From 075cd90fb7cc64b60e69e3e6b31804e9131c087b Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Tue, 22 Feb 2022 23:25:46 +0100 Subject: [PATCH] core01: rekey with MrF, add pve01 hypervisor monitoring --- krops.nix | 4 +- machines/core-services-01/monitoring.nix | 12 ++++- .../secrets/dexGiteaClientSecret.age | Bin 1303 -> 1424 bytes .../core-services-01/secrets/droneKeyFile.age | Bin 1462 -> 1578 bytes .../secrets/keycloakDatabasePasswordFile.age | 48 +++++++++--------- .../secrets/oauth2ProxyKeyFile.age | Bin 1328 -> 1492 bytes machines/core-services-01/secrets/secrets.nix | 2 +- 7 files changed, 37 insertions(+), 29 deletions(-) diff --git a/krops.nix b/krops.nix index 351034b..24f6566 100644 --- a/krops.nix +++ b/krops.nix @@ -29,7 +29,7 @@ let inherit target; }; }; in {} -// mkDeploy "core-services-01" "root@core01.rz.ens.wtf" +// mkDeploy "core-services-01" "root@10.1.1.20" // mkDeploy "remote-builder-01" "root@nix01.builders.rz.ens.wtf" -// mkDeploy "public-cof" "root@beta.rz.ens.wtf" +// mkDeploy "public-cof" "root@minecraft.beta.rz.ens.wtf" // mkTestsConfig [ "core-services-01" "remote-builder-01" "public-cof" ] diff --git a/machines/core-services-01/monitoring.nix b/machines/core-services-01/monitoring.nix index b355179..6149d24 100644 --- a/machines/core-services-01/monitoring.nix +++ b/machines/core-services-01/monitoring.nix @@ -19,7 +19,7 @@ in text = '' [global] page cache size = 32 - dbengine multihost disk space = 4096 + dbengine multihost disk space = 8192 ''; }; @@ -28,12 +28,20 @@ in group = "netdata"; mode = "0600"; text = '' + # pve01 hypervisor [e245097d-bf52-4f66-9c10-984e8d5ee178] enabled = yes - default history = 5000 + default history = 10000 default memory mode = dbengine health enabled by default = auto allow from = 10.1.1.10 + # public-cof server + [c48e6ef1-5cdf-408d-ae2f-86aadb14e3fe] + enabled = yes + default history = 10000 + default memory mode = dbengine + health enabled by default = auto + allow from = 10.1.1.21 ''; }; diff --git a/machines/core-services-01/secrets/dexGiteaClientSecret.age b/machines/core-services-01/secrets/dexGiteaClientSecret.age index 41ffd354202ccee6cabafde5e5cd7027d76ef859..daef2a2a00c33743ebcd5b46b39b1205e074fc61 100644 GIT binary patch literal 1424 zcmZY9JImw*6b4`ytkP{KR>QW#Y%;k_5*Cysll$a;nM^<-$z*b!+%ri=1#v;FE%YZ? zSZJf$EP{>xfGxBU|An=mjm5X^ImH9-dpJQ7Z{jNImS)K6>UrHI;B5OU98jg6>GR#|QwQ|nVpxacS&oNBi<{uotMPIryQ~Hd{F)G?hsA)3 z48Om*kfUZncpvMdr+Ey$RT$hjbu4kNA8YB3N@-m6O$a>U9lfOFv^%9`|Dib;yAoy#~h896F}N2-{EOS4mx?o`Y>37j5l$B~c@ z#!3<<%yMEuy(c0>;vrEbzIlju2P1E4uPCgp3MvRkg%n;>M;Gcid61E=x!+ zz-n1dfNQH5enTE+VU*B`D-NE!y;E^*o5?0Wq`yJ7!I^ zxk%a^Yh?Lby>+oI%G2t$gD6xLQUMZs%sBB{ax3*K$Tlg|l(MAv-ae3a`hYk!0GeJK z&`WpjbZmcB&phSU6|}YY+wG8w@VawzZeYnQ@88l0?3nS%3hlQAYW3_E=Q*|3mPr81 zeBH~J?BeA`Ivnp-X!xVoJan-~c5+M%hmH<0E@{J)Mq6mA@u{&-vT;9+X$%Qj*?GwS zNp^j(D!LNJxVZsyY(!Mzck25t^j5Bi#{z};1XExtOG!{s*4 zc6tWnL7kw64IxaIE1ZWZ6iqS6xHL7oh49qI$p~~TSuQL=Mx@C($*klUN4$(mE(*aE z2!qy|>3|7DXZBn2G!VO75MV**T4P}#ni%-w`5|#W;lN7Z#)L1Y6RAwwNu|b2&j9fV z<8h3-b$^p6vc89kT%^W-ce{r+Nf!rwy!!BYBv3BCdUgk7S86>mFl!R#I`EurDbJ4a zGh4#if|UmqZYg4>%!MtRCGq0K6OpkMSZ+O>2cMX8V7yh)EJQ9V8Hf`IRADzHdhcZu zw;FH`=~kQX;=>o)P3vjbH-X`DGdoLhbW(uLX0zg>T6DLOu=kMP?|CLK~#OgcK6&x!GwLHjdgss8_dkBaz4tFf<JvA5DcHmWG0yeJjl!>lgT-`k3!6yOs>f>IR@9p%0)1x7Jor0J}`Nq@JbJZrKqbj=Ch~!e%}W>#~fS9CbN-*0VH3hn35Q6)TZ&b+M{V z&0{=QhYNu04QVuuvPffAhTUC0oK-WS4c10AW$nkU&DNgiBrWb7c>UoQlwz2!}AYEO(&pLn$u>E2QjJJmHpN0B8)*7<}&As`C- z#N=uziV|kEgd)#5$n5yv+EIvN*n$KJ%*yr&XdW`ZRW4q&UrSBhul&g0lRKMV>#2B_ z$7xwBOGSmX#nk|6W!uKqWsN|`a(zCjk}hL)CTqqvX%7SM3>PIL7KVl;&RwmI^aDSF zTy<#2k~C`0u2qHL@z$#9-Of6@4RjHuxfKcmPD0MT27rpos@vDerZI_1>GP)1EcZ)xGdkEs6l-NqQZ7p7D2MJHUft@UwT~-w%arqFakRb67S;{OuN}MA;nBMgO=4;%V8R>z0cQ zh89oS?aDVdAcirX${DwDExO0jQ!{gWp&*r(ld~~kRy$|tw2)ABGJxN%(39hv&whPD zdiMOaN6#Ps@!%!#={^6KufHXK`0^na-T!&>)#In%Lw|q%%8L(v{|o=@{N3`KFJAuW T-lso3`SF84m#@AXd~*LE7tych diff --git a/machines/core-services-01/secrets/droneKeyFile.age b/machines/core-services-01/secrets/droneKeyFile.age index 00703c2e6c4f86e7d398c31242300078cdb21abd..2c12d704a2edfc6737dc35ad655b01c9961898f5 100644 GIT binary patch literal 1578 zcmZY7>F?770LF2Rcfmvra`|S8!DIaFwYIA!$hx&%yYA?^ZtJ2Xz1DTzx~}Vb%ovZL zi7~zrV~moBcpCwUAW8^o#1MsO03~Q53Tgxs&>-;&Ch8ks{QL_(Po8{L%bYV^-A}y0 z9=W%Td3>ZL8*(gDLnX{86b3Qh8ZW&DMA~BWcYrfgwN>K{7qE@va zDABB{q-$+T@Ar%vHbAq6!