pub-solar/infra
6
1
Fork 3
Code Issues 20 Pull requests 9 Actions Packages Projects 1 Releases Wiki Activity
infra/secrets/secrets.nix

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

72 lines
3.4 KiB
Nix
Raw Permalink Normal View History

Merge pull request 'feature/pub-solar-website' (#20) from feature/pub-solar-website into main Reviewed-on: https://git.pub.solar/pub-solar/infra-new/pulls/20
2023-10-28 14:45:30 +00:00
let
wireguard: initial commit
2024-04-03 18:54:40 +00:00
admins = import ../logins/admins.nix;
Merge pull request 'feature/pub-solar-website' (#20) from feature/pub-solar-website into main Reviewed-on: https://git.pub.solar/pub-solar/infra-new/pulls/20
2023-10-28 14:45:30 +00:00
nachtigall-host = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP7G0ufi+MNvaAZLDgpieHrABPGN7e/kD5kMFwSk4ABj root@nachtigall";
secrets: add drone, forgejo-actions-runner secrets and rekey
2023-11-06 20:28:37 +00:00
flora-6-host = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGP1InpTBN4AlF/4V8HHumAMLJzeO8DpzjUv9Co/+J09 root@flora-6";
Merge pull request 'feature/pub-solar-website' (#20) from feature/pub-solar-website into main Reviewed-on: https://git.pub.solar/pub-solar/infra-new/pulls/20
2023-10-28 14:45:30 +00:00
wireguard: initial commit
2024-04-03 18:54:40 +00:00
adminKeys = builtins.foldl' (keys: login: keys ++ (builtins.attrValues login.secretEncryptionKeys)) [] (builtins.attrValues admins);
Merge pull request 'feature/pub-solar-website' (#20) from feature/pub-solar-website into main Reviewed-on: https://git.pub.solar/pub-solar/infra-new/pulls/20
2023-10-28 14:45:30 +00:00
nachtigallKeys = [
nachtigall-host
];
secrets: add drone, forgejo-actions-runner secrets and rekey
2023-11-06 20:28:37 +00:00
flora6Keys = [
flora-6-host
];
Merge pull request 'feature/pub-solar-website' (#20) from feature/pub-solar-website into main Reviewed-on: https://git.pub.solar/pub-solar/infra-new/pulls/20
2023-10-28 14:45:30 +00:00
in
{
feat: add declarative root ssh key on nachtigall
2023-11-05 18:35:37 +00:00
# ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBB5XaH02a6+TchnyQED2VwaltPgeFCbildbE2h6nF5e root@nachtigall
wireguard: initial commit
2024-04-03 18:54:40 +00:00
"nachtigall-root-ssh-key.age".publicKeys = nachtigallKeys ++ adminKeys;
"nachtigall-wg-private-key.age".publicKeys = nachtigallKeys ++ adminKeys;
"flora6-wg-private-key.age".publicKeys = flora6Keys ++ adminKeys;
feat: add declarative root ssh key on nachtigall
2023-11-05 18:35:37 +00:00
wireguard: initial commit
2024-04-03 18:54:40 +00:00
"mastodon-secret-key-base.age".publicKeys = nachtigallKeys ++ adminKeys;
"mastodon-otp-secret.age".publicKeys = nachtigallKeys ++ adminKeys;
"mastodon-vapid-private-key.age".publicKeys = nachtigallKeys ++ adminKeys;
"mastodon-vapid-public-key.age".publicKeys = nachtigallKeys ++ adminKeys;
"mastodon-smtp-password.age".publicKeys = nachtigallKeys ++ adminKeys;
"mastodon-extra-env-secrets.age".publicKeys = nachtigallKeys ++ adminKeys;
feat: add keycloak secrets and virtualhost
2023-10-28 19:28:01 +00:00
wireguard: initial commit
2024-04-03 18:54:40 +00:00
"keycloak-database-password.age".publicKeys = nachtigallKeys ++ adminKeys;
feat: add forgejo
2023-10-28 19:46:18 +00:00
wireguard: initial commit
2024-04-03 18:54:40 +00:00
"forgejo-actions-runner-token.age".publicKeys = flora6Keys ++ adminKeys;
"forgejo-database-password.age".publicKeys = nachtigallKeys ++ adminKeys;
"forgejo-mailer-password.age".publicKeys = nachtigallKeys ++ adminKeys;
forgejo: make SSH keys declarative
2024-04-05 17:14:10 +00:00
"forgejo-ssh-private-key.age".publicKeys = nachtigallKeys ++ adminKeys;
nachtigall: Configure matrix-synapse with telegram integration
2023-10-28 00:21:34 +00:00
wireguard: initial commit
2024-04-03 18:54:40 +00:00
"matrix-mautrix-telegram-env-file.age".publicKeys = nachtigallKeys ++ adminKeys;
"matrix-synapse-signing-key.age".publicKeys = nachtigallKeys ++ adminKeys;
"matrix-synapse-secret-config.yaml.age".publicKeys = nachtigallKeys ++ adminKeys;
"matrix-synapse-sliding-sync-secret.age".publicKeys = nachtigallKeys ++ adminKeys;
wip: matrix moderation
2024-02-06 11:20:41 +00:00
"matrix-mjolnir-password.age".publicKeys = nachtigallKeys ++ adminKeys;
feat: add nextcloud secrets
2023-10-28 16:53:02 +00:00
wireguard: initial commit
2024-04-03 18:54:40 +00:00
"nextcloud-secrets.age".publicKeys = nachtigallKeys ++ adminKeys;
"nextcloud-admin-pass.age".publicKeys = nachtigallKeys ++ adminKeys;
fix: add searx secret key
2023-10-29 14:38:44 +00:00
wireguard: initial commit
2024-04-03 18:54:40 +00:00
"searx-environment.age".publicKeys = nachtigallKeys ++ adminKeys;
feat: droppie backups for all nachtigall services
2023-11-05 21:54:09 +00:00
wireguard: initial commit
2024-04-03 18:54:40 +00:00
"restic-repo-droppie.age".publicKeys = nachtigallKeys ++ adminKeys;
"restic-repo-storagebox.age".publicKeys = nachtigallKeys ++ adminKeys;
secrets: add drone, forgejo-actions-runner secrets and rekey
2023-11-06 20:28:37 +00:00
wireguard: initial commit
2024-04-03 18:54:40 +00:00
"drone-db-secrets.age".publicKeys = flora6Keys ++ adminKeys;
"drone-secrets.age".publicKeys = flora6Keys ++ adminKeys;
feat: add mediawiki Co-authored-by: @teutat3s <teutates@mailbox.org>
2023-10-30 00:22:34 +00:00
wireguard: initial commit
2024-04-03 18:54:40 +00:00
"mediawiki-database-password.age".publicKeys = nachtigallKeys ++ adminKeys;
"mediawiki-admin-password.age".publicKeys = nachtigallKeys ++ adminKeys;
"mediawiki-oidc-client-secret.age".publicKeys = nachtigallKeys ++ adminKeys;
"mediawiki-secret-key.age".publicKeys = nachtigallKeys ++ adminKeys;
nachtigall: Deploy coturn and configure matrix to use it
2023-11-19 16:22:09 +00:00
wireguard: initial commit
2024-04-03 18:54:40 +00:00
"coturn-static-auth-secret.age".publicKeys = nachtigallKeys ++ adminKeys;
feat(flora-6): init grafana + prometheus on grafana.pub.solar
2023-12-03 13:19:30 +00:00
wireguard: initial commit
2024-04-03 18:54:40 +00:00
"grafana-admin-password.age".publicKeys = flora6Keys ++ adminKeys;
"grafana-keycloak-client-secret.age".publicKeys = flora6Keys ++ adminKeys;
"grafana-smtp-password.age".publicKeys = flora6Keys ++ adminKeys;
feat(prometheus): add node-exporter to nachtigall, protect endpoint https://nachtigall.pub.solar/metrics with TLS and basic auth
2023-12-06 18:11:45 +00:00
wireguard: initial commit
2024-04-03 18:54:40 +00:00
"nachtigall-metrics-nginx-basic-auth.age".publicKeys = nachtigallKeys ++ adminKeys;
"nachtigall-metrics-prometheus-basic-auth-password.age".publicKeys = flora6Keys ++ nachtigallKeys ++ adminKeys;
obs-portal: init obs-portal on nachtigall This follows the official installation instructions at https://github.com/openbikesensor/portal/blob/main/docs/production-deployment.md Unfortunately, the postgres database needs to have postgis enabled, so we'll have to start a second instance. To stay close to the official deployment instructions, this is running in docker. The secrets were taken from the old installation instance. During initial installation, we'll need to import data from the old instance into this one, which might take a while.
2024-02-22 18:20:24 +00:00
"obs-portal-env.age".publicKeys = nachtigallKeys ++ adminKeys;
"obs-portal-database-env.age".publicKeys = nachtigallKeys ++ adminKeys;
Merge pull request 'feature/pub-solar-website' (#20) from feature/pub-solar-website into main Reviewed-on: https://git.pub.solar/pub-solar/infra-new/pulls/20
2023-10-28 14:45:30 +00:00
}
Reference in a new issue Copy permalink