Compare commits

...
Sign in to create a new pull request.

49 commits

Author SHA1 Message Date
5c894c5265
Rekey agenix secrets 2023-04-25 12:10:02 +02:00
a5061b8947
secrets: add host keys for hensoko 2023-04-25 10:18:54 +02:00
41939956c5
secrets: add host keys for b12f + teutat3s 2023-04-25 10:14:46 +02:00
b55dace1ea
Merge branch 'momo/main' into momo/keycloak 2023-04-25 09:49:13 +02:00
9efce1619a
Merge pull request 'host_001_momo_koeln: fix swap UUID and initrd boot modules' () from momo/fix-swap-uuid into momo/main
Reviewed-on: 
Reviewed-by: hensoko <hensoko@gssws.de>
2023-04-24 18:02:29 +02:00
db53f9f1be
host_001_momo_koeln: fix initrd kernelModules
boot.initrd.kernelModules overrides boot.initrd.availableKernelModules
and forces the initrd to load only those modules. This leads to the host
being unbootable in this case because of missing required modules.
availableKernelModules is the correct place for desired modules.

This got fixed during a debugging session of hensoko and teutat3s, but
not implemented in nix code until now.
2023-04-24 13:13:12 +02:00
2692b2dc20
host_001_momo_koeln: fix swap UUID
This got changed while debugging boot failures on this host, by

re-creating swap.
2023-04-24 13:05:05 +02:00
211f1d16d0
Merge pull request 'momo/main: merge main branch' () from momo-merge-main into momo/main
Reviewed-on: 
Reviewed-by: b12f <hello@benjaminbaedorf.eu>
2023-04-24 12:50:47 +02:00
4faf4267a3
Merge branch 'main' into momo-merge-main 2023-04-18 10:45:27 +02:00
4c4c4cab0b
secrets: Add keycloak-database-password 2023-04-17 18:41:44 +02:00
8b8280d07e
secrets: Add keys for axeman and host_001_momo_koeln 2023-04-17 18:41:44 +02:00
a0a92d27c9
001_momo_koeln: Add caddy 2023-04-17 18:41:42 +02:00
6e6e5857fd
001_momo_koeln: Add keycloak 2023-04-17 18:41:26 +02:00
366d3b1278
Merge pull request '001_momo_koeln: Add @axeman's key to barkeeper's authorized_keys' () from momo/add-axeman-key into momo/main
Reviewed-on: 
Reviewed-by: teutat3s <teutates@mailbox.org>
2023-03-31 16:44:25 +02:00
48d55417bd
001_momo_koeln: Add @axeman's key to barkeeper's authorized_keys 2023-03-31 16:40:13 +02:00
ea18402f21
Merge pull request 'main-to-momo-main' () from main-to-momo-main into momo/main
Reviewed-on: 
Reviewed-by: teutat3s <teutates@mailbox.org>
2023-03-31 16:19:07 +02:00
3992ca0d5f
Merge branch 'main' into main-to-momo-main 2023-03-31 16:15:10 +02:00
43bd742150
Merge pull request 'ci: fix Host key verification failed' () from momo/ci-deployment-known-hosts into momo/main
Reviewed-on: 
2023-03-08 14:13:03 +01:00
b21b98dadd
ci: fix Host key verification failed
- Fix missing SSH known_hosts in deploy pipeline
- SSH tries to use Trust-On-First-Use (TOFU) interactively to add a new
  host key
- Verbose SSH logs show:
debug1: Server host key: ssh-ed25519 SHA256:1bbksDNYBWSh/rIFP7MMfs557kWn1dM64bpXdnfBE5E
debug1: read_passphrase: can't open /dev/tty: No such device or address
- deploy-rs uses nix, which uses SSH which doesn't use the environment variable
HOME, but rather /etc/passwd to find a user's HOME
- To solve this, we override SSH options using UserKnownHostsFile and
  the -i flag
2023-03-08 14:10:19 +01:00
f5239c042b
Merge pull request 'ci: debug Host key verification failed error' () from momo/ci-deployment-known-hosts into momo/main
Reviewed-on: 
2023-03-08 14:05:19 +01:00
51e84e9418
ci: debug Host key verification failed error 2023-03-08 14:04:06 +01:00
f6708d252e
Merge pull request 'ci: debug Host key verification failed error' () from momo/ci-deployment-known-hosts into momo/main
Reviewed-on: 
2023-03-08 13:55:32 +01:00
0bd30c33d5
ci: debug Host key verification failed error 2023-03-08 13:54:50 +01:00
3f9b0f9a3b
Merge pull request 'ci: debug Host key verification failed error' () from momo/ci-deployment-known-hosts into momo/main
Reviewed-on: 
2023-03-08 13:49:58 +01:00
09cdf6c390
ci: debug Host key verification failed error 2023-03-08 13:49:27 +01:00
30652571cf
Merge pull request 'ci: debug Host key verification failed error' () from momo/ci-deployment-known-hosts into momo/main
Reviewed-on: 
2023-03-08 13:43:13 +01:00
9812687fb1
ci: debug Host key verification failed error 2023-03-08 13:42:29 +01:00
86ca4f6f54
Merge pull request 'ci: debug Host key verification failed error' () from momo/ci-deployment-known-hosts into momo/main
Reviewed-on: 
2023-03-08 13:35:46 +01:00
1a16083510
ci: debug Host key verification failed error 2023-03-08 13:35:02 +01:00
8c4cc68bd6
Merge pull request 'ci: fix Host key verification failed' () from momo/ci-deployment-known-hosts into momo/main
Reviewed-on: 
2023-03-08 13:30:24 +01:00
9dc77abfc8
ci: fix Host key verification failed
- missing SSH known_hosts in deploy pipeline
- SSH tries to use Trust-On-First-Use (TOFU) interactively to add a new
  host key
- verbose SSH logs:
debug1: Server host key: ssh-ed25519 SHA256:1bbksDNYBWSh/rIFP7MMfs557kWn1dM64bpXdnfBE5E
debug1: read_passphrase: can't open /dev/tty: No such device or address
- deploy-rs uses nix, which uses SSH which doesn't use the environment variable
HOME, but rather /etc/passwd to find a user's HOME
2023-03-08 13:25:49 +01:00
6192881ac1
Merge pull request 'ci: debug Host key verification failed error' () from momo/ci-deployment-known-hosts into momo/main
Reviewed-on: 
2023-03-08 12:54:37 +01:00
3890494935
ci: debug Host key verification failed error 2023-03-08 12:53:56 +01:00
420a201f70
Merge pull request 'ci: debug Host key verification failed error' () from momo/ci-deployment-known-hosts into momo/main
Reviewed-on: 
2023-03-08 12:26:33 +01:00
e2c601509a
ci: debug Host key verification failed error 2023-03-08 12:26:01 +01:00
3491fc2b74
Merge pull request 'ci: debug Host key verification failed error' () from momo/ci-deployment-known-hosts into momo/main
Reviewed-on: 
2023-03-08 11:54:51 +01:00
40e967fb7d
ci: debug Host key verification failed error 2023-03-08 11:54:03 +01:00
503a40da11
Merge pull request 'ci: debug Host key verification failed error' () from momo/ci-deployment-known-hosts into momo/main
Reviewed-on: 
2023-03-08 11:51:40 +01:00
6190795afa
ci: debug Host key verification failed error 2023-03-08 11:50:21 +01:00
8bf3b126de
Merge pull request 'ci: fix missing SSH known_hosts in deploy pipeline' () from momo/ci-deployment-known-hosts into momo/main
Reviewed-on: 
Reviewed-by: hensoko <hensoko@gssws.de>
2023-03-08 11:33:02 +01:00
e3db9f51a6
ci: fix missing SSH known_hosts in deploy pipeline 2023-03-07 21:51:43 +01:00
6913d66458
Merge pull request 'ci: deploy host_001_momo_koeln on every push to momo/main' () from momo/ci-deployment into momo/main
Reviewed-on: 
Reviewed-by: hensoko <hensoko@gssws.de>
2023-03-07 21:21:56 +01:00
716f22e32d
ci: deploy host_001_momo_koeln on every push to
momo/main

The branch momo/main is now protected from direct pushes and changes
should go through review before getting merged

Fix drone lint errors:
Pipeline stage 'Notification' declares invalid dependency 'Tests'
Pipeline stage 'Publish ISO' declares invalid dependency 'Check'
2023-03-07 17:33:01 +01:00
4b5955a164
Merge pull request 'barkeeper: add teutat3s SSH public key' () from momo/teutat3s-ssh-public-key into momo/main
Reviewed-on: 
2023-03-07 10:54:47 +01:00
9ae94a6c4e
Remove unused bootstrap host 2023-03-07 01:19:46 +01:00
597594912c
Remove unused pub-solar user 2023-03-07 01:17:03 +01:00
2ae3276694
Remove unused PubSolarOS host, ci should builds
host_001_momo_koeln instead
2023-03-07 01:14:59 +01:00
9d7dfe52cb
barkeeper: add teutat3s SSH public key 2023-03-07 01:10:27 +01:00
0daf30fe09 add 001_momo_koeln 2023-03-07 00:48:42 +01:00
15 changed files with 256 additions and 113 deletions

View file

@ -1,7 +1,7 @@
--- ---
kind: pipeline kind: pipeline
type: exec type: exec
name: Check name: Check and deploy
node: node:
hosttype: baremetal hosttype: baremetal
@ -15,7 +15,27 @@ steps:
commands: commands:
- 'echo DEBUG: Using NIX_FLAGS: $NIX_FLAGS' - 'echo DEBUG: Using NIX_FLAGS: $NIX_FLAGS'
- nix $$NIX_FLAGS develop --command nix flake show - nix $$NIX_FLAGS develop --command nix flake show
- nix $$NIX_FLAGS build ".#nixosConfigurations.PubSolarOS.config.system.build.toplevel" - nix $$NIX_FLAGS build ".#nixosConfigurations.host_001_momo_koeln.config.system.build.toplevel"
- name: "Deploy"
when:
event:
- push
branch:
- momo/main
environment:
NIX_FLAGS: "--print-build-logs --verbose --accept-flake-config"
PRIVATE_SSH_KEY:
from_secret: ci_private_ssh_key
SSH_HOST_KEY: "80.244.242.4 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE7XTCHfX6ta8EtkdOcZLnpdhMmXDfTebVMs4NC8JEPj"
commands:
- mkdir $$HOME/.ssh && chmod 700 $$HOME/.ssh
- echo "$$PRIVATE_SSH_KEY" > $$HOME/.ssh/id_ed25519 && chmod 600 $$HOME/.ssh/id_ed25519
- echo "$$SSH_HOST_KEY" > $$HOME/.ssh/known_hosts
# SSH uses HOME from /etc/passwd, not from the environment, so override it
- export SSHOPTS="-o UserKnownHostsFile=$$HOME/.ssh/known_hosts -i $$HOME/.ssh/id_ed25519"
- "echo DEBUG: Using NIX_FLAGS: $$NIX_FLAGS"
- nix $$NIX_FLAGS develop --command deploy --magic-rollback false --skip-checks --targets '.#host_001_momo_koeln' --ssh-opts="$$SSHOPTS"
--- ---
kind: pipeline kind: pipeline
@ -76,9 +96,6 @@ steps:
from_secret: matrix_password from_secret: matrix_password
template: "Test run triggered by tag: {{ build.tag }}. Test run exit status: {{ build.status }}. Artifacts uploaded to Manta: https://eu-central.manta.greenbaum.cloud/pub_solar/public/ci/{{ repo.Owner }}/{{ repo.Name }}/{{ build.number }}/foot_wayland_info.png" template: "Test run triggered by tag: {{ build.tag }}. Test run exit status: {{ build.status }}. Artifacts uploaded to Manta: https://eu-central.manta.greenbaum.cloud/pub_solar/public/ci/{{ repo.Owner }}/{{ repo.Name }}/{{ build.number }}/foot_wayland_info.png"
depends_on:
- Tests
trigger: trigger:
ref: ref:
- refs/tags/v* - refs/tags/v*
@ -132,9 +149,6 @@ steps:
unlink_first: true unlink_first: true
strip_components: 3 strip_components: 3
depends_on:
- Check
trigger: trigger:
branch: branch:
- main - main
@ -147,6 +161,6 @@ volumes:
--- ---
kind: signature kind: signature
hmac: 6aee0ffe22111bb629c0a79940bfbc3fa75f68c5ed5c4bba68abf6797b87a7ab hmac: a600be61980312efec74374647cdff7e3876a7858caf51433a8b76148312edc1
... ...

View file

@ -119,10 +119,9 @@
users = digga.lib.rakeLeaves ./users; users = digga.lib.rakeLeaves ./users;
}; };
suites = with profiles; rec { suites = with profiles; rec {
base = [users.pub-solar users.root]; base = [ base-user users.root users.barkeeper ];
iso = base ++ [base-user graphical pub-solar-iso];
pubsolaros = [full-install base-user users.root]; host_001_momo_koeln = base;
anonymous = [pubsolaros users.pub-solar];
}; };
}; };
}; };
@ -137,10 +136,10 @@
}; };
}; };
users = { users = {
pub-solar = {suites, ...}: { barkeeper = {suites, ...}: {
imports = suites.base; imports = suites.base;
home.stateVersion = "21.03"; home.stateVersion = "22.05";
}; };
}; # digga.lib.importers.rakeLeaves ./users/hm; }; # digga.lib.importers.rakeLeaves ./users/hm;
}; };
@ -149,6 +148,11 @@
homeConfigurations = digga.lib.mkHomeConfigurations self.nixosConfigurations; homeConfigurations = digga.lib.mkHomeConfigurations self.nixosConfigurations;
deploy.nodes = digga.lib.mkDeployNodes self.nixosConfigurations {}; deploy.nodes = digga.lib.mkDeployNodes self.nixosConfigurations {
host_001_momo_koeln = {
hostname = "80.244.242.4";
sshUser = "barkeeper";
};
};
}; };
} }

View file

@ -1,21 +0,0 @@
{suites, ...}: {
### root password is empty by default ###
### default password: pub-solar, optional: add your SSH keys
imports =
suites.iso;
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
networking.networkmanager.enable = true;
fileSystems."/" = {device = "/dev/disk/by-label/nixos";};
# This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions
# on your system were taken. Its perfectly fine and recommended to leave
# this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "22.05"; # Did you read the comment?
}

View file

@ -1,54 +0,0 @@
{
config,
lib,
pkgs,
profiles,
...
}:
with lib; let
# Gets hostname of host to be bundled inside iso
# Copied from https://github.com/divnix/digga/blob/30ffa0b02272dc56c94fd3c7d8a5a0f07ca197bf/modules/bootstrap-iso.nix#L3-L11
getFqdn = config: let
net = config.networking;
fqdn =
if (net ? domain) && (net.domain != null)
then "${net.hostName}.${net.domain}"
else net.hostName;
in
fqdn;
in {
# build with: `nix build ".#nixosConfigurations.bootstrap.config.system.build.isoImage"`
imports = [
# profiles.networking
profiles.users.root # make sure to configure ssh keys
profiles.users.pub-solar
profiles.base-user
profiles.graphical
profiles.pub-solar-iso
];
config = {
boot.loader.systemd-boot.enable = true;
# will be overridden by the bootstrapIso instrumentation
fileSystems."/" = {device = "/dev/disk/by-label/nixos";};
system.nixos.label = "PubSolarOS-" + config.system.nixos.version;
# mkForce because a similar transformation gets double applied otherwise
# https://github.com/divnix/digga/blob/30ffa0b02272dc56c94fd3c7d8a5a0f07ca197bf/modules/bootstrap-iso.nix#L17
# https://github.com/NixOS/nixpkgs/blob/aecd4d8349b94f9bd5718c74a5b789f233f67326/nixos/modules/installer/cd-dvd/installation-cd-base.nix#L21-L22
isoImage = {
isoBaseName = mkForce (getFqdn config);
isoName = mkForce "${config.system.nixos.label}-${config.isoImage.isoBaseName}-${pkgs.stdenv.hostPlatform.system}.iso";
};
# This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions
# on your system were taken. Its perfectly fine and recommended to leave
# this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "21.05"; # Did you read the comment?
};
}

View file

@ -0,0 +1,26 @@
{
config,
...
}: {
# Changing the Caddyfile should only trigger a reload, not a restart
systemd.services.caddy.reloadTriggers = [
config.services.caddy.configFile
];
services.caddy = {
enable = true;
email = "wg-tooling@list.momo.koeln";
virtualHosts = {
"auth.momo.koeln" = {
logFormat = ''
output discard
'';
extraConfig = ''
reverse_proxy :8080
'';
};
};
};
networking.firewall.allowedTCPPorts = [80 443];
}

View file

@ -0,0 +1,33 @@
{ config, lib, pkgs, ... }:
{
imports =
[
# Include the results of the hardware scan.
./hardware-configuration.nix
./caddy.nix
./keycloak.nix
];
pub-solar.core.lite = true;
time.timeZone = "Europe/Berlin";
networking = {
useDHCP = false;
interfaces.enp1s0.ipv4.addresses = [{
address = "80.244.242.4";
prefixLength = 29;
}];
defaultGateway = "80.244.242.1";
nameservers = [ "95.129.51.51" "80.244.244.244" ];
};
# Enable the OpenSSH daemon.
services.openssh.enable = true;
system.stateVersion = "22.05";
}

View file

@ -0,0 +1,6 @@
{ suites, ... }:
{
imports = [
./host_001_momo_koeln.nix
] ++ suites.host_001_momo_koeln;
}

View file

@ -0,0 +1,57 @@
{
config,
pkgs,
lib,
...
}: {
# Use the GRUB 2 boot loader.
boot.loader.systemd-boot.enable = false;
boot.loader.grub.enable = true;
boot.loader.grub.version = 2;
# boot.loader.grub.efiSupport = true;
# boot.loader.grub.efiInstallAsRemovable = true;
# boot.loader.efi.efiSysMountPoint = "/boot/efi";
# Define on which hard drive you want to install Grub.
boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
boot.initrd.availableKernelModules = ["ahci" "xhci_pci" "virtio_pci" "sd_mod" "sr_mod" "dm-snapshot"];
boot.initrd.kernelModules = [];
boot.kernelModules = ["kvm-intel"];
boot.extraModulePackages = [];
boot.initrd.luks.devices."cryptroot" = {
device = "/dev/disk/by-uuid/531ee357-5777-498f-abbf-64bb4cff9a14";
};
fileSystems."/" = {
device = "/dev/disk/by-uuid/f5b3152a-a3bd-46d1-968f-53d50fca921e";
fsType = "ext4";
};
fileSystems."/boot" = {
device = "/dev/disk/by-uuid/1fd053f8-725b-418d-aed1-aee71dac2b62";
fsType = "ext4";
};
swapDevices = [
{device = "/dev/disk/by-uuid/967d1933-131d-4b56-8aa9-15c11ff940c9";}
];
networking = {
defaultGateway = "80.244.242.1";
nameservers = ["95.129.51.51" "80.244.244.244"];
interfaces."enp1s0" = {
ipv4.addresses = [
{
address = "80.244.242.4";
prefixLength = 29;
}
];
};
};
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
}

View file

@ -0,0 +1,12 @@
{ config, pkgs, lib, ... }:
with lib;
with pkgs;
let
psCfg = config.pub-solar;
in
{
imports = [
./configuration.nix
];
}

View file

@ -0,0 +1,25 @@
{
config,
lib,
inputs,
pkgs,
self,
...
}: {
age.secrets.keycloak-database-password = {
file = "${self}/secrets/keycloak-database-password.age";
mode = "700";
};
# keycloak
services.keycloak = {
enable = true;
database.passwordFile = config.age.secrets.keycloak-database-password.path;
settings = {
hostname = "auth.momo.koeln";
http-host = "127.0.0.1";
http-port = 8080;
proxy = "edge";
};
};
}

View file

@ -13,12 +13,15 @@ in {
users = { users = {
mutableUsers = false; mutableUsers = false;
groups."${psCfg.user.name}" = {};
users = with pkgs; users = with pkgs;
pkgs.lib.setAttrByPath [psCfg.user.name] { pkgs.lib.setAttrByPath [psCfg.user.name] {
# Indicates whether this is an account for a “real” user. # Indicates whether this is an account for a “real” user.
# This automatically sets group to users, createHome to true, # This automatically sets group to users, createHome to true,
# home to /home/username, useDefaultShell to true, and isSystemUser to false. # home to /home/username, useDefaultShell to true, and isSystemUser to false.
isNormalUser = true; isNormalUser = true;
group = "${psCfg.user.name}";
description = psCfg.user.description; description = psCfg.user.description;
extraGroups = [ extraGroups = [
"wheel" "wheel"

Binary file not shown.

