pub-solar/infra
6
1
Fork 3
Code Issues 23 Pull requests 10 Actions Packages Projects 1 Releases Wiki Activity
infra/secrets/secrets.nix

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

126 lines
6.4 KiB
Nix
Raw Permalink Normal View History

Merge pull request 'feature/pub-solar-website' (#20) from feature/pub-solar-website into main Reviewed-on: https://git.pub.solar/pub-solar/infra-new/pulls/20
2023-10-28 14:45:30 +00:00
let
wireguard: initial commit
2024-04-03 18:54:40 +00:00
admins = import ../logins/admins.nix;
Merge pull request 'feature/pub-solar-website' (#20) from feature/pub-solar-website into main Reviewed-on: https://git.pub.solar/pub-solar/infra-new/pulls/20
2023-10-28 14:45:30 +00:00
nachtigall-host = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP7G0ufi+MNvaAZLDgpieHrABPGN7e/kD5kMFwSk4ABj root@nachtigall";
initial work on mail
2024-05-22 19:49:34 +00:00
metronom-host = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICLX6UvvrKALKL0xsNnytLPHryzZF5evUnxAgGokf14i root@metronom";
ci: add self-hosted forgejo-actions-runner wip: add git.pub.solar to /etc/hosts ci: add devshell with Node.js for forgejo actions ci: add PATH ci: add HOME
2024-05-29 15:45:23 +00:00
tankstelle-host = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJdF6cJKPDiloWiDja1ZtqkXDdXOCHPs10HD+JMzgeU4 root@tankstelle";
garage: init module
2024-08-24 01:05:16 +00:00
trinkgenossin-host = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDZXRDpom/LtyoCxvRuoONARKxIT6wNUwEyUjzHRE7DG root@trinkgenossin";
delite-host = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAKo7zlfQhcJ5/okFTOoOstZtmEL1iNlHxQ4q2baEcWT root@delite";
blue-shell-host = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP9g9X0a/MaVtbh44IeLxcq+McuYec0GYAdLsseBpk5f root@blue-shell";
matrix-authentication-service: init host underground to test mas, related to #242
2024-10-26 00:03:31 +00:00
underground-host = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGF3PtA89yhVkmN7aJI6gqXK8DW9L7kI71IgiK4TAEwI root@underground";
Merge pull request 'feature/pub-solar-website' (#20) from feature/pub-solar-website into main Reviewed-on: https://git.pub.solar/pub-solar/infra-new/pulls/20
2023-10-28 14:45:30 +00:00
wireguard: initial commit
2024-04-03 18:54:40 +00:00
adminKeys = builtins.foldl' (
keys: login: keys ++ (builtins.attrValues login.secretEncryptionKeys)
) [ ] (builtins.attrValues admins);
Merge pull request 'feature/pub-solar-website' (#20) from feature/pub-solar-website into main Reviewed-on: https://git.pub.solar/pub-solar/infra-new/pulls/20
2023-10-28 14:45:30 +00:00
nachtigallKeys = [ nachtigall-host ];
secrets: add drone, forgejo-actions-runner secrets and rekey
2023-11-06 20:28:37 +00:00
ci: add self-hosted forgejo-actions-runner wip: add git.pub.solar to /etc/hosts ci: add devshell with Node.js for forgejo actions ci: add PATH ci: add HOME
2024-05-29 15:45:23 +00:00
tankstelleKeys = [ tankstelle-host ];
initial work on mail
2024-05-22 19:49:34 +00:00
metronomKeys = [ metronom-host ];
garage: init module
2024-08-24 01:05:16 +00:00
wireguard: add trinkgenossin, delite, blue-shell
2024-08-24 22:13:53 +00:00
trinkgenossinKeys = [ trinkgenossin-host ];
deliteKeys = [ delite-host ];
blueshellKeys = [ blue-shell-host ];
matrix-authentication-service: init host underground to test mas, related to #242
2024-10-26 00:03:31 +00:00
undergroundKeys = [ underground-host ];
style: format using nixfmt-rfc-style
2024-08-24 15:39:49 +00:00
garageKeys = [
trinkgenossin-host
delite-host
blue-shell-host
];
Merge pull request 'feature/pub-solar-website' (#20) from feature/pub-solar-website into main Reviewed-on: https://git.pub.solar/pub-solar/infra-new/pulls/20
2023-10-28 14:45:30 +00:00
in
{
feat: add declarative root ssh key on nachtigall
2023-11-05 18:35:37 +00:00
# ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBB5XaH02a6+TchnyQED2VwaltPgeFCbildbE2h6nF5e root@nachtigall
wireguard: initial commit
2024-04-03 18:54:40 +00:00
"nachtigall-root-ssh-key.age".publicKeys = nachtigallKeys ++ adminKeys;
mail: add backups to garage bucket + storagebox Restic backups to garage S3 bucket metronom-backups
2024-08-25 01:45:53 +00:00
# ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPDeKXqbhNzbXk15h2k8wGBByxMDCC6HE1/fwa4j6ECu root@metronom
"metronom-root-ssh-key.age".publicKeys = metronomKeys ++ adminKeys;
wireguard: initial commit
2024-04-03 18:54:40 +00:00
"nachtigall-wg-private-key.age".publicKeys = nachtigallKeys ++ adminKeys;
tankstelle: configure wireguard
2024-05-30 17:17:21 +00:00
"tankstelle-wg-private-key.age".publicKeys = tankstelleKeys ++ adminKeys;
initial work on mail
2024-05-22 19:49:34 +00:00
"metronom-wg-private-key.age".publicKeys = metronomKeys ++ adminKeys;
wireguard: add trinkgenossin, delite, blue-shell
2024-08-24 22:13:53 +00:00
"trinkgenossin-wg-private-key.age".publicKeys = trinkgenossinKeys ++ adminKeys;
"delite-wg-private-key.age".publicKeys = deliteKeys ++ adminKeys;
"blue-shell-wg-private-key.age".publicKeys = blueshellKeys ++ adminKeys;
feat: add declarative root ssh key on nachtigall
2023-11-05 18:35:37 +00:00
mastodon: update to version 4.3.0 from nixos-unstable https://github.com/mastodon/mastodon/releases/tag/v4.3.0 https://github.com/NixOS/nixpkgs/pull/337545/files
2024-10-15 21:16:34 +00:00
"mastodon-active-record-encryption-deterministic-key.age".publicKeys = nachtigallKeys ++ adminKeys;
style: fix formatting
2024-10-16 09:37:10 +00:00
"mastodon-active-record-encryption-key-derivation-salt.age".publicKeys =
nachtigallKeys ++ adminKeys;
mastodon: update to version 4.3.0 from nixos-unstable https://github.com/mastodon/mastodon/releases/tag/v4.3.0 https://github.com/NixOS/nixpkgs/pull/337545/files
2024-10-15 21:16:34 +00:00
"mastodon-active-record-encryption-primary-key.age".publicKeys = nachtigallKeys ++ adminKeys;
wireguard: initial commit
2024-04-03 18:54:40 +00:00
"mastodon-secret-key-base.age".publicKeys = nachtigallKeys ++ adminKeys;
"mastodon-otp-secret.age".publicKeys = nachtigallKeys ++ adminKeys;
"mastodon-vapid-private-key.age".publicKeys = nachtigallKeys ++ adminKeys;
"mastodon-vapid-public-key.age".publicKeys = nachtigallKeys ++ adminKeys;
"mastodon-smtp-password.age".publicKeys = nachtigallKeys ++ adminKeys;
"mastodon-extra-env-secrets.age".publicKeys = nachtigallKeys ++ adminKeys;
feat: add keycloak secrets and virtualhost
2023-10-28 19:28:01 +00:00
wireguard: initial commit
2024-04-03 18:54:40 +00:00
"keycloak-database-password.age".publicKeys = nachtigallKeys ++ adminKeys;
feat: add forgejo
2023-10-28 19:46:18 +00:00
ci: add self-hosted forgejo-actions-runner wip: add git.pub.solar to /etc/hosts ci: add devshell with Node.js for forgejo actions ci: add PATH ci: add HOME
2024-05-29 15:45:23 +00:00
"tankstelle-forgejo-actions-runner-token.age".publicKeys = tankstelleKeys ++ adminKeys;
wireguard: initial commit
2024-04-03 18:54:40 +00:00
"forgejo-database-password.age".publicKeys = nachtigallKeys ++ adminKeys;
"forgejo-mailer-password.age".publicKeys = nachtigallKeys ++ adminKeys;
forgejo: make SSH keys declarative
2024-04-05 17:14:10 +00:00
"forgejo-ssh-private-key.age".publicKeys = nachtigallKeys ++ adminKeys;
nachtigall: Configure matrix-synapse with telegram integration
2023-10-28 00:21:34 +00:00
wireguard: initial commit
2024-04-03 18:54:40 +00:00
"matrix-mautrix-telegram-env-file.age".publicKeys = nachtigallKeys ++ adminKeys;
modules/matrix: rename secrets to not include hostnames
2024-10-30 16:14:47 +00:00
"matrix-synapse-signing-key.age".publicKeys = nachtigallKeys ++ adminKeys;
"matrix-synapse-secret-config.yaml.age".publicKeys = nachtigallKeys ++ adminKeys;
"matrix-synapse-sliding-sync-secret.age".publicKeys = nachtigallKeys ++ adminKeys;
mas: move to module, add secrets for prod
2024-10-30 16:57:33 +00:00
"matrix-authentication-service-secret-config.yml.age".publicKeys = nachtigallKeys ++ adminKeys;
matrix-authentication-service: init host underground to test mas, related to #242
2024-10-26 00:03:31 +00:00
modules/matrix: rename secrets to not include hostnames
2024-10-30 16:14:47 +00:00
"staging-matrix-synapse-secret-config.yaml.age".publicKeys = undergroundKeys ++ adminKeys;
"staging-matrix-authentication-service-secret-config.yml.age".publicKeys =
style: fix formatting
2024-10-27 16:28:20 +00:00
undergroundKeys ++ adminKeys;
feat: add nextcloud secrets
2023-10-28 16:53:02 +00:00
wireguard: initial commit
2024-04-03 18:54:40 +00:00
"nextcloud-secrets.age".publicKeys = nachtigallKeys ++ adminKeys;
"nextcloud-admin-pass.age".publicKeys = nachtigallKeys ++ adminKeys;
fix: add searx secret key
2023-10-29 14:38:44 +00:00
wireguard: initial commit
2024-04-03 18:54:40 +00:00
"searx-environment.age".publicKeys = nachtigallKeys ++ adminKeys;
feat: droppie backups for all nachtigall services
2023-11-05 21:54:09 +00:00
mail: add backups to garage bucket + storagebox Restic backups to garage S3 bucket metronom-backups
2024-08-25 01:45:53 +00:00
"restic-repo-garage-metronom.age".publicKeys = metronomKeys ++ adminKeys;
"restic-repo-garage-metronom-env.age".publicKeys = metronomKeys ++ adminKeys;
wireguard: initial commit
2024-04-03 18:54:40 +00:00
"restic-repo-droppie.age".publicKeys = nachtigallKeys ++ adminKeys;
secrets: rename restic-repo-storagebox{,-nachtigall} To use a restic repository per host
2024-08-29 14:22:58 +00:00
"restic-repo-storagebox-nachtigall.age".publicKeys = nachtigallKeys ++ adminKeys;
mail: add backups to garage bucket + storagebox Restic backups to garage S3 bucket metronom-backups
2024-08-25 01:45:53 +00:00
"restic-repo-storagebox-metronom.age".publicKeys = metronomKeys ++ adminKeys;
mediawiki: add backups to garage bucket + storagebox Restic backups to garage S3 bucket nachtigall-backups https://garagehq.deuxfleurs.fr/documentation/connect/backup/#restic
2024-08-28 15:10:17 +00:00
"restic-repo-garage-nachtigall.age".publicKeys = nachtigallKeys ++ adminKeys;
"restic-repo-garage-nachtigall-env.age".publicKeys = nachtigallKeys ++ adminKeys;
secrets: add drone, forgejo-actions-runner secrets and rekey
2023-11-06 20:28:37 +00:00
wireguard: initial commit
2024-04-03 18:54:40 +00:00
"mediawiki-database-password.age".publicKeys = nachtigallKeys ++ adminKeys;
"mediawiki-admin-password.age".publicKeys = nachtigallKeys ++ adminKeys;
"mediawiki-oidc-client-secret.age".publicKeys = nachtigallKeys ++ adminKeys;
"mediawiki-secret-key.age".publicKeys = nachtigallKeys ++ adminKeys;
nachtigall: Deploy coturn and configure matrix to use it
2023-11-19 16:22:09 +00:00
coturn: fix secret path this is fallout that was overlooked in #250
2024-11-13 20:25:12 +00:00
"coturn-static-auth-secret.age".publicKeys = nachtigallKeys ++ adminKeys;
feat(flora-6): init grafana + prometheus on grafana.pub.solar
2023-12-03 13:19:30 +00:00
flora-6: remove This commit removes the flora-6 host. All services are moved to trinkgenossin, with the drone service being removed completely in favour of forgejo actions.
2024-09-09 15:22:57 +00:00
"grafana-admin-password.age".publicKeys = trinkgenossinKeys ++ adminKeys;
"grafana-keycloak-client-secret.age".publicKeys = trinkgenossinKeys ++ adminKeys;
"grafana-smtp-password.age".publicKeys = trinkgenossinKeys ++ adminKeys;
feat(prometheus): add node-exporter to nachtigall, protect endpoint https://nachtigall.pub.solar/metrics with TLS and basic auth
2023-12-06 18:11:45 +00:00
flora-6: remove This commit removes the flora-6 host. All services are moved to trinkgenossin, with the drone service being removed completely in favour of forgejo actions.
2024-09-09 15:22:57 +00:00
"alertmanager-envfile.age".publicKeys = trinkgenossinKeys ++ adminKeys;
obs-portal: init obs-portal on nachtigall This follows the official installation instructions at https://github.com/openbikesensor/portal/blob/main/docs/production-deployment.md Unfortunately, the postgres database needs to have postgis enabled, so we'll have to start a second instance. To stay close to the official deployment instructions, this is running in docker. The secrets were taken from the old installation instance. During initial installation, we'll need to import data from the old instance into this one, which might take a while.
2024-02-22 18:20:24 +00:00
"obs-portal-env.age".publicKeys = nachtigallKeys ++ adminKeys;
"obs-portal-database-env.age".publicKeys = nachtigallKeys ++ adminKeys;
initial work on mail
2024-05-22 19:49:34 +00:00
secrets: rekey for nachtigalls tt-rss secrets
2024-07-17 16:49:36 +00:00
"tt-rss-feed-crypt-key.age".publicKeys = nachtigallKeys ++ adminKeys;
"tt-rss-keycloak-client-secret.age".publicKeys = nachtigallKeys ++ adminKeys;
"tt-rss-smtp-password.age".publicKeys = nachtigallKeys ++ adminKeys;
"tt-rss-database-password.age".publicKeys = nachtigallKeys ++ adminKeys;
tt-rss: add pub.solar specific configuration
2024-07-17 11:12:57 +00:00
initial work on mail
2024-05-22 19:49:34 +00:00
# mail
"mail/hensoko.age".publicKeys = metronomKeys ++ adminKeys;
mail: add more @pub.solar mail accounts
2024-05-25 15:24:42 +00:00
"mail/teutat3s.age".publicKeys = metronomKeys ++ adminKeys;
"mail/admins.age".publicKeys = metronomKeys ++ adminKeys;
"mail/bot.age".publicKeys = metronomKeys ++ adminKeys;
"mail/crew.age".publicKeys = metronomKeys ++ adminKeys;
"mail/erpnext.age".publicKeys = metronomKeys ++ adminKeys;
"mail/hakkonaut.age".publicKeys = metronomKeys ++ adminKeys;
garage: init module
2024-08-24 01:05:16 +00:00
# garage
"garage-rpc-secret.age".publicKeys = garageKeys ++ adminKeys;
"garage-admin-token.age".publicKeys = garageKeys ++ adminKeys;
garage: init buckets.pub.solar, use nginx as reverse proxy https://garagehq.deuxfleurs.fr/documentation/cookbook/reverse-proxy/
2024-08-24 19:48:48 +00:00
"acme-namecheap-env.age".publicKeys = garageKeys ++ adminKeys;
Merge pull request 'feature/pub-solar-website' (#20) from feature/pub-solar-website into main Reviewed-on: https://git.pub.solar/pub-solar/infra-new/pulls/20
2023-10-28 14:45:30 +00:00
}
Reference in a new issue Copy permalink