chore(ops): Clean up old GCP infrastructure files
This removes almost all of the GCP-infrastructure leftovers from my previous setup. The DNS configuration is retained, but moves to my user folder instead. Change-Id: I1867acd379443882f11a3c645846c9902eadd5b0 Reviewed-on: https://cl.tvl.fyi/c/depot/+/782 Tested-by: BuildkiteCI Reviewed-by: eta <eta@theta.eu.org> Reviewed-by: isomer <isomer@tvl.fyi>
This commit is contained in:
Vincent Ambo
tazjin
parent
d3f9cb0ec3
commit
dc07977866
34 changed files with 0 additions and 648 deletions
|
|
@ -22,8 +22,6 @@ Twitter][].
|
|||
* `tools/cheddar` contains a source code and Markdown rendering tool
|
||||
that is integrated with my cgit instance to render files in various
|
||||
views
|
||||
* `ops/kms_pass.nix` is a tiny tool that emulates the user-interface of `pass`,
|
||||
but actually uses Google Cloud KMS for secret decryption
|
||||
* `ops/kontemplate` contains my Kubernetes resource templating tool (with which
|
||||
the services in this repository are deployed!)
|
||||
* `ops/besadii` contains a tool that runs as the git
|
||||
|
|
|
|||
|
|
@ -19,10 +19,6 @@ case "${TARGET_TOOL}" in
|
|||
stern)
|
||||
attr="third_party.stern"
|
||||
;;
|
||||
kms_pass)
|
||||
attr="ops.kms_pass"
|
||||
TARGET_TOOL="pass"
|
||||
;;
|
||||
aoc2019)
|
||||
attr="fun.aoc2019.${1}"
|
||||
;;
|
||||
|
|
|
|||
|
|
@ -1 +0,0 @@
|
|||
__dispatch.sh
|
||||
|
|
@ -61,7 +61,6 @@ in lib.fix (self: {
|
|||
depot.ops."posix_mq.rs"
|
||||
besadii
|
||||
journaldriver
|
||||
kms_pass
|
||||
kontemplate
|
||||
mq_cli
|
||||
];
|
||||
|
|
|
|||
|
|
@ -24,13 +24,6 @@ let
|
|||
# Pass third_party as 'pkgs' (for compatibility with external
|
||||
# imports for certain subdirectories)
|
||||
pkgs = depot.third_party;
|
||||
|
||||
kms = {
|
||||
project = "tazjins-infrastructure";
|
||||
region = "europe-north1";
|
||||
keyring = "tazjins-keys";
|
||||
key = "kontemplate-key";
|
||||
};
|
||||
};
|
||||
|
||||
readTree' = import ./nix/readTree {};
|
||||
|
|
|
|||
|
|
@ -1,2 +0,0 @@
|
|||
Code under //ops/infra is mostly configuration for other tools, not
|
||||
Nix derivations to be built.
|
||||
3
ops/infra/gcp/.gitignore
vendored
3
ops/infra/gcp/.gitignore
vendored
|
|
@ -1,3 +0,0 @@
|
|||
.terraform
|
||||
*.tfstate
|
||||
*.tfstate.backup
|
||||
|
|
@ -1,116 +0,0 @@
|
|||
# Terraform configuration for the GCP project 'tazjins-infrastructure'
|
||||
|
||||
provider "google" {
|
||||
project = "tazjins-infrastructure"
|
||||
region = "europe-north1"
|
||||
version = "~> 2.20"
|
||||
}
|
||||
|
||||
# Configure a storage bucket in which to keep Terraform state and
|
||||
# other data, such as Nixery's layers.
|
||||
resource "google_storage_bucket" "tazjins-data" {
|
||||
name = "tazjins-data"
|
||||
location = "EU"
|
||||
}
|
||||
|
||||
terraform {
|
||||
backend "gcs" {
|
||||
bucket = "tazjins-data"
|
||||
prefix = "terraform"
|
||||
}
|
||||
}
|
||||
|
||||
# Configure enabled APIs
|
||||
resource "google_project_services" "primary" {
|
||||
project = "tazjins-infrastructure"
|
||||
services = [
|
||||
"bigquery-json.googleapis.com",
|
||||
"bigquerystorage.googleapis.com",
|
||||
"cloudapis.googleapis.com",
|
||||
"cloudbuild.googleapis.com",
|
||||
"clouddebugger.googleapis.com",
|
||||
"cloudfunctions.googleapis.com",
|
||||
"cloudkms.googleapis.com",
|
||||
"cloudtrace.googleapis.com",
|
||||
"compute.googleapis.com",
|
||||
"container.googleapis.com",
|
||||
"containerregistry.googleapis.com",
|
||||
"datastore.googleapis.com",
|
||||
"distance-matrix-backend.googleapis.com",
|
||||
"dns.googleapis.com",
|
||||
"gmail.googleapis.com",
|
||||
"iam.googleapis.com",
|
||||
"iamcredentials.googleapis.com",
|
||||
"logging.googleapis.com",
|
||||
"monitoring.googleapis.com",
|
||||
"oslogin.googleapis.com",
|
||||
"pubsub.googleapis.com",
|
||||
"run.googleapis.com",
|
||||
"secretmanager.googleapis.com",
|
||||
"servicemanagement.googleapis.com",
|
||||
"serviceusage.googleapis.com",
|
||||
"sourcerepo.googleapis.com",
|
||||
"sql-component.googleapis.com",
|
||||
"storage-api.googleapis.com",
|
||||
"storage-component.googleapis.com",
|
||||
]
|
||||
}
|
||||
|
||||
|
||||
# Configure the main Kubernetes cluster in which services are deployed
|
||||
resource "google_container_cluster" "primary" {
|
||||
name = "tazjin-cluster"
|
||||
location = "europe-north1"
|
||||
|
||||
remove_default_node_pool = true
|
||||
initial_node_count = 1
|
||||
}
|
||||
|
||||
resource "google_container_node_pool" "primary_nodes" {
|
||||
name = "primary-nodes"
|
||||
location = "europe-north1"
|
||||
cluster = google_container_cluster.primary.name
|
||||
node_count = 1
|
||||
|
||||
node_config {
|
||||
preemptible = true
|
||||
machine_type = "n1-standard-2"
|
||||
|
||||
oauth_scopes = [
|
||||
"storage-rw",
|
||||
"logging-write",
|
||||
"monitoring",
|
||||
"https://www.googleapis.com/auth/source.read_only",
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
# Configure a service account for which GCS URL signing keys can be created.
|
||||
resource "google_service_account" "nixery" {
|
||||
account_id = "nixery"
|
||||
display_name = "Nixery service account"
|
||||
}
|
||||
|
||||
# Configure Cloud KMS for secret encryption
|
||||
resource "google_kms_key_ring" "tazjins_keys" {
|
||||
name = "tazjins-keys"
|
||||
location = "europe-north1"
|
||||
|
||||
lifecycle {
|
||||
prevent_destroy = true
|
||||
}
|
||||
}
|
||||
|
||||
resource "google_kms_crypto_key" "kontemplate_key" {
|
||||
name = "kontemplate-key"
|
||||
key_ring = google_kms_key_ring.tazjins_keys.id
|
||||
|
||||
lifecycle {
|
||||
prevent_destroy = true
|
||||
}
|
||||
}
|
||||
|
||||
# Configure the git repository that contains everything.
|
||||
resource "google_sourcerepo_repository" "depot" {
|
||||
name = "depot"
|
||||
}
|
||||
|
|
@ -1,80 +0,0 @@
|
|||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: gcsr-secrets
|
||||
type: Opaque
|
||||
data:
|
||||
username: "Z2l0LXRhemppbi5nbWFpbC5jb20="
|
||||
# This credential is a GCSR 'gitcookie' token.
|
||||
password: '{{ passLookup "gcsr-tazjin-password" | b64enc }}'
|
||||
# This credential is an OAuth token for builds.sr.ht
|
||||
sourcehut: '{{ passLookup "sr.ht-token" | b64enc }}'
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: cgit
|
||||
labels:
|
||||
app: cgit
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: cgit
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: cgit
|
||||
spec:
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
fsGroup: 1000
|
||||
containers:
|
||||
- name: cgit
|
||||
image: nixery.local/shell/web.cgit-taz:{{ gitHEAD }}
|
||||
command: [ "cgit-launch" ]
|
||||
env:
|
||||
- name: HOME
|
||||
value: /git
|
||||
volumeMounts:
|
||||
- name: git-volume
|
||||
mountPath: /git
|
||||
- name: sync-gcsr
|
||||
image: nixery.local/shell/ops.sync-gcsr:{{ gitHEAD }}
|
||||
command: [ "sync-gcsr" ]
|
||||
env:
|
||||
- name: SYNC_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: gcsr-secrets
|
||||
key: username
|
||||
- name: SYNC_PASS
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: gcsr-secrets
|
||||
key: password
|
||||
- name: SRHT_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: gcsr-secrets
|
||||
key: sourcehut
|
||||
volumeMounts:
|
||||
- name: git-volume
|
||||
mountPath: /git
|
||||
volumes:
|
||||
- name: git-volume
|
||||
emptyDir: {}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: cgit
|
||||
spec:
|
||||
selector:
|
||||
app: cgit
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 80
|
||||
targetPort: 8080
|
||||
|
|
@ -1,19 +0,0 @@
|
|||
(config :port 4242
|
||||
:data-dir "/var/lib/gemma/")
|
||||
|
||||
(deftask bathroom/wipe-mirror 7)
|
||||
(deftask bathroom/wipe-counter 7)
|
||||
|
||||
;; Bedroom tasks
|
||||
(deftask bedroom/change-sheets 7)
|
||||
(deftask bedroom/vacuum 10)
|
||||
|
||||
;; Kitchen tasks
|
||||
(deftask kitchen/normal-trash 3)
|
||||
(deftask kitchen/green-trash 5)
|
||||
(deftask kitchen/blue-trash 5)
|
||||
(deftask kitchen/wipe-counters 3)
|
||||
(deftask kitchen/vacuum 5 "Kitchen has more crumbs and such!")
|
||||
|
||||
;; Entire place
|
||||
(deftask clean-windows 60)
|
||||
|
|
@ -1,8 +0,0 @@
|
|||
---
|
||||
apiVersion: networking.gke.io/v1beta1
|
||||
kind: ManagedCertificate
|
||||
metadata:
|
||||
name: {{ .domain | replace "." "-" }}
|
||||
spec:
|
||||
domains:
|
||||
- {{ .domain }}
|
||||
|
|
@ -1,43 +0,0 @@
|
|||
# This resource configures the HTTPS load balancer that is used as the
|
||||
# entrypoint to all HTTPS services running in the cluster.
|
||||
---
|
||||
apiVersion: extensions/v1beta1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: https-ingress
|
||||
annotations:
|
||||
networking.gke.io/managed-certificates: tazj-in, git-tazj-in, www-tazj-in, oslo-pub
|
||||
spec:
|
||||
rules:
|
||||
# Route website to, well, the website ...
|
||||
- host: tazj.in
|
||||
http:
|
||||
paths:
|
||||
- path: /*
|
||||
backend:
|
||||
serviceName: website
|
||||
servicePort: 8080
|
||||
# Same for www.* (the redirect is handled by the website nginx)
|
||||
- host: www.tazj.in
|
||||
http:
|
||||
paths:
|
||||
- path: /*
|
||||
backend:
|
||||
serviceName: website
|
||||
servicePort: 8080
|
||||
# Route git.tazj.in to the cgit pods
|
||||
- host: git.tazj.in
|
||||
http:
|
||||
paths:
|
||||
- path: /*
|
||||
backend:
|
||||
serviceName: nginx
|
||||
servicePort: 6756
|
||||
# Route oslo.pub to the nginx instance which serves redirects
|
||||
- host: oslo.pub
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
backend:
|
||||
serviceName: nginx
|
||||
servicePort: 6756
|
||||
|
|
@ -1,59 +0,0 @@
|
|||
daemon off;
|
||||
worker_processes 1;
|
||||
error_log stderr;
|
||||
pid /run/nginx.pid;
|
||||
|
||||
events {
|
||||
worker_connections 1024;
|
||||
}
|
||||
|
||||
http {
|
||||
log_format json_combined escape=json
|
||||
'{'
|
||||
'"time_local":"$time_local",'
|
||||
'"remote_addr":"$remote_addr",'
|
||||
'"remote_user":"$remote_user",'
|
||||
'"request":"$request",'
|
||||
'"status": "$status",'
|
||||
'"body_bytes_sent":"$body_bytes_sent",'
|
||||
'"request_time":"$request_time",'
|
||||
'"http_referrer":"$http_referer",'
|
||||
'"http_user_agent":"$http_user_agent"'
|
||||
'}';
|
||||
|
||||
access_log /dev/stdout json_combined;
|
||||
|
||||
sendfile on;
|
||||
keepalive_timeout 65;
|
||||
|
||||
server {
|
||||
listen 80 default_server;
|
||||
location / {
|
||||
return 200 "ok";
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
server_name oslo.pub;
|
||||
|
||||
location / {
|
||||
return 302 https://www.google.com/maps/d/viewer?mid=1pJIYY9cuEdt9DuMTbb4etBVq7hs;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
server_name git.tazj.in;
|
||||
|
||||
# Static assets must always hit the root.
|
||||
location ~ ^/(favicon\.ico|cgit\.(css|png))$ {
|
||||
proxy_pass http://cgit;
|
||||
}
|
||||
|
||||
# Everything else hits the depot directly.
|
||||
location / {
|
||||
proxy_pass http://cgit/cgit.cgi/depot/;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -1,60 +0,0 @@
|
|||
# Deploy an nginx instance which serves ... redirects.
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: nginx-conf
|
||||
data:
|
||||
nginx.conf: {{ insertFile "nginx.conf" | toJson }}
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: nginx
|
||||
labels:
|
||||
app: nginx
|
||||
spec:
|
||||
replicas: 2
|
||||
selector:
|
||||
matchLabels:
|
||||
app: nginx
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: nginx
|
||||
config: {{ insertFile "nginx.conf" | sha1sum }}
|
||||
spec:
|
||||
containers:
|
||||
- name: nginx
|
||||
image: nixery.local/shell/third_party.nginx:{{ .version }}
|
||||
command: ["/bin/bash", "-c"]
|
||||
args:
|
||||
- |
|
||||
cd /run
|
||||
echo 'nogroup:x:30000:nobody' >> /etc/group
|
||||
echo 'nobody:x:30000:30000:nobody:/tmp:/bin/bash' >> /etc/passwd
|
||||
exec nginx -c /etc/nginx/nginx.conf
|
||||
volumeMounts:
|
||||
- name: nginx-conf
|
||||
mountPath: /etc/nginx
|
||||
- name: nginx-rundir
|
||||
mountPath: /run
|
||||
volumes:
|
||||
- name: nginx-conf
|
||||
configMap:
|
||||
name: nginx-conf
|
||||
- name: nginx-rundir
|
||||
emptyDir: {}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: nginx
|
||||
spec:
|
||||
type: NodePort
|
||||
selector:
|
||||
app: nginx
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 6756
|
||||
targetPort: 80
|
||||
|
|
@ -1,67 +0,0 @@
|
|||
# Deploys an instance of Nixery into the cluster.
|
||||
#
|
||||
# The service via which Nixery is exposed has a private DNS entry
|
||||
# pointing to it, which makes it possible to resolve `nixery.local`
|
||||
# in-cluster without things getting nasty.
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: nixery
|
||||
namespace: kube-public
|
||||
labels:
|
||||
app: nixery
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: nixery
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: nixery
|
||||
spec:
|
||||
containers:
|
||||
- name: nixery
|
||||
image: eu.gcr.io/tazjins-infrastructure/nixery:{{ .version }}
|
||||
volumeMounts:
|
||||
- name: nixery-secrets
|
||||
mountPath: /var/nixery
|
||||
env:
|
||||
- name: BUCKET
|
||||
value: {{ .bucket}}
|
||||
- name: PORT
|
||||
value: "{{ .port }}"
|
||||
- name: GOOGLE_APPLICATION_CREDENTIALS
|
||||
value: /var/nixery/gcs-key.json
|
||||
- name: GCS_SIGNING_KEY
|
||||
value: /var/nixery/gcs-key.pem
|
||||
- name: GCS_SIGNING_ACCOUNT
|
||||
value: {{ .account }}
|
||||
- name: GIT_SSH_COMMAND
|
||||
value: 'ssh -F /var/nixery/ssh_config'
|
||||
- name: NIXERY_PKGS_REPO
|
||||
value: {{ .repo }}
|
||||
- name: NIX_POPULARITY_URL
|
||||
value: 'https://storage.googleapis.com/nixery-layers/popularity/{{ .popularity }}'
|
||||
volumes:
|
||||
- name: nixery-secrets
|
||||
secret:
|
||||
secretName: nixery-secrets
|
||||
defaultMode: 256
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: nixery
|
||||
namespace: kube-public
|
||||
annotations:
|
||||
cloud.google.com/load-balancer-type: "Internal"
|
||||
spec:
|
||||
selector:
|
||||
app: nixery
|
||||
type: LoadBalancer
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 80
|
||||
targetPort: 8080
|
||||
|
|
@ -1 +0,0 @@
|
|||
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCzBM6ydst77jDHNcTFWKD9Fw4SReqyNEEp2MtQBk2wt94U4yLp8MQIuNeOEn1GaDEX4RGCxqai/2UVF1w9ZNdU+v2fXcKWfkKuGQH2XcNfXor2cVNObd40H78++iZiv3nmM/NaEdkTbTBbi925cRy9u5FgItDgsJlyKNRglCb0fr6KlgpvWjL20dp/eeZ8a/gLniHK8PnEsgERQSvJnsyFpxxVhxtoUiyLWpXDl4npf/rQr0eRDf4Q5sN/nbTwksapPHfze8dKcaoA7A2NqT3bJ6DPGrwVCzGRtGw/SXJwFwmmtAl9O6BklpeReyiknSxc+KOtrjDW6O0r6yvymD5Z nixery
|
||||
|
|
@ -1,3 +0,0 @@
|
|||
github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==
|
||||
140.82.118.4 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==
|
||||
[source.developers.google.com]:2022,[172.253.120.82]:2022 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBB5Iy4/cq/gt/fPqe3uyMy4jwv1Alc94yVPxmnwNhBzJqEV5gRPiRk5u4/JJMbbu9QUVAguBABxL7sBZa5PH/xY=
|
||||
|
|
@ -1,18 +0,0 @@
|
|||
# The secrets below are encrypted using keys stored in Cloud KMS and
|
||||
# templated in by kontemplate when deploying.
|
||||
#
|
||||
# Not all of the values are actually secret (see the matching)
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: nixery-secrets
|
||||
namespace: kube-public
|
||||
type: Opaque
|
||||
data:
|
||||
gcs-key.json: {{ passLookup "nixery-gcs-json" | b64enc }}
|
||||
gcs-key.pem: {{ passLookup "nixery-gcs-pem" | b64enc }}
|
||||
id_nixery: {{ printf "%s\n" (passLookup "nixery-ssh-private") | b64enc }}
|
||||
id_nixery.pub: {{ insertFile "id_nixery.pub" | b64enc }}
|
||||
known_hosts: {{ insertFile "known_hosts" | b64enc }}
|
||||
ssh_config: {{ insertFile "ssh_config" | b64enc }}
|
||||
|
|
@ -1,4 +0,0 @@
|
|||
Match host *
|
||||
User tazjin@google.com
|
||||
IdentityFile /var/nixery/id_nixery
|
||||
UserKnownHostsFile /var/nixery/known_hosts
|
||||
|
|
@ -1,38 +0,0 @@
|
|||
# Kontemplate configuration for the primary GKE cluster in the project
|
||||
# 'tazjins-infrastructure'.
|
||||
---
|
||||
context: gke_tazjins-infrastructure_europe-north1_tazjin-cluster
|
||||
include:
|
||||
# SSL certificates (provisioned by Google)
|
||||
- name: tazj-in-cert
|
||||
path: https-cert
|
||||
values:
|
||||
domain: tazj.in
|
||||
- name: www-tazj-in-cert
|
||||
path: https-cert
|
||||
values:
|
||||
domain: www.tazj.in
|
||||
- name: git-tazj-in-cert
|
||||
path: https-cert
|
||||
values:
|
||||
domain: git.tazj.in
|
||||
- name: oslo-pub-cert
|
||||
path: https-cert
|
||||
values:
|
||||
domain: oslo.pub
|
||||
|
||||
# Services
|
||||
- name: nixery
|
||||
values:
|
||||
port: 8080
|
||||
version: xkm36vrbcnzxdccybzdrx4qzfcfqfrhg
|
||||
bucket: tazjins-data
|
||||
account: nixery@tazjins-infrastructure.iam.gserviceaccount.com
|
||||
repo: ssh://tazjin@gmail.com@source.developers.google.com:2022/p/tazjins-infrastructure/r/depot
|
||||
popularity: 'popularity-nixos-unstable-3140fa89c51233397f496f49014f6b23216667c2.json'
|
||||
- name: website
|
||||
- name: cgit
|
||||
- name: https-lb
|
||||
- name: nginx
|
||||
values:
|
||||
version: a349d5e9145ae9a6c89f62ec631f01fb180de546
|
||||
|
|
@ -1,37 +0,0 @@
|
|||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: website
|
||||
labels:
|
||||
app: website
|
||||
spec:
|
||||
replicas: 3
|
||||
selector:
|
||||
matchLabels:
|
||||
app: website
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: website
|
||||
spec:
|
||||
containers:
|
||||
- name: website
|
||||
image: nixery.local/shell/web.homepage:{{ gitHEAD }}
|
||||
env:
|
||||
- name: CONTAINER_SETUP
|
||||
value: "true"
|
||||
command: [ "homepage" ]
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: website
|
||||
spec:
|
||||
type: NodePort
|
||||
selector:
|
||||
app: website
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 8080
|
||||
targetPort: 8080
|
||||
|
|
@ -1,61 +0,0 @@
|
|||
# This tool mimics a subset of the interface of 'pass', but uses
|
||||
# Google Cloud KMS for encryption.
|
||||
#
|
||||
# It is intended to be compatible with how 'kontemplate' invokes
|
||||
# 'pass.'
|
||||
#
|
||||
# Only the 'show' and 'insert' commands are supported.
|
||||
|
||||
{ depot, kms, ... }:
|
||||
|
||||
let inherit (depot.third_party) google-cloud-sdk tree writeShellScriptBin;
|
||||
in (writeShellScriptBin "pass" ''
|
||||
set -eo pipefail
|
||||
|
||||
CMD="$1"
|
||||
readonly SECRET=$2
|
||||
readonly SECRETS_DIR=${./secrets}
|
||||
readonly SECRET_PATH="$SECRETS_DIR/$SECRET"
|
||||
|
||||
function secret_check {
|
||||
if [[ -z $SECRET ]]; then
|
||||
echo 'Secret must be specified'
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
if [[ -z $CMD ]]; then
|
||||
CMD="ls"
|
||||
fi
|
||||
|
||||
case "$CMD" in
|
||||
ls)
|
||||
${tree}/bin/tree $SECRETS_DIR
|
||||
;;
|
||||
show)
|
||||
secret_check
|
||||
${google-cloud-sdk}/bin/gcloud kms decrypt \
|
||||
--project ${kms.project} \
|
||||
--location ${kms.region} \
|
||||
--keyring ${kms.keyring} \
|
||||
--key ${kms.key} \
|
||||
--ciphertext-file $SECRET_PATH \
|
||||
--plaintext-file -
|
||||
;;
|
||||
insert)
|
||||
secret_check
|
||||
${google-cloud-sdk}/bin/gcloud kms encrypt \
|
||||
--project ${kms.project} \
|
||||
--location ${kms.region} \
|
||||
--keyring ${kms.keyring} \
|
||||
--key ${kms.key} \
|
||||
--ciphertext-file $SECRET_PATH \
|
||||
--plaintext-file -
|
||||
echo "Inserted secret '$SECRET'"
|
||||
;;
|
||||
*)
|
||||
echo "Usage: pass show/insert <secret>"
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
'') // { meta.enableCI = true; }
|
||||
|
|
@ -1 +0,0 @@
|
|||
No Nix derivations under //ops/secrets
|
||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
|
|
@ -1,13 +0,0 @@
|
|||
{ depot, ... }:
|
||||
|
||||
with depot;
|
||||
|
||||
third_party.writeShellScriptBin "kontemplate" ''
|
||||
export PATH="${ops.kms_pass}/bin:$PATH"
|
||||
|
||||
if [[ -z $1 ]]; then
|
||||
exec ${ops.kontemplate}/bin/kontemplate
|
||||
fi
|
||||
|
||||
exec ${ops.kontemplate}/bin/kontemplate $1 ${./../..}/ops/infra/kubernetes/primary-cluster.yaml ''${@:2}
|
||||
''
|
||||
Loading…
Reference in a new issue