feat: add new host envoy for mail, switch disko to partlabel

2025-10-10 23:00:39 +02:00 · 2024-04-07 21:59:54 +02:00 · 2024-04-07 21:59:54 +02:00 · 289fcdd197
commit 289fcdd197
parent 303fbd5595
45 changed files with 302 additions and 154 deletions
--- a/secrets/generated/envoy/dhparams.pem.age
+++ b/secrets/generated/envoy/dhparams.pem.age
--- a/secrets/generated/envoy/initrd_host_ed25519_key.age
+++ b/secrets/generated/envoy/initrd_host_ed25519_key.age
--- a/secrets/generated/envoy/promtail-loki-basic-auth-password.age
+++ b/secrets/generated/envoy/promtail-loki-basic-auth-password.age
--- a/secrets/generated/envoy/telegraf-influxdb-token.age
+++ b/secrets/generated/envoy/telegraf-influxdb-token.age
@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> X25519 V7BwuAWcBb8XH3Eb6tWfyfoCL1shUP1kgWFDDubzPCw
+4FlGy8DMzFpgN+wOEj4yrMgctNibQP6afuv79LlpZig
+-> piv-p256 xqSe8Q A3VKu8wLRa7PX8kdNYS5chPWZgdUOWcR6tbfq0G9QVr7
+b8Z8cCA8BRHjLxAe0o/57ifVOI/xrUChoMCikui0bgY
+-> T-grease }@.z [ ./ %/A8'7
+69b+3UIwlyGj0TrDvVVkCO/+Jvnk
+--- yPe/jQ7/2m7jqcVE1Z/+vrAbPRK9A65DbDbkOrcSnNM
+á×˜þojèTÝ:E—8ÜGÓÊ�%±#‰q=<óaèÈåéhI-aô�'PÚî‘¬öa¦”ðqIþBRe¨‡DW<ù+¥QúéöOQ~ÿ
--- a/secrets/generated/sentinel/loki-basic-auth-hashes.age
+++ b/secrets/generated/sentinel/loki-basic-auth-hashes.age
--- a/secrets/global.nix.age
+++ b/secrets/global.nix.age
--- a/secrets/rekeyed/envoy/18339a3d1929a51d4e47d2541c123e2c-wireguard-proxy-sentinel-priv-envoy.age
+++ b/secrets/rekeyed/envoy/18339a3d1929a51d4e47d2541c123e2c-wireguard-proxy-sentinel-priv-envoy.age
@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 yV7lcA ro8yCQGqIdBBovM2iK7imSP88HGNQwpan0yauSw5qU8
+VbL9PnSeLvQojxZ0qrb7wJ3a6NSCQHqPQyKh70CjVqM
+-> )NZc,-grease EFSDzU\| \uz{0/ NN<#vF{
+1Cu8YWV71eWkHxA7I3dw1+sWIWtUC5sWxRKZiH64h5g
+--- JDjw2+EYI9KJSnfhUinszT2Q5531mDwcrK3kflQDbzA
+¥ÌIÉ�9HŠþþŠéê"¦!•ÜTûÊKâ³$[�óÖb|ö¨–0›$Ÿ¿î]\Êd;9%–·‹Š¢–¤ãkË>f	@I�cÈxñ•ºÒ
--- a/secrets/rekeyed/envoy/192d6b442164766c6509bcaedc330592-promtail-loki-basic-auth-password.age
+++ b/secrets/rekeyed/envoy/192d6b442164766c6509bcaedc330592-promtail-loki-basic-auth-password.age
@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 yV7lcA I5wScaDWTGX1gasgX1yIrxC/ydftpHQJSCe+D45H+x4
+rL7dK7KvxBi7WjR33Uk8ApLCahQwYaH4lXJSjXfWeio
+-> `l10-grease _, &7 fe-*# /,uA
+enpbx3yatzXTsg
+--- yrSIElR05M59DbLbtVM++07G1jygBtfsD26buadiqBY
+	£;ö|…í‹J? »Šñg·”¸
*Q•tA1Ô>™€\Ò‡ó¤Œ°mÌéŽäÿŠ•Æ‘ØÊýcžBK¡™M—&��O7Ü<�C)ÿ3Üï�Í.�`>
--- a/secrets/rekeyed/envoy/192d927a0da577d8f0117a747de9ea81-dhparams.pem.age
+++ b/secrets/rekeyed/envoy/192d927a0da577d8f0117a747de9ea81-dhparams.pem.age
--- a/secrets/rekeyed/envoy/2689b787b982e885b1ba3361b7affbe2-wireguard-proxy-sentinel-psks-envoy+sentinel.age
+++ b/secrets/rekeyed/envoy/2689b787b982e885b1ba3361b7affbe2-wireguard-proxy-sentinel-psks-envoy+sentinel.age
@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 yV7lcA YJsWJO8spPFzaDtGlvw8qccQ1L9RpirgE8TPsc9aNhk
+0PuAaJS7EXN8G4vck0Pm+XOf/nLUylZDH8j53SoAuA4
+-> mh!+A:^-grease <,
+siLvQ+lKp1BU8l7t54
+--- DVzyObFZjySus/P22atP2xYm0+ZDdhgDoon8u5ijZEI
+áçô°^‚ÏÅŽ]s–ÀX¬^Ì›¬êî¶|J®�Ce”’—:Ì_I4†ÿÓ˜dÆóF�ŠRÏ5AŽÀò)ó¶•>÷�	ªînî§è÷u
--- a/secrets/rekeyed/envoy/2ef9539ec793ecd1fce9cb9b732ca42a-initrd_host_ed25519_key.age
+++ b/secrets/rekeyed/envoy/2ef9539ec793ecd1fce9cb9b732ca42a-initrd_host_ed25519_key.age
@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 yV7lcA 24sIrRomFFXsZ57wFq/Alchpea891THmcqcCp8WIaQI
+60isrJZAzhUyQ0WDYzIqwEarHFsJdMKaIoYsubP2sgQ
+-> i{WB:-grease 0mO
+lWfmjDoi
+--- VN5AXCQjnCaaudIcFrKrH/J6iQLeVDDs6lT24YONEws
+>i%hÀ¬4bÉ6Zîì7•âóYÈ¦¼¨%B:oÅÜ†,?®rÀ1dÓgs€qþ](QÙÚ÷É-=^pÁöz˜}
…�Ÿ5üÈvªýÄŒîd‹^n´ÖÉáxÇÊ¿!ª2%hy8ÀKÈ}å	?	]ãyÎ¿»…iî0Áš¦ÏÍ9Z�
Ó†M-!ìàÑÖ™�0ŠNV�ˆ‡°™U™[©D07¢KfÌ@tIžU©Ö±ÉeÑ|‰þp%j(±#<¨+½-í6FÔêø=c�Ï†amqš,ƒ]â˜•ˆ§m¤+�ÚÎ¯5’ž„×…0µ�&*rÑ¯lÐ	€¡ºÞhNäuL�\ˆîM]BEíÎßFö Ýt%ðó�?ä.‚Új x†*±ý
+ãSÙo" ¹�ïánÅ+âáVðÇþ³ënÊ¤l#ó³ÿ©ûç‚þÊÅ>,ü¦»âÝ^¦^§Š¿¨%µPi
+ä?1n¿ºŒ$ÌpÌû0o§lùŽÄâÄl÷¡î8k¡UÞŠY ºõt<é¾¶W‡1*h—³EÃÍÑÊ{€rx�3’°Ÿ–t+¶‰Së}ý¾ÀÙŠ
--- a/secrets/rekeyed/envoy/5bc09852ae48483fb23647b453988a84-telegraf-influxdb-token.age
+++ b/secrets/rekeyed/envoy/5bc09852ae48483fb23647b453988a84-telegraf-influxdb-token.age
--- a/secrets/rekeyed/envoy/adc68343fd1e82562f7f6fb8666deb22-acme-cloudflare-dns-token.age
+++ b/secrets/rekeyed/envoy/adc68343fd1e82562f7f6fb8666deb22-acme-cloudflare-dns-token.age
@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 yV7lcA a+d05L2QodqMakVeeKaHaTqUUQjqkZyE0yDW8L4/VkQ
+uzwmBpz1Cyaiuqp/OxQOUY5Kq7LpffGAhS8uvwvTMgw
+-> 2YW09-grease e Cpd|.76
+1gf8alzcxM/al3TN119HGyJdq3ZsGgGL2K60UUSelg
+--- sU+WGjV9XFeGHxh7CmsUWSUNCrJaFFMEQRE56HhZxms
+šÕêY*ä“f•ta=Ö±3Íìf=Yžh^|¸Øºo©z.¹ÃG}Œ¦“Ã:Zûo+Ûd¯¡¯‘/°s��;¡F„",¹]û�÷2á
--- a/secrets/rekeyed/envoy/fbe90fea6015be22bc47a2164a0f22f0-acme-cloudflare-zone-token.age
+++ b/secrets/rekeyed/envoy/fbe90fea6015be22bc47a2164a0f22f0-acme-cloudflare-zone-token.age
@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> ssh-ed25519 yV7lcA Q8NjkvIVBHAbDj0dDmFkiumtDjTBCAEZVrhiklFzzFk
+SDDTiC1fxy5XOVVqyFLuunx1O5qvMWSBdKEsIceKgBQ
+-> _ef4v-grease
+FsmTbPsm7eoAjXgaegyCthI4YvOl7T0ucIwr4lCF9IViwhLaa2Pv47HEZfOgkos+
+2yYSmVj8MFI4nO2epCrLVdtdUe2PhMw+0Brv6IoX4N4S
+--- z9G4Xvmg/WK4y8qyV6aP68AVGONt5nC98Ewj2MVMOCs
+S{+
taŸ>Ÿ³¿gÑˆ0�²+nÝq\ã5¶"uá7Šs¤{Óó¯×	ÝÆŽÔa?ùY„{]¸O?žYß>›�†Ôç‰âÓõ¦–•
--- a/secrets/rekeyed/sentinel/2689b787b982e885b1ba3361b7affbe2-wireguard-proxy-sentinel-psks-envoy+sentinel.age
+++ b/secrets/rekeyed/sentinel/2689b787b982e885b1ba3361b7affbe2-wireguard-proxy-sentinel-psks-envoy+sentinel.age
@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 yV7lcA FPyVM8Oy0xNsKf2cJEZ3hBpSbr1hf/hmnM7GFOuE3Q0
+Z50LLBpDRNItinG6u+xaItYW9YezvdSBjE08dtHSjXc
+-> R-grease yC`(= <jE
+f5Lwr1aWSUnQhDaIeN4
+--- Igi4vXPKAP9OqLRCdK0RVoGAGb3NqgSl/BtiDDWSxis
+Ø‚6à‚ í¦q€taO‰+Î4úƒÇºgÖó ±Ñ��åºÂPg¢'´aÁZ¤6Ö×9 ¾C®zèˆ�·•@ä_«ø¹ÔÌ€ï
--- a/secrets/rekeyed/sentinel/4cff83edc1d2b2ca516f8cb63fb06782-wireguard-proxy-sentinel-psks-sentinel+sire-ai.age
+++ b/secrets/rekeyed/sentinel/4cff83edc1d2b2ca516f8cb63fb06782-wireguard-proxy-sentinel-psks-sentinel+sire-ai.age
@ -1,8 +0,0 @@
-age-encryption.org/v1
-> ssh-ed25519 yV7lcA /KC8F/lM5E8cNGSk5aDjhxYEQJDZhv4fdZmY8tOd0ic
-dLzqTpJRzwb1jmaQB7MqOcMYoh/1jpm/u8AK+lG3uMI
-> NX-grease mWzYBZ k<&L`D_
-dn3tatoIJ8BZuGlJ
--- Zxr1wrJSf6CGK+EpHNZyobURdv+ISrafHBRrBLhaUZU
-‰(µ&ÄÄíî7ªËQi0§#a:6Y¦£ZÕÊvéIèÒkál=Ï¢dÜð¹îKÌ
-7vw]qãÅ`â×±Ò!_“sÓâòóq~[a9à
--- a/secrets/rekeyed/sentinel/8df8bc7331f1c1b2112f03dbbbfe126c-wireguard-proxy-sentinel-psks-sentinel+sire-samba.age
+++ b/secrets/rekeyed/sentinel/8df8bc7331f1c1b2112f03dbbbfe126c-wireguard-proxy-sentinel-psks-sentinel+sire-samba.age
@ -1,9 +0,0 @@
-age-encryption.org/v1
-> ssh-ed25519 yV7lcA PPKZ78iD3jThcf5YkIOC5hKTeDHcT77g11UZ0vc8IjE
-lgkPYZAMzhVZpUSk13rzBJTDW1pNeOyuVAkNpqJb4lg
-> %%JlO}-grease C[7]eK3F KX &_=S \FSSf[^<
-
--- Tww9Yj1LeH6zq/6A7TJo5i9rMUNGV0VN6Yyf44aRnpM
-ÑjD£A6%ß®Z4áäîˆ]ÁPq ¾Òa!b
-¹”iük®Kø† £¹
�atèž¨N7®-sëæ5¢³šÞþ8@b“
-‚¥.
--- a/secrets/rekeyed/sentinel/b8a185a1607106ef955c392329c27f35-loki-basic-auth-hashes.age
+++ b/secrets/rekeyed/sentinel/b8a185a1607106ef955c392329c27f35-loki-basic-auth-hashes.age
--- a/secrets/rekeyed/sentinel/dff3a7ca6af4b2bde64b18a2c7fdec70-loki-basic-auth-hashes.age
+++ b/secrets/rekeyed/sentinel/dff3a7ca6af4b2bde64b18a2c7fdec70-loki-basic-auth-hashes.age
--- a/secrets/rekeyed/sire-ai/89b98207bb1577a81049b4ce319739bf-wireguard-proxy-sentinel-psks-sentinel+sire-ai.age
+++ b/secrets/rekeyed/sire-ai/89b98207bb1577a81049b4ce319739bf-wireguard-proxy-sentinel-psks-sentinel+sire-ai.age
@ -1,7 +0,0 @@
-age-encryption.org/v1
-> ssh-ed25519 vhmDsA nYG2Z2yA03ESRpjgbIDkEoTEH6AJc1v1RUeS+z3cyVY
-vzPGWSTfQwY4kqUjAO/SVJatgcbGd904c/SluNLgpZc
-> Ym-grease
-twk
--- WSBuW7VDmG3ToQrlbccevVe0u0NI/RZYtvcqGSm4Tco
-M�獟惉鐨V1gR'袤単1鈽"鄖
[渳擻菣�V酪uс堇爑挞x腊$囉磜渜樳YP愅箽肚B
--- a/secrets/rekeyed/sire-ai/b106bbbb9f3c987e555b49df7263512d-wireguard-proxy-sentinel-priv-sire-ai.age
+++ b/secrets/rekeyed/sire-ai/b106bbbb9f3c987e555b49df7263512d-wireguard-proxy-sentinel-priv-sire-ai.age
--- a/secrets/rekeyed/sire-influxdb/556953d98099cdb7f1274d6e0bd62443-telegraf-influxdb-token-envoy.age
+++ b/secrets/rekeyed/sire-influxdb/556953d98099cdb7f1274d6e0bd62443-telegraf-influxdb-token-envoy.age
@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 1tdZKQ ZNcyXbeW/bii8cBafPVHi45e07DPoXfFFyPWOm6XanY
