Julien Malka
d05fcb7e2c
Some checks failed
Check meta / check_dns (push) Failing after 19s
Check meta / check_meta (push) Successful in 20s
build configuration / build_and_cache_storage01 (push) Failing after 35s
build configuration / build_and_cache_compute01 (push) Failing after 36s
build configuration / build_and_cache_rescue01 (push) Failing after 33s
build configuration / build_and_cache_geo01 (push) Failing after 32s
build configuration / build_and_cache_geo02 (push) Failing after 31s
build configuration / build_and_cache_vault01 (push) Failing after 33s
build configuration / build_and_cache_web01 (push) Failing after 32s
build configuration / build_and_cache_web02 (push) Failing after 33s
lint / check (push) Failing after 28s
build configuration / build_and_cache_krz01 (push) Failing after 1m55s
build configuration / build_and_cache_bridge01 (push) Failing after 33s
39 lines
1.2 KiB
Nix
39 lines
1.2 KiB
Nix
let
|
|
_sources = import ../npins;
|
|
|
|
meta = import ../meta (import _sources.nixpkgs { }).lib;
|
|
|
|
getAttr = flip builtins.getAttr;
|
|
|
|
inherit (import ../lib/nix-lib) flip setDefault unique;
|
|
in
|
|
|
|
rec {
|
|
# WARNING: When updating this list, make sure that the nodes and members are alphabetically sorted
|
|
# If not, you will face an angry maintainer
|
|
_keys = (import "${_sources.infrastructure}/keys")._keys // {
|
|
krz01 = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP4o65gWOgNrxbSd3kiQIGZUM+YD6kuZOQtblvzUGsfB" ];
|
|
};
|
|
|
|
getKeys = ls: builtins.concatLists (builtins.map (getAttr _keys) ls);
|
|
|
|
mkSecrets =
|
|
nodes: setDefault { publicKeys = unique (rootKeys ++ (builtins.concatMap getNodeKeys' nodes)); };
|
|
|
|
getNodeKeys' =
|
|
node:
|
|
let
|
|
names = builtins.foldl' (names: group: names ++ meta.organization.groups.${group}) (
|
|
meta.nodes.${node}.admins ++ [ node ]
|
|
) meta.nodes.${node}.adminGroups;
|
|
in
|
|
unique (getKeys names);
|
|
|
|
getNodeKeys = node: rootKeys ++ getNodeKeys' node;
|
|
|
|
# List of keys for the root group
|
|
rootKeys = getKeys meta.organization.groups.root;
|
|
|
|
# List of 'machine' keys
|
|
machineKeys = rootKeys ++ (getKeys (builtins.attrNames meta.nodes));
|
|
}
|