
+-> ssh-ed25519 E6Q+Lw UGKrcPeqrpOYzV2av7IuItfjj/tR6Q4iJ6EejJdpjlA
+i/9AHEsIZ1ynza0ZNd2Jzq/zceGxlnA6KFcZ1yFSiy4
+-> ssh-ed25519 uKHp4w PCl6trn5v4oZ2RU1Ef6tVB/9dacPwGpJnQ6DCTO9mw0
+gCfwb4sW5CoEO951Z9ALAXmckchTIitU9rLHK+Gvq88
+--- mecoDuf+Ew7R8jne3RdpQwa/Y0fEcb1jbUALv+zA9sg
+‰'¾<>Qõnê$ñ§!H6`rüI#_û­ùÆLFýÝDq•àS˜9 åPµôeÌwnÜ1Oû1$é›:œö?ç1´8ËÂdR»„}‰ò¦ô„TU¤–T±Ÿ`ÏOÂþÏ