View file

@ -1,8 +1,21 @@
let let
# set ssh public keys here for your system and user # set ssh public keys here for your system and user
system = ""; host_001_momo_koeln = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE7XTCHfX6ta8EtkdOcZLnpdhMmXDfTebVMs4NC8JEPj root@nixos";
user = ""; axeman = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMNeQYLFauAbzDyIbKC86NUh9yZfiyBm/BtIdkcpZnSU @axeman";
allKeys = [system user]; b12f-bbcom = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCmXpOU6vzQiVSSYCoxHYv7wDxC63Qg3dxlAMR6AOzwIABCU5PFFNcO0NWYms/YR7MOViorl+19LCLRABar9JgHU1n+uqxKV6eGph3OPeMp5sN8LAh7C9N+TZj8iJzBxQ3ch+Z/LdmLRwYNJ7KSUI+gwGK6xRS3+z1022Y4P0G0sx7IeCBl4lealQEIIF10ZOfjUdBcLQar7XTc5AxyGKnHCerXHRtccCoadLQujk0AvPXbv3Ma4JwX9X++AnCWRWakqS5UInu2tGuZ/6Hrjd2a9AKWjTaBVDcbYqCvY4XVuMj2/A2bCceFBaoi41apybSk26FSFTU4qiEUNQ6lxeOwG4+1NCXyHe2bGI4VyoxinDYa8vLLzXIRfTRA0qoGfCweXNeWPf0jMqASkUKaSOH5Ot7O5ps34r0j9pWzavDid8QeKJPyhxKuF1a5G4iBEZ0O9vuti60dPSjJPci9oTxbune2/jb7Sa0yO06DtLFJ2ncr5f70s/BDxKk4XIwQLy+KsvzlQEGdY8yA6xv28bOGxL3sQ0HE2pDTsvIbAisVOKzdJeolStL9MM5W8Hg0r/KkGj2bg0TfoRp1xHV9hjKkvJrsQ6okaPvNFeZq0HXzPhWMOVQ+/46z80uaQ1ByRLr3FTwuWJ7F/73ndfxiq6bDE4z2Ji0vOjeWJm6HCxTdGw==";
teutat3s-dumpyourvms = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHcU6KPy4b1MQXd6EJhcYwbJu7E+0IrBZF/IP6T7gbMf teutat3s@dumpyourvms";
hensoko_nitrokey_1 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII/58A18EtxnLYHu63c/+AyTSkJQSso/VVdHUFGp1CTk cardno:FFFE34353135";
hensoko_harrison = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEbaQdxp7Flz6ttELe63rn+Nt9g43qJOLih6VCMP4gPb hensoko@harrison";
hensoko_norman = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAqkqMYgncrnczcW/0PY+Z+FmNXXpgw6D9JWTTwiainy hensoko@hensoko-tp-work";
allKeys = [
axeman
b12f-bbcom
hensoko_nitrokey_1
hensoko_harrison
hensoko_norman
host_001_momo_koeln
teutat3s-dumpyourvms
];
in { in {
"secret.age".publicKeys = allKeys; "keycloak-database-password.age".publicKeys = allKeys;
} }

View file

@ -0,0 +1,43 @@
{
config,
hmUsers,
pkgs,
lib,
...
}: let
psCfg = config.pub-solar;
in {
config = {
home-manager.users = {inherit (hmUsers) barkeeper;};
security.sudo.extraRules = [
{
users = ["${psCfg.user.name}"];
commands = [
{
command = "ALL";
options = ["NOPASSWD"];
}
];
}
];
pub-solar = {
user = {
name = "barkeeper";
description = "momo deployment user";
fullName = "momo infra barkeeper";
email = "admins@momo.koeln";
gpgKeyId = "";
publicKeys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII/58A18EtxnLYHu63c/+AyTSkJQSso/VVdHUFGp1CTk cardno:FFFE34353135 @hensoko"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAqkqMYgncrnczcW/0PY+Z+FmNXXpgw6D9JWTTwiainy hensoko@hensoko-tp-work"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEbaQdxp7Flz6ttELe63rn+Nt9g43qJOLih6VCMP4gPb @hensoko"
"ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFro/k4Mgqyh8yV/7Zwjc0dv60ZM7bROBU9JNd99P/4co6fxPt1pJiU/pEz2Dax/HODxgcO+jFZfvPEuLMCeAl0= YubiKey #10593996 PIV Slot 9a @teutat3s"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGP5MvCwNRtCcP1pSDrn0XZTNlpOqYnjHDm9/OI4hECW @ci-drone-runner"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMNeQYLFauAbzDyIbKC86NUh9yZfiyBm/BtIdkcpZnSU @axeman"
];
};
};
};
}

View file

@ -1,18 +0,0 @@
{hmUsers, ...}: {
home-manager.users = {inherit (hmUsers) pub-solar;};
pub-solar = {
# These are your personal settings
# The only required settings are `name` and `password`,
# for convenience, use publicKeys to add your SSH keys
# The rest is used for programs like git
user = {
name = "pub-solar";
# default password = pub-solar
password = "$6$Kv0BCLU2Jg7GN8Oa$hc2vERKCbZdczFqyHPfgCaleGP.JuOWyd.bfcIsLDNmExGXI6Rnkze.SWzVzVS311KBznN/P4uUYAUADXkVtr.";
fullName = "Pub Solar";
email = "iso@pub.solar";
publicKeys = [];
};
};
}