+9Jeo7X34qcyiKm1LMQdbsDVaOsgZI/lyl0hARfbcakU
+-> }zO<<U-grease ls\.$Cf
+PyKy2zpmpEwLrAikw4XFNAyujvy3dQUsRTsyEq6YRqVXd8QihnxLFVzHiA
+--- ZidPkRsL+u7okLSFiIpAuLUwbRcKj5zo1NGxDnac8oU
+Íl]K5k"2‡Ã-i™
�r½‘mýÚ)jÈ0t·�hœ4ñ®¸� 3µš¹©õ®Wn<
…¼0q�	«r;K¹$œCøµìm$ÃˆÀ,ð
--- a/secrets/rekeyed/sire-samba/52e0b64f69eb5e84fcccee0f8141cce7-wireguard-proxy-sentinel-priv-sire-samba.age
+++ b/secrets/rekeyed/sire-samba/52e0b64f69eb5e84fcccee0f8141cce7-wireguard-proxy-sentinel-priv-sire-samba.age
@ -1,9 +0,0 @@
-age-encryption.org/v1
-> ssh-ed25519 rQrJ/w rBq18FEF23qZMQ1L0ZmPwes7YA6c5tcYghl+wMpH4UE
-KsWpipPanBEkM0sJO91aGEUJVLNbKfCGlB8n1AJMe58
-> -iJ@"-grease
-e0JwXaE3AG+cwHCgRoYZamBMyxEd60t3woMN4WAChA2FL1sBJ8F+3BFjZdACZDYy
-02KPJC2pCplo+rsTpMZd/XRw7+icfGcatjM5yEOuJKz3zNdsKtMnwXGR8BKV4w
--- eWHO47OEkFmhlJ+AxIutCfholFzG3SU/M5H4u1wM0Ew
-p¤¢”ü6ýS"\£€3
-O ¼¤¬,()a.ÌDe>¿»>c„I3ÆçRÔoý,)èª[Ù8ml°ó“¬!9˜¤…¦)+"G·”ZøP·
--- a/secrets/rekeyed/sire-samba/9cb014e8ff14329d085de1287ff23802-wireguard-proxy-sentinel-psks-sentinel+sire-samba.age
+++ b/secrets/rekeyed/sire-samba/9cb014e8ff14329d085de1287ff23802-wireguard-proxy-sentinel-psks-sentinel+sire-samba.age
@ -1,7 +0,0 @@
-age-encryption.org/v1
-> ssh-ed25519 rQrJ/w EuoChlYXjzab/J3l8oB5V5NJNtpcr5yAOd6y9m4rjSg
-MAJwhKjR+hBx5AEZx95wZvP6IeYAIiksy+zc5ukkQdg
-> S5c!<-grease qdoe 9a_t1FH
-YuKwOpJ1hoqJl+xYxNW6J88aGGiiceHyHy9RgajmXBsivTDbeaEeXRGdJySGWA
--- F2Mty9Hr43tH1SomwZ2vzgj1zQCdVw5pHcVOFIVjZfQ
-9»eg‚‚o«Èf�G}gNçôäi8`(ë–ª33ÇÛd^=Ê×÷Ž×¾©-˜¾¦ÒWX*Ð¹�«ê=Liñù{Ý%3s�ÔéÇÎo"yl
--- a/secrets/rekeyed/zackbiene/2114c48ad63cd022bc589099aa7ae978-mosquitto-pw-home_assistant.age
+++ b/secrets/rekeyed/zackbiene/2114c48ad63cd022bc589099aa7ae978-mosquitto-pw-home_assistant.age
@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 DynNMA 0jbyffbAwO0+WtJmLPgBdQ6o4BQfhtyoR3eC/CisgyY
+nx2vpN/ZWdoG6z0GVA5a4563wiySTlr+BUggqeAxfVU
+-> fHq^-grease $1R? 4g mF
+6Y3otzVbFmwsR3Jqy6G82g9wnKz5JB5tSblkn6O9UoO5
+--- wiu0ndqSrU3ofFPn8WlpLJz3JaMRSGDYcxR8A+QHSbI
+g[û^0ÄJìI‘¢¸—ÿ«3}§ß½c·m`íç-“x�‡tS'Éö˜¢»9¨$ˆ²Qb�ÝÛÎ†
