feat(grfn/mugwump): Set up agenix
Start setting up agenix with secrets in //users/grfn/secrets for mugwump, starting with my cloudflare API key which I use for the ddns from my home apartment Change-Id: Ida66cb91da3415357a512039d6c23402f0ae9388 Reviewed-on: https://cl.tvl.fyi/c/depot/+/4683 Reviewed-by: grfn <grfn@gws.fyi> Autosubmit: grfn <grfn@gws.fyi> Tested-by: BuildkiteCI
This commit is contained in:
parent
ef62e51b7b
commit
169d7fb874
6 changed files with 37 additions and 2 deletions
1
users/grfn/secrets/.envrc
Normal file
1
users/grfn/secrets/.envrc
Normal file
|
@ -0,0 +1 @@
|
||||||
|
eval "$(lorri direnv)"
|
9
users/grfn/secrets/cloudflare.age
Normal file
9
users/grfn/secrets/cloudflare.age
Normal file
|
@ -0,0 +1,9 @@
|
||||||
|
age-encryption.org/v1
|
||||||
|
-> ssh-ed25519 CpJBgQ w4W+pzmVIEMF0uZN7KZMAppJaLjEeDKoe7i9LGayKDQ
|
||||||
|
Rd8k+3csmbZQIrp09ZUfCAOZVwI0BZ6hCBN3nkZQMp4
|
||||||
|
-> ssh-ed25519 LfBFbQ dyv1splvcftMd1zWDkPBfsgvXxH5neZlO7ZjrhyzNHI
|
||||||
|
N/kqc/luOl8lsZcbaxF8/3ULsL78zvZhkiCarohe+G4
|
||||||
|
-> \w7t-grease lo&b JZpCA
|
||||||
|
nN2lH0W9+zulMjZMLPMk61+xsrQ
|
||||||
|
--- voTpUbu8OiJQyuKB7tIOvlErgY0jg2w7N3MehD5FIdM
|
||||||
|
&cŽz“læ Î|Kœ<4B>M<EFBFBD>~<7E>®2àe¢ºÐ¨°úUN8“Pâ~}Ý*ÇhÞÁêSYJJÇØÁFÉŠâoºÂc=ˆL<CB86>û`z«“ŽO7€ùòËK—ÖgZ”ÝÛÕ¿.ÎaXDÚHЦ€ýÙ8„7½ÙÉÌþã–ó8
|
2
users/grfn/secrets/default.nix
Normal file
2
users/grfn/secrets/default.nix
Normal file
|
@ -0,0 +1,2 @@
|
||||||
|
{ depot, ... }:
|
||||||
|
depot.ops.secrets.mkSecrets ./. (import ./secrets.nix)
|
8
users/grfn/secrets/secrets.nix
Normal file
8
users/grfn/secrets/secrets.nix
Normal file
|
@ -0,0 +1,8 @@
|
||||||
|
let
|
||||||
|
grfn = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMcBGBoWd5pPIIQQP52rcFOQN3wAY0J/+K2fuU6SffjA";
|
||||||
|
mugwump = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFE2fxPgWO+zeQoLBTgsgxP7Vg7QNHlrQ+Rb3fHFTomB";
|
||||||
|
in
|
||||||
|
|
||||||
|
{
|
||||||
|
"cloudflare.age".publicKeys = [ grfn mugwump ];
|
||||||
|
}
|
8
users/grfn/secrets/shell.nix
Normal file
8
users/grfn/secrets/shell.nix
Normal file
|
@ -0,0 +1,8 @@
|
||||||
|
let
|
||||||
|
depot = import ../../.. {};
|
||||||
|
in
|
||||||
|
depot.third_party.nixpkgs.mkShell {
|
||||||
|
buildInputs = [
|
||||||
|
depot.third_party.agenix.cli
|
||||||
|
];
|
||||||
|
}
|
|
@ -8,6 +8,7 @@ with lib;
|
||||||
(modulesPath + "/installer/scan/not-detected.nix")
|
(modulesPath + "/installer/scan/not-detected.nix")
|
||||||
"${depot.path}/ops/modules/prometheus-fail2ban-exporter.nix"
|
"${depot.path}/ops/modules/prometheus-fail2ban-exporter.nix"
|
||||||
"${depot.path}/users/grfn/xanthous/server/module.nix"
|
"${depot.path}/users/grfn/xanthous/server/module.nix"
|
||||||
|
"${depot.third_party.agenix.src}/modules/age.nix"
|
||||||
];
|
];
|
||||||
|
|
||||||
networking.hostName = "mugwump";
|
networking.hostName = "mugwump";
|
||||||
|
@ -64,6 +65,12 @@ with lib;
|
||||||
|
|
||||||
nix.gc.dates = "monthly";
|
nix.gc.dates = "monthly";
|
||||||
|
|
||||||
|
age.secrets = let
|
||||||
|
secret = name: depot.users.grfn.secrets."${name}.age";
|
||||||
|
in {
|
||||||
|
cloudflare.file = secret "cloudflare";
|
||||||
|
};
|
||||||
|
|
||||||
services.depot.auto-deploy = {
|
services.depot.auto-deploy = {
|
||||||
enable = true;
|
enable = true;
|
||||||
interval = "1d";
|
interval = "1d";
|
||||||
|
@ -132,7 +139,7 @@ with lib;
|
||||||
};
|
};
|
||||||
|
|
||||||
systemd.services.ddclient.serviceConfig = {
|
systemd.services.ddclient.serviceConfig = {
|
||||||
EnvironmentFile = "/etc/secrets/cloudflare.env";
|
EnvironmentFile = "/run/agenix/cloudflare";
|
||||||
DynamicUser = lib.mkForce false;
|
DynamicUser = lib.mkForce false;
|
||||||
ExecStart = lib.mkForce (
|
ExecStart = lib.mkForce (
|
||||||
let runtimeDir =
|
let runtimeDir =
|
||||||
|
@ -149,7 +156,7 @@ with lib;
|
||||||
|
|
||||||
security.acme.certs."metrics.gws.fyi" = {
|
security.acme.certs."metrics.gws.fyi" = {
|
||||||
dnsProvider = "cloudflare";
|
dnsProvider = "cloudflare";
|
||||||
credentialsFile = "/etc/secrets/cloudflare.env";
|
credentialsFile = "/run/agenix/cloudflare";
|
||||||
webroot = mkForce null;
|
webroot = mkForce null;
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue