feat: use declaratively provisioned influx tokens for telegraf

modules/default.nix

@@ -18,7 +18,6 @@
     ./config/users.nix
     ./config/xdg.nix
 
-    ./meta/influxdb-retrieve.nix
     ./meta/influxdb.nix
     ./meta/microvms.nix
     ./meta/nginx.nix

modules/meta/influxdb-retrieve.nix

@@ -1,33 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}: let
-  inherit
-    (lib)
-    mkOption
-    types
-    ;
-
-  cfg = config.services.influxdb2;
-in {
-  options.services.influxdb2.provision.retrieveToken = mkOption {
-    type = types.functionTo (types.functionTo types.str);
-    readOnly = true;
-    description = "Script that returns a agenix-rekey generator to retrieve the given token";
-    default = def: let
-      id = builtins.substring 0 32 (builtins.hashString "sha256" "${def.user}:${def.org}:${def.name}");
-    in
-      {
-        pkgs,
-        lib,
-        ...
-      }: ''
-        echo " -> Retrieving influxdb token ${def.name} for org ${def.org} on ${config.node.name}" >&2
-        ssh ${config.node.name} -- \
-          'bash -c '"'"'influx auth list --json --token "$(< ${cfg.provision.initialSetup.tokenFile})"'"'" \
-          | ${lib.getExe pkgs.jq} -r '.[] | select(.description | contains("${id}")) | .token' \
-          || die "Could not list/find influxdb api token '${def.name}' (${id})"
-      '';
-  };
-}

modules/meta/influxdb.nix

@@ -545,11 +545,14 @@ in {
       preStart = ''
         if ! test -e "$STATE_DIRECTORY/influxd.bolt"; then
           touch "$STATE_DIRECTORY/.first_startup"
+        else
+          # Manipulate provisioned api tokens if necessary
+          ${getExe tokenManipulator} "$STATE_DIRECTORY/influxd.bolt"
         fi
       '';
 
       postStart = let
-        influxCli = "${pkgs.influxdb2-cli}/bin/influx"; # getExe pkgs.influxdb2-cli
+        influxCli = getExe pkgs.influxdb2-cli;
       in
         ''
           set -euo pipefail
@@ -589,6 +592,7 @@ in {
           fi
 
           export INFLUX_TOKEN=$(< ${escapeShellArg cfg.provision.initialSetup.tokenFile})
+          any_tokens_created=0
         ''
         + flip concatMapStrings cfg.provision.deleteApiTokens (apiToken: ''
           if id=$(
@@ -839,11 +843,17 @@ in {
             "--write-bucket" "''${bucketIds[${escapeShellArg bucket}]}"
           '')}
             )
-            ${influxCli} auth create ${escapeShellArgs createArgs} >/dev/null \
+            ${influxCli} auth create ${escapeShellArgs createArgs} >/dev/null "''${extraArgs[@]}"
-              "''${extraArgs[@]}"
+            any_tokens_created=1
             echo "Created api token org="${escapeShellArg apiToken.org}" user="${escapeShellArg apiToken.user}
           fi
-        '');
+        '')
+        + ''
+          if [[ $any_tokens_created == 1 ]]; then
+            echo "Created new tokens, forcing service restart so we can manipulate secrets"
+            kill "$MAINPID"
+          fi
+        '';
     };
   };
 }

modules/meta/telegraf.nix

@@ -7,6 +7,7 @@
 }: let
   inherit
     (lib)
+    mkAfter
     mkEnableOption
     mkIf
     mkOption
@@ -55,141 +56,137 @@ in {
     };
   };
 
-  config = let
+  config = mkIf cfg.enable {
-    tokenDef = {
+    nodes.${cfg.influxdb2.node}.services.influxdb2.provision.ensureApiTokens = [
-      name = "telegraf (${config.node.name})";
+      {
-      org = "servers";
+        name = "telegraf (${config.node.name})";
-      user = "admin";
+        org = "servers";
-      readBuckets = ["telegraf"];
+        user = "admin";
-      writeBuckets = ["telegraf"];
+        readBuckets = ["telegraf"];
+        writeBuckets = ["telegraf"];
+        tokenFile = config.age.secrets.telegraf-influxdb-token.path;
+      }
+    ];
+
+    age.secrets.telegraf-influxdb-token = {
+      generator.script = "alnum";
+      generator.tags = ["influxdb"];
+      mode = "440";
+      group = "telegraf";
     };
-  in
+
-    mkIf cfg.enable {
+    security.elewrap.telegraf-sensors = mkIf cfg.scrapeSensors {
-      nodes.${cfg.influxdb2.node}.services.influxdb2.provision.ensureApiTokens = [
+      command = ["${pkgs.lm_sensors}/bin/sensors" "-A" "-u"];
-        tokenDef
+      targetUser = "root";
+      allowedUsers = ["telegraf"];
+    };
+
+    security.elewrap.telegraf-nvme = mkIf config.services.smartd.enable {
+      command = ["${pkgs.nvme-cli}/bin/nvme"];
+      targetUser = "root";
+      allowedUsers = ["telegraf"];
+      passArguments = true;
+    };
+
+    security.elewrap.telegraf-smartctl = mkIf config.services.smartd.enable {
+      command = ["${pkgs.smartmontools}/bin/smartctl"];
+      targetUser = "root";
+      allowedUsers = ["telegraf"];
+      passArguments = true;
+    };
+
+    services.telegraf = {
+      enable = true;
+      environmentFiles = ["/run/telegraf/env"];
+      extraConfig = {
+        agent = {
+          interval = "10s";
+          round_interval = true; # Always collect on :00,:10,...
+          metric_batch_size = 5000;
+          metric_buffer_limit = 50000;
+          collection_jitter = "0s";
+          flush_interval = "20s";
+          flush_jitter = "5s";
+          precision = "1ms";
+          hostname = config.node.name;
+          omit_hostname = false;
+        };
+        outputs = {
+          influxdb_v2 = {
+            urls = ["https://${cfg.influxdb2.domain}"];
+            token = "$INFLUX_TOKEN";
+            inherit (cfg.influxdb2) organization bucket;
+          };
+        };
+        inputs =
+          {
+            conntrack = {};
+            cpu = {};
+            disk = {};
+            diskio = {};
+            internal = {};
+            interrupts = {};
+            kernel = {};
+            kernel_vmstat = {};
+            linux_sysctl_fs = {};
+            mem = {};
+            net = {};
+            netstat = {};
+            nstat = {};
+            processes = {};
+            swap = {};
+            system = {};
+            systemd_units = {
+              unittype = "service";
+            };
+            temp = {};
+            wireguard = {};
+            # http_response = { urls = [ "http://localhost/" ]; };
+            # ping = { urls = [ "9.9.9.9" ]; };
+          }
+          // optionalAttrs config.services.smartd.enable {
+            sensors = {};
+            smart = {
+              attributes = true;
+              path_nvme = config.security.elewrap.telegraf-nvme.path;
+              path_smartctl = config.security.elewrap.telegraf-smartctl.path;
+              use_sudo = false;
+            };
+          }
+          // optionalAttrs config.services.nginx.enable {
+            nginx.urls = ["http://localhost/nginx_status"];
+          }
+          // optionalAttrs (config.networking.wireless.enable || config.networking.wireless.iwd.enable) {
+            wireless = {};
+          };
+      };
+    };
+
+    services.nginx.virtualHosts = mkIf config.services.nginx.enable {
+      localhost.listenAddresses = ["127.0.0.1" "[::1]"];
+      localhost.locations."= /nginx_status".extraConfig = ''
+        allow 127.0.0.0/8;
+        allow ::1;
+        deny all;
+        stub_status;
+        access_log off;
+      '';
+    };
+
+    systemd.services.telegraf = {
+      path = [
+        # Make sensors refer to the correct wrapper
+        (mkIf cfg.scrapeSensors
+          (pkgs.writeShellScriptBin "sensors" config.security.elewrap.telegraf-sensors.path))
       ];
-
+      preStart = mkAfter ''
-      age.secrets.telegraf-influxdb-token = {
+        echo "INFLUX_TOKEN=$(< ${config.age.secrets.telegraf-influxdb-token.path})" > /run/telegraf/env
-        generator = {
+      '';
-          script = args: ''
+      serviceConfig = {
-            echo -n "INFLUX_TOKEN="
+        # For wireguard statistics
-            ${nodes.${cfg.influxdb2.node}.config.services.influxdb2.provision.retrieveToken tokenDef args}
+        AmbientCapabilities = ["CAP_NET_ADMIN"];
-          '';
+        RestartSec = "600"; # Retry every 10 minutes
-          tags = ["influxdb"];
-        };
-        mode = "440";
-        group = "telegraf";
-      };
-
-      security.elewrap.telegraf-sensors = mkIf cfg.scrapeSensors {
-        command = ["${pkgs.lm_sensors}/bin/sensors" "-A" "-u"];
-        targetUser = "root";
-        allowedUsers = ["telegraf"];
-      };
-
-      security.elewrap.telegraf-nvme = mkIf config.services.smartd.enable {
-        command = ["${pkgs.nvme-cli}/bin/nvme"];
-        targetUser = "root";
-        allowedUsers = ["telegraf"];
-        passArguments = true;
-      };
-
-      security.elewrap.telegraf-smartctl = mkIf config.services.smartd.enable {
-        command = ["${pkgs.smartmontools}/bin/smartctl"];
-        targetUser = "root";
-        allowedUsers = ["telegraf"];
-        passArguments = true;
-      };
-
-      services.telegraf = {
-        enable = true;
-        environmentFiles = [config.age.secrets.telegraf-influxdb-token.path];
-        extraConfig = {
-          agent = {
-            interval = "10s";
-            round_interval = true; # Always collect on :00,:10,...
-            metric_batch_size = 5000;
-            metric_buffer_limit = 50000;
-            collection_jitter = "0s";
-            flush_interval = "20s";
-            flush_jitter = "5s";
-            precision = "1ms";
-            hostname = config.node.name;
-            omit_hostname = false;
-          };
-          outputs = {
-            influxdb_v2 = {
-              urls = ["https://${cfg.influxdb2.domain}"];
-              token = "$INFLUX_TOKEN";
-              inherit (cfg.influxdb2) organization bucket;
-            };
-          };
-          inputs =
-            {
-              conntrack = {};
-              cpu = {};
-              disk = {};
-              diskio = {};
-              internal = {};
-              interrupts = {};
-              kernel = {};
-              kernel_vmstat = {};
-              linux_sysctl_fs = {};
-              mem = {};
-              net = {};
-              netstat = {};
-              nstat = {};
-              processes = {};
-              swap = {};
-              system = {};
-              systemd_units = {
-                unittype = "service";
-              };
-              temp = {};
-              wireguard = {};
-              # http_response = { urls = [ "http://localhost/" ]; };
-              # ping = { urls = [ "9.9.9.9" ]; };
-            }
-            // optionalAttrs config.services.smartd.enable {
-              sensors = {};
-              smart = {
-                attributes = true;
-                path_nvme = config.security.elewrap.telegraf-nvme.path;
-                path_smartctl = config.security.elewrap.telegraf-smartctl.path;
-                use_sudo = false;
-              };
-            }
-            // optionalAttrs config.services.nginx.enable {
-              nginx.urls = ["http://localhost/nginx_status"];
-            }
-            // optionalAttrs (config.networking.wireless.enable || config.networking.wireless.iwd.enable) {
-              wireless = {};
-            };
-        };
-      };
-
-      services.nginx.virtualHosts = mkIf config.services.nginx.enable {
-        localhost.listenAddresses = ["127.0.0.1" "[::1]"];
-        localhost.locations."= /nginx_status".extraConfig = ''
-          allow 127.0.0.0/8;
-          allow ::1;
-          deny all;
-          stub_status;
-          access_log off;
-        '';
-      };
-
-      systemd.services.telegraf = {
-        path = [
-          # Make sensors refer to the correct wrapper
-          (mkIf cfg.scrapeSensors
-            (pkgs.writeShellScriptBin "sensors" config.security.elewrap.telegraf-sensors.path))
-        ];
-        serviceConfig = {
-          # For wireguard statistics
-          AmbientCapabilities = ["CAP_NET_ADMIN"];
-          RestartSec = "600"; # Retry every 10 minutes
-        };
       };
     };
+  };
 }

secrets/generated/sentinel/telegraf-influxdb-token.age

@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> X25519 XaUYj853Wb8tgblcv5E+yo6MKHUYr8e+XlH8pqpCOHY
+DRB2jT+q3YpsTHtEVcruJAwgPuobIdHesUyfUosKFHo
+-> piv-p256 xqSe8Q ArvvrpYNMLY1NedNvRFROaiB8cBLWoXQXu7uFK0ZEBi5
+nYP5qQckg305iwTXsL4MFb1/4km5TKc3o3YrmdTh1x0
+-> /I_wd-grease
+TF9ugWulDwvVvXrs1QtbcsDucoI6J8WIxU1MZwp1KL9LxoijQBBAb1cuOpAHuVSX
+pDZxKU2beBRQil8uT32EivOmIInqM+Sn5/oi9RlB5HTfdw
+--- a/B6rYarBkmrEefH2VOoRavtXpWR0jH10p/Pngq0siE
+ŔµEaoň©¨°~ˇ×á/,‡ęűXCŞÇäşÖđŽe[×
çć±hć©řŽbdý©§]XTŽčvTĐNX¶ĺŢ-ílF‹]ëo&ÎŘâo9™H

secrets/generated/ward-adguardhome/telegraf-influxdb-token.age

@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> X25519 MlCQ2HsjzlqHlH3nJlDwR1s+rO5WWuCF0zB/G7NswHo
+guS7FgYnGsPNUf7zPmTxU8Hbcwor193fdXMNYs/FPpQ
+-> piv-p256 xqSe8Q AyHBP0NuW471QlgC79x/yPXG6PN0+LDBGb5YyITSEp1M
+KzEJpDbav6toEZw0FM+TC9bDV2JJllxYTCiAu2uc9Lo
+-> <&q_2-grease
+RohRWZShwRkLONaKAQYk23yngHRABtxM9t/oeMuB5yATqbKzRsEDa/SzohEYo3Tm
+Raxwj331Ef6m0Rei
+--- tKzgy6zBz/tNCFhw+dSALCYkDSrJzRUeiRnnV9n14J8
+åûÚù™ÑAˆ¶5zƒ‡ÝQªÚ–46N!ü¢ŒØá¶ÔÄèãåéqÀ@‚í�¬y>G´ù!<©¢Ó6Dœ}r¹&XêÚÃ&ª:Úì¹ÞÇè

secrets/generated/ward-grafana/telegraf-influxdb-token.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> X25519 Cc7PWXLAFnIkYfKMd0vGHFg9WOXZHbOW6AAued1bMj4
+ip0C1+qKn0tOPgZmgk42JNCpvY43sRRB+S7Dwskuxt4
+-> piv-p256 xqSe8Q AkrxA2yOZJPTY9MSln1kJHxg1W6/lyZ9OjET50TNgFca
+0uYVICSpjkbVOrze4x4WBykIXVG6ffueBB3nw+vnZlI
+-> @m}n.7X^-grease HBs- )0s>p?C *DSGr:rO ;/+8^Ut
+EoguGIyVx/VaAio
+--- XRZwLpq71IBAh5WfILkenvcuQx0FHL8uNMBT6mze/3s
+æļÅ]“e�Fýz0¸[ßK
á­R€±TžÜ�C~-BNQ�œÝqÕEo­ Êi{o²U­=c4‹¢¾&n}ý²Ã¥g×[aÛŒB,ï䚦íð

secrets/generated/ward-influxdb/influxdb-admin-password.age

@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> X25519 wJwhuj/4zAiNsu0SzW4u+JGUSnPbbcuVX2mxsOhg6zU
+WUhB3qF/gLFU72JnE9uifnKtJ5E0af5iNX7nAG/RTNE
+-> piv-p256 xqSe8Q Anprcnfe0HEx57+8Fa56KUNYOZwj0rCL28l4HOAGt7AS
+qHIBp3wKN/RKQpHSV5gdTKFo0DPC/32wTo8vXcOGy+4
+-> 9<_yx-grease 0 !0
+xNRkYKRa9ZX1Ya8srULQT3R1kQyGE6suzN3y8PCfLwYtdhP52cP86qS0ns3SLYSQ
+gZ/KJuS9
+--- ZefCrwo87Wp8qwbLnZdQ/VF+ha5p76QfkkR4fvFa88Q
+’,[øê­ôŒXð=sûˆìèl�62¡9ŒúŽuœ7°ü\†çõž›Ê‘Ý®•m(ßOS¢–o]̈w‘†È�™¼…"×=cÒsýåä½"…Î

secrets/generated/ward-influxdb/influxdb-admin-token.age

@@ -0,0 +1,11 @@
+age-encryption.org/v1
+-> X25519 nhBk8Og0lTWtFc0RlE1/abEjkS+RjwvNhXgQS17fonE
+Mkfv+l90lb8w+7gFICnvDTjFsX0eXhsvfpbC4TNX9m8
+-> piv-p256 xqSe8Q AyE6Ot2+JH10ENDVlYj9KxpNuhfI4Uw3I3aajWOWZ1g5
+GbhN48VaSWoT07afQlNj5dd6LkA+iZLA/fkZ4BFNRQ8
+-> $8z_T6"-grease
+VWBSvw6gxnEhN8GjjQ5bBmck6Pq6RQti/d2lmeJHc6gJbcNPfcsLArk4cJYIWtj3
+rTy7QP360q2ii5x2dIKLYXX9i34GZg
+--- 7vQ7h4WR7TzMeAvJx7gB3FiqwfetPklBHASCdhPmJUE
+üÓâé´CT?)	ž6èu²X–A
±žI¿\<¯¤Bf댅ĞŸ9¡qfÊßDÓêÔûŽž3rõÎ2
+-³µ±bÊ|Íì÷š}ó/zI0

secrets/generated/ward-influxdb/influxdb-user-telegraf-token.age

@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> X25519 dkZjt5XeqwMUgkEAY52mrY8JhOfRbf7aZMkRN+q2OQY
+NYjY1Ik1glh7LpyAMXDvDQ/Nn1a9DcZKVsm0dNILtCo
+-> piv-p256 xqSe8Q Ah5E7KJBKEQ7U8nvPQK7vZZaS+H/erFOQMJJnzdwUhyo
+rNEABByeWmhVuDYg1/Xf+U2R8QgUpCRvYOJ6U2SIFQ8
+-> i@7+6*CD-grease ]n{AO; _mqh/b2$ (cn`0HP| Pq]0ZO.S
+LhjtAwFt+C/6bhAV3dJGfjnL0v3zej76GXN5w8ecGo7RNcaov+ibEhJZS1L9HfB9
+HI9OgEW45wzi/ACzS++nsjM8uvRqkEnZph/KDtI8WkBvhi5kxQj8ygk
+--- HgaKgjntQCNOKxPArzML9wbWVViOP4iK1ZKaFlhau6E
+§ü�dpMíZÑÙÆ8ý%{Déof!o»+bŒ€Y:ö½¹“Ó-sD�FÏt·×Ù>‚{�ê�t–öÛI¾Ù6àHE´ÑéÒ™ ~ÿĨèÌ7

secrets/generated/ward-influxdb/telegraf-influxdb-token.age

@@ -0,0 +1,11 @@
+age-encryption.org/v1
+-> X25519 vau2b1TsJYw29/QqdjbJD7ac4t2EsDS4idFtaG6JNC4
+EUS9gCziFWQnoa/caONoCKC1vHzZu+IS55PibahTAjI
+-> piv-p256 xqSe8Q AlqWLbSrnqBIrmFMka6LBoI2q8Z6uhPYzNJuazmVt36L
+IR6oLfRAyGScskuyCWEMoRV4Q4+T1kZ4k+k12L/mdlc
+-> nHz5-grease Geri j
+aVMAiPtWs7NICMdquHXx
+--- hCWMTkexH2LgrDoj+/9O7R8ghh3q2vItX8fpf8uJlGY
+…
+ùØÅÙ+qUе圮îY?+ñëý)S§zb8â$–®ýRl]`CøÌ.{y3é­E\¤Å' ´7`°å«#­Hìæ
+HxÁ®

secrets/generated/ward-kanidm/telegraf-influxdb-token.age

@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> X25519 MfENY6W8BxIjJZTMOrjmAD0A8xX16zjPFUyLoC1Fbzc
++LcdZlLA/FIzybetfK4dJLrxxkgBzmtClqmqJ9S7lhU
+-> piv-p256 xqSe8Q AqKyv0URos2ZKmDLgkKuG+S6M8SP+LuXVxrRIRtWNaJM
+XUVagZCLJxy/jTgxIfgZBi5LT8oLKQkwr/1xZ+iaKSk
+-> k-^*_G*t-grease d4.pB=/ ;!]-|
+7Siqvz2APk/MUBVdwCCxagxbAqTfU/U2+3I3dknxiNSsVg
+--- XJXcNEtC1APhgW5V66jj3APN2wQ5Pah9dOZb4k9waF0
+°ˆm뮇×ykÚoÁlKõ;µ1¢!ÀîË{$oóùûÚë­Fá
+VälôŒQg¨�ûü‹%S×B«˜[JÎ*gkÂEíœÖñDåÝ|B

secrets/generated/ward-loki/telegraf-influxdb-token.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> X25519 gPvDo9uYyj3YlMMfA9KsasXNczootXGFuIsUtPS0DHY
+b3Zn/0i0/fgn2Vb6OxyIj+e0RcwPiFlGigjfz0DT2/U
+-> piv-p256 xqSe8Q AyamueW+2d8vmU23vXzEewyIG3MIwbbYOcfgL5h4vgD+
+xi6MM4Jvb+H9D1lE2kyLZ3Ebmx4dGzoAFP2yI1fy20w
+-> [RK/,AI-grease - :+OOFI
+L4ACjD7rbdoHSbE7/YWBDpcqPleNbo8zsDsBqa+5rhc+2Hri9mAZkrgVyqiB
+--- 9nasrdpV6bPUbXT/RsnGOgMuiwnU9In1P3THD6KLrHA
+o&‡�ª}eÀü®ã¿ì„ÓŽ’W|û‚ÊEy[•¨a®VEõ}Ž#ýžçæ`mœG/[ø®èq¶p=ß½šƒ7	�.�2§Ÿ«Éhçì4½

secrets/generated/ward-paperless/telegraf-influxdb-token.age

@@ -0,0 +1,11 @@
+age-encryption.org/v1
+-> X25519 pjorEcAKfCrZ6jpsUID4TIoZCemY3zTgmtJH4WnYZl8
+rFPq7T3tVox7mVmU4hja2+V15EWqaTeiLjS+Hw40eq0
+-> piv-p256 xqSe8Q Avqz+MvYywnGhfFd8xh8pszXVtxbzmMcXV8OkQx/hPuE
+QvL7pmoJlR7b1LWPlu5u4d+Gho/p2Ag5WWtVcGv9B1o
+-> I[-grease L% WgI-+G2
+zKQPNN6dPm/RN62gJIJ9eMeY9AsFO826BoaXAv7cSlHe6RLANRY67qGo8rE7G+Hu
+6fZoBzAeU0+g5AhJAXT1kJ8IqJpWkHs2MO98TBw
+--- DzJ/ycU3ftBqMFEAMaDgOCAU9YfPGty/h4o5to3qWhY
+Þ2ý,S%P]ƒîùzðøä�HzþÌÅñã:ñÎV=è ]«p¯1±¿"�±¢e+¦·Ì0žö6eáÕV=.•�訓þºl
+§n

secrets/generated/ward-vaultwarden/telegraf-influxdb-token.age

@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> X25519 31+IfJC02uqhMs9babTHz0xXeLYR8u/mh/Xoqz7ihHw
+0TGSxcpjOPhetoFt8vOr2tlvVyf83TvWO1+4mrdXoe0
+-> piv-p256 xqSe8Q Aywdg9e/eiSRODRAJH10nDPDUF9FLGGcGJJHTmJtBX69
+S5XMCwiRDwO648mEosIZM/x56ken5GohbTOoPDmjv/c
+-> F3<_]-grease
+kewBBGbL1vd5Ju13jVyaZ41gNQKfd4xMZ2fo5iOWn4bPi1cz+w7ZjA
+--- B3kVQBZfSgooF64jc16joJ+Qy62l+qu0MFy/ar22QbI
+…(³/Cæ£÷ÍêìLÜ[Œ5í{ùäwÿn‰^ñz5ú‡üJ1¥®ì½zZøk4árª÷Õ{ÆÂî¯YŠWr6ë‘Ay
+ÎÚšOêæwËÙ

secrets/generated/ward/telegraf-influxdb-token.age

@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> X25519 cuVidpMh/X5ILKEfHolSaE43WieKTPS0G7iugT91zAU
+CvRxysJAIztyrWgJCdmz4egFqfD0o9QntMAKaq38gxQ
+-> piv-p256 xqSe8Q Ajp2/FdDMiKSQThbXwXlE1BzF9qkil+ipYogsyVlXIgl
+FMSMNxUdWP7rnMsO/BX8O32g0p40qkV0gqaz1JO6J6A
+-> Am!*E(A-grease !S(+@ 4cm j}yp4 \&
+bkVvMNy/N9QtLJxCu+JF6TV5vnYTfzym0FiU4hARs29CEvJG8zD9XVU3931oY8ai
+I09MCiMksKB7cpcgnvO76lp90w1WhOERtzW2sO8ocs8UAMStkw
+--- zA7XDmO7UOnMzBi6UPAMS7djwk2GO2jI5f6wQRvCVhw
+…˛Ňšâ.äžnŻ ŕuž�*CQY ?Š�
ň1eůŔK˙–Ěl´»CE¦3ÁŰ1Ý ö§ĎçH®ČŽ‘5Zr?TZ±iÎZ¬ňŕ3ú