--- a/secrets/rekeyed/zackbiene/21fec08806b3194e39c928380133562f-mosquitto-pw-zigbee2mqtt.age
+++ b/secrets/rekeyed/zackbiene/21fec08806b3194e39c928380133562f-mosquitto-pw-zigbee2mqtt.age
@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> ssh-ed25519 DynNMA IKMt3H+qN5Tp+klLYaeKCa0b5brlB8//VAjpAl68GCI
+MTV8wXhkCYulvS6o7Wnq/rMHeYqPxDdSMggMT6+FLyo
+-> |-:8x-grease s O3ZB {Q"
+GscWlHRccebYhiGFelYXa+GLLzprQc+k9iS//LY
+--- FgB9+ChfVo/svSZ9pgcCv+ZG/edwwIs11tNjCpkHLjg
+Ã�Þ�
+Ô»W€%˜D´Ñ¯¯“`›¦{E[&rÕ-îÿ‘×–bMM�€õ[Óˆ=t�.&š„„›_À�Ú
--- a/secrets/rekeyed/zackbiene/47aefe1120e3a32dc5b13dca618bb1ab-mosquitto-pw-zigbee2mqtt.yaml.age
+++ b/secrets/rekeyed/zackbiene/47aefe1120e3a32dc5b13dca618bb1ab-mosquitto-pw-zigbee2mqtt.yaml.age
--- a/secrets/wireguard/proxy-sentinel/keys/envoy.age
+++ b/secrets/wireguard/proxy-sentinel/keys/envoy.age
@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> X25519 guqR3l3I7Aa0DQ/l2D4MNpLanB4C3PgvwXm/96hPaRc
+c/k+f+fFHVObsCCTi49snWjfidRNuIny2+AefKQ9j70
+-> piv-p256 xqSe8Q AiMovFyBe+XW+kiY84vewtPf6RXoD4yCh8qgZ1jAxke8
+2eg4gF9casDTL/CZ7crqvLulzCBshR0wOaRx7F/BzP0
+-> Zg[dg@o-grease 6qG)H\ 0E
+/OA
+--- nnNkb9JT4yPw0mw6r9NQa/4JfWGjt6ZOi15cQSDmeXE
+›¢Ö-DåN Î+•ÅnHë÷‡Ó\r#…9 �üåÓoŒõÔ4¹!‘DÕ‡�ÚC)“ °0K9ÛÛ›Ú,ô¡§˜mûL›•‚R<>zú
--- a/secrets/wireguard/proxy-sentinel/keys/envoy.pub
+++ b/secrets/wireguard/proxy-sentinel/keys/envoy.pub
@ -0,0 +1 @@
+ikABIdsLZyLPhzujmXTxAXfCHs3FTlblv2Xza1W7jz8=
--- a/secrets/wireguard/proxy-sentinel/psks/envoy+sentinel.age
+++ b/secrets/wireguard/proxy-sentinel/psks/envoy+sentinel.age
@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> X25519 Rum6P5225U0CtcafI68tq+QulUYKH7um3wEkahe33Dk
+f6YAiC/0xU3SFywiOnARpR4d4gAgJeGCAEt/TPV3Gyg
+-> piv-p256 xqSe8Q As29vYnLfn5HuZn/ybyzWvMNsDIYbYchIP8qP6f6/ngX
+vDLqOW0V7JlHOcncgkCnXpNWvIaJl8w/rhZpuQyw+v0
+-> b-grease d /|( EP:
+RfUV02LatAx4gm/RsPXq7aWe0nsGIQadTubk/XUZliOqOSMTXuXfCZrZ
+--- 4trrv3Kv3OOujp3K4WZ1buDoJ0BEnLxkr7UWeZHVxrg
+‰áÍôúŠã‡£åÒt0TWýjx;ÙÅ†4yOì%³5ŽC™�ÿÉ�œ‡>Ðž£žP¾š¥R±È]ÍçÐ£šK‘KI¦òî
				`@ -0,0 +1 @@`
				`ikABIdsLZyLPhzujmXTxAXfCHs3FTlblv2Xza1W7jz8=`