-|y#;-z8MRmqST$M3A2}L4_D-C8GXb>05St&*> z*4AXYE|Q8A@R`B?v@F)LSt~_C!*XngktvHRueY)U8EcTw(wNq+8Px$1LnA$>V3S^`pl%t6Qt?#(qDdP75438>I$?`Z< z9ZxN@K#Zyu8{jgl4QsS8pe#^i+MqhldXer5^?_G)`(PS#1DwI}dJYFXwcmv7>7bBQ zBvA;^!YZoEC`%VA&cvE^qkb{( zM!?+MTncoi6*p0J4~j9Z*zWnoZ2q4=Db!UgG+XX=C}!xAoguA>!1_DyKL5}GgcUUK6~MbP5Y1E;q|_~{>6i<_iS1G_1u~10oZ1o<@X;Hmv8!X!J-X&x1IiZ zMfV=(L*(YS-+lJfTYr=u{p92IA1$qmTTQjJ3cU!rWy=LSp8c)6vT&byiaM*Td(R_Rcnc-^i}r%Xb*h<&_(MSiA_o=E@W4myVF7>sB0C!~M0B TQJAaNt-*@fQf*Y69Z9EFly9jqP+Nm@BieN@5`6JTGykx ztNEi=*Yw<^Mz1)>r ztUnMmAzTl@RF0=bp-#nv%jbl_V}RK$w~&Sv8}%fol~XmT1P$;`C|z}s!q8)V096GG zq9xBM7%pRjJl^XjV`h&@3k6fnqr>`@ny*W2W)RkWSEx3Ju*EV1FHcxn-fYkwx?7%s@lJ&CxYZ60B zCS4Ev#fqIy1i66-1X#m@$sx_~Sl+6QX-Nc4@CDE?%?4AT8ghs?7_x+6I1D=@u*uuG zCPg*6Qb|LDN}H`j@StfI5S<8Y_P=a?M-4aq5}6f3wrds9{6KZ899R}o48z6-%`{XX zwG_6mS2SUw(;uU_X3fJSWP1ts*e}j^fpTA_ysXvF)=~rEU%55nfb7bWF`ydL{0r`kj*Dp}7{-xV(eQ zA7ITIJ6iX3wWEizi52(v!a+QgT{mZX>r!IZ=IalB?*#iE zU;5sp_1oF;i8N%+-g)1$Is2!UonL+Jp;@P`dDWtCbWWdr_U-k+tPA-)3m+RDSbWvb zmsTDBddY*pqccC$-rBKa^11QrjvbTt9$EeHyjRZbfANub(Ye4co71z0Kb4!~n{Kb%YRpjyMk1uSe(7hKe^W ssh-ed25519 lHr4YQ FHOLoe1idBzwzFB5v1UqrVIgIjmyVMqhC60F+7bsslY -+4jeqlOONU712hstLOOU59dHgx48CB3+Z4xn1faH8Q0 --> ssh-ed25519 Wu8JLQ hqwTH7IVS1GTep9tNy6vrUUVtPcVXBxDnJj77S+l/Ek -gmnQhE5wnxQgEhyE18RKKemMQr4ewtRkQRt0bJo8O7Y --> ssh-ed25519 cvTB5g bw+GZVk23ok4lgUF86PqTkZOM7BPNY7foMYYMZSEemU -6BAoCmLYb1oJwPPW3X2AaS3ZOttSxAykOeKIJM/03+k --> ssh-ed25519 /vwQcQ Kqg5WdWhAuxCxMgWPpXWk77utvbIbBdcZXNSOF+a938 -4361sLVjBWOoWqTl7sIktNiulSU4gHnD2Q5gjDkZ2po --> ssh-ed25519 reTIKw abLB9hwppWQhlkAHx3AiFgePvigajethU03CjTu6SUg -sueQMp1LPmF4h1EPsyGrSDH6RoXVXoWm1i3OISZlyPw --> ssh-ed25519 85WiGg T6amGqzBiF7BLhnhPrz8BCu/NDikWBDnRv+UL2Y8mXs -xghk5e+D3O4rX4FT4TNu/bowSj7HCn3Wi4E6F7pseiw +-> ssh-ed25519 lHr4YQ S/Kuy8PdLoLLRDvlDDyuDaGXGb0RMBJKo9XyHK2I0Bg +VFjemRE9hOc/fEol+2OAjM6d/5QLPeeo0ytdgcwa8Zs +-> ssh-ed25519 h6AgbA ParmcGdbVHdvihrEuV+nLBLDnTwKR+zoxc/O0LdrUhA +L1kL6sr4ak1DTTaui9k6tpPJ1p86bKAoOcPwCJu7vr0 +-> ssh-ed25519 Wu8JLQ hTPuIn+IogmX6U16p3EQ/9C/L+X7dZaQaBrEAdq4twM +QhnuGbpuqpFFujNlXSDUDMEGHK875Sr5hHX/q2ShkhU +-> ssh-ed25519 cvTB5g P8av9KTsR9ccIRPz0TABQF3EfeO+cyn+Od+shxeatEk +GnExLTBOicvRs7neFPL/GLxE6hqpdqNV8P4nWRbMjKU +-> ssh-ed25519 /vwQcQ WE0fxso39H7ZyYwJ8eNnmrLgf0xL5AdpHZ1mrvbiPyQ +y4GjFZuYtiGg6cY8ZTOKHbYjjFJoFI5W4IF7np/OB/8 +-> ssh-ed25519 reTIKw LxM4ihcAb5u6rKqtrOUZ7/4XXoMVbf/HHhby/i9Xbn4 +O8KkO/99T2lBttsADSTJE/18ljFrUjrJWhK7peehei8 +-> ssh-ed25519 85WiGg +GtCSdOR7TTwu+zTvwOoRhOE0iLwB7JuFaZkP8cP+Fk +0GCjcBgOPeynvAUDmEioWPJMhZWGchKKukGGXHCBEUU -> ssh-rsa krWCLQ -KDsZM/5myCVtb7RL9Mo1F2WUKzBPhwillBvrIONZKH0dh3mCMjeVfyYTto1NxKxp -GsvYltgLbDggo3ittwQedB9s/JXL5z0+f3DroKVJzw82ti6w3SMpvKiCR2x+5DjH -D4Wzt/CQFujxAMOghKQGlFuCM6nVkpmL9ucgUPEp7ApbNWuc4patJgLpvkE0yj7X -Q4ScTPg86Oh5RFf4Qwa3QhG7IdnIoSSJxK+rK5qZb2vPST9zc2OKZKQXOh2h6hBy -tEAhRYBTu6oqprwYlEWL7dCsbBeHjLmBE6Zvovp51PizZhzub1jCh/fuka1VTFSq -f1oWAdTS3Ow5gXWKoH5TkQ --> +_u~Wjak-grease cU8 ?4 8Y(inxl+ -h+7nxip00iflkCYBX2HvbHYc0SjsLvn4WVYUPzhDGjyauwARfA5zCfuIbGnEcxzF -FOWG9QQzr90JDCkonUjGTJ3N+ykLpiYCvLDJgXZB4MVEONyutwM ---- dZ6ca/xXQAOh82oeOyV/EkjTzK+oUj0YgzGTqyzJ8Rs -a OvF⌞ʛ -JFjj+ \ No newline at end of file +bSk43qTcHFgrS7AeXTzUbx5FO/1YrLuRlm58lcXpTTKcRMZWKmFbPTVNdIvkT4xt +B6HW0OqV/Ks1pbeJUCPRdLwYHYULEC4quRGlgeToXoUQ8zCvcPT6uikpK0Hzne7e +WI5MLdS3vvAPljlSSaPN8gb3yiPgA2IPrHjqIsMNkotGFjUQ/oIyJ8YcDsSfGE2T +Z8+TOj4ZNxPda2hX7mL2x2dJmmQW5FkOVtSpSyvwpkOqPOi6b5vZaWu/GtXzGEhD +SD6SALiqmWkCHb8n588XDqKj8Lj/741R24f8IM8qW9cBz4QClh3Bnrl4gendsUCp +PkQPjniidi/aF6sHhfrSNg +-> |#4-grease y%'e^I RB nBNinf \dob +L2HkuH7S3KtuQN9AWLBL99nJPxVw +--- +QOdyAz8FR0RecYvvkzxv2IzJ9yt89/xePALK3l7sjs +&,NpJ~ ƅ˜*,؆5:i W}m"Q-FJm \ No newline at end of file diff --git a/machines/core-services-01/secrets/oauth2ProxyKeyFile.age b/machines/core-services-01/secrets/oauth2ProxyKeyFile.age index eb729b2e73acd38c84e188d8175df2a70cdea4dd..a62c1af71b7bdad19991f49ff4102777092cf4b4 100644 GIT binary patch literal 1492 zcmZA1&Fk9)0LF1d9kYs?A}T1X3?0MLrAd=CRZx<&Nt&c>k|yad0g=2XZIkAuNt)nL z7{0JwC%Xv4De4r2;n1t6F`Z-R1R3hYfyxjM+d&XKI0P@hzulEY3Vx)L@L*gKl7j)1r2g7Y*is0DYKze^mGx2sN4|2Ka;9k6nsJh&(`6%w0c+(Xs zgfCFt(un?cP&v#*&K-%9i-JU_6`3xXn!*q}^nI+M*5hS_1_s&k%E8XkAZx!j;$?e2 zCK5#}v@jI~Gay>BwZU?h z;%J;B%5vHx!yTi`(lX@;GCrA&CW0;IINlhnX@!e(T^75jKZc2(la!`Q)7-cfZ!>MP z<`HEvbX0rL*{uOZDOzHa!`OaeDhomIb4`ZuR-Hl=K|8J1A{B>S`@%yS3DjM_k!#^&$jy!@Aa{OFZ2$ z9o_LEv}RUAU^TBnFR9j~J{*sw0p1v*fX&mYkyezOxUJqGEIH5L(BVc==y*&~rJ-Bh zX~6>4ZVf}`0qr#nh6pl$;mqW`0Ax+Ibg{;H5*sjrsWEQfUbF&l94(g-++fO3SdS95 zs{vgYuU)JUas7y9LEneCIqr8yH6PF_=S;KzwKOxD%XCiiVgrXp%#Z+A65uf9bPO7{ z5EYuPglwO7F?^sG)3|2Btx6)WDj-9hkLuX6>k+pa!^zZX6k663Y??*TfVR8r3|jh? zg{(;nm<+WXLju^TI84LXaWbPSO`XIHlByaw${BxD&f$g`@UuejIcKr47W9(UX~ztq z3h&CfKSN?imlVQ>icaRXgoU}v6h4jfcqVCh296?IZ-4-irnw0dE*1E?59H(o43gGr zzEx<1191sf{B)<60Z9UZ*+^*lD?gL#a)Hd(&P-4nX{yyhZwMAxB%oR*^if1uOsE8@ zSdEi(y9C5_77kYu1>$?jR@nmxMLI0j>$;+?5(~CYN`&n8-oF2X zv!7$ozrA_pz~OsOpL*gC_A-9)`vX7OFCE|WF!N2&k#8S-kT literal 1328 zcmZY5NvPZe0LF2(waOekD0)$Juqf#Gn#p96NhmF5wq&wRl9_B{L9@RkljS9uWD=n* z=s`iD6{}DzqF9Rv)e3qN1Z|NPr4>C1q7@H%5EpQPTDOCj=lz2p-(Pp_4LdT^D#^V# z+7qWPP=Jk%{mm@f+_0?<41-v6Nv2&*Xv#DOiixvS=Y+i`;kr}Cz;KomQ07aUV|OgB z>C#@oj3*0?#b7as1%cBhsKw(hBIz|X8c-=sO=ENwXp)ZuP@-G)z}>DXE0kh{ro^PI zm0(0CSawKtFoUXvV6lj@0+)~wE{A~OY_=EUL?lLH7dT|#VDrBzrkMn?@A^;}NWc`gjSp3xTyyzMQzi2;o&qr5rL0o!JjJrUibZY?MQgH^9g%0CL)DyUVS#N564UnChBp7LAiY4X3y{&1)!O2t` zDw;T_T3f)nT233#bV8d^*D~})N*b-w2XM{giD`~OJwh!ay}L%B+z?`BxhT zv3B9S5K4`1)Rdw-^A>@(ThWwNhJ2S`{SmnU6FwS^O^YeIVGU0}$Tkt8U(b7$Dv>oZ zhd0y7Fk9-4e1=J~MMG-A`m@<6Fh)jP;{VnrdV{@>q#JH(>zUoC=6ZpMWVzKJ7jET% z3dX5086b1xpYg^<6PCHeuyqIZ+mI!vR-JXTjB9HPd{V{WijF%yGj1=W!7OV$adG!= zPrh~A=_5D1f6wu+@9d3F?!C-@bNs%S5-hj?p4jJq@-bB&8~qu5|H0b2esbvQHOd=5 zzIcFt`MMT*6J@maJb(YGOTyh(c3pV;!6RpHzU%RWJKe9|eU(s8e|Z@5&K-ka35iSZ zoj-i^G;#0l*PmS+{CSsk^@U&l8sGQ;{o${#U4HCy=FO)LoOpD<`0efP&huy7AKv-n wmWxLp+HvUQvFO4xXIj^ud-c1Ip8Mic {}; lib = pkgs.lib; readPubkeys = user: builtins.filter (k: k != "") (lib.splitString "\n" (builtins.readFile (../pubkeys + "/${user}.keys"))); - superadmins = (readPubkeys "raito") ++ (readPubkeys "gdd"); + superadmins = (readPubkeys "raito") ++ (readPubkeys "gdd") ++ (readPubkeys "mrf"); core-services-01 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILrnZxP4OUGDzd1uykMghzFNLH0Fg42hH+0qxif6O6oU"; systems = [ core-services-01 ]; in