sokai/mynixos-config
1
1
Fork 0
forked from mirrors_public/oddlama_nix-config
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

refactor: move relevant secrets to microvms

Browse source
This commit is contained in:
oddlama 2023-06-12 00:32:27 +02:00
parent dfe1abdfde
commit f33fa54b65
No known key found for this signature in database
GPG key ID: 14EFE510775FE39A
11 changed files with 7 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

8
hosts/ward/microvms/grafana/default.nix
View file

@ -6,8 +6,6 @@
utils, utils,
... ...
}: { }: {
age.rekey.hostPubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBXXjI6uB26xOF0DPy/QyLladoGIKfAtofyqPgIkCH/g";
extra.wireguard.proxy-sentinel.client.via = "sentinel"; extra.wireguard.proxy-sentinel.client.via = "sentinel";
networking.nftables.firewall = { networking.nftables.firewall = {
@ -35,13 +33,15 @@
group = "grafana"; group = "grafana";
}; };
age.secrets.loki-basic-auth-password = { age.secrets.grafana-loki-basic-auth-password = {
rekeyFile = ./secrets/loki-basic-auth-password.age; rekeyFile = ./secrets/grafana-loki-basic-auth-password.age;
generator = "alnum"; generator = "alnum";
mode = "440"; mode = "440";
group = "grafana"; group = "grafana";
}; };
nodes.sentinel.age.secrets.loki-basic-auth-hashes.generator.dependencies = [config.age.secrets.grafana-loki-basic-auth-password];
services.grafana = { services.grafana = {
enable = true; enable = true;
settings = { settings = {

0
hosts/ward/secrets/grafana-secret-key.age → hosts/ward/microvms/grafana/secrets/grafana-secret-key.age
View file

1
hosts/ward/microvms/grafana/secrets/host.pub Normal file
View file

@ -0,0 +1 @@
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBXXjI6uB26xOF0DPy/QyLladoGIKfAtofyqPgIkCH/g

2
hosts/ward/microvms/kanidm/default.nix
View file

@ -6,8 +6,6 @@
utils, utils,
... ...
}: { }: {
age.rekey.hostPubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN2TxWynLb8V9SP45kFqsoCWhe/dG8N1xWNuJG5VQndq";
extra.wireguard.proxy-sentinel.client.via = "sentinel"; extra.wireguard.proxy-sentinel.client.via = "sentinel";
# TODO this as includable module? # TODO this as includable module?

1
hosts/ward/microvms/kanidm/secrets/host.pub Normal file
View file

@ -0,0 +1 @@
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN2TxWynLb8V9SP45kFqsoCWhe/dG8N1xWNuJG5VQndq

0
hosts/ward/secrets/kanidm-self-signed.crt.age → hosts/ward/microvms/kanidm/secrets/kanidm-self-signed.crt.age
View file

0
hosts/ward/secrets/kanidm-self-signed.key.age → hosts/ward/microvms/kanidm/secrets/kanidm-self-signed.key.age
View file

2
hosts/ward/microvms/loki/default.nix
View file

@ -5,8 +5,6 @@
utils, utils,
... ...
}: { }: {
age.rekey.hostPubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICDDvvF3+KwfoZrPAUAt2HS7y5FM9S5Mr1iRkBUqoXno";
extra.wireguard.proxy-sentinel.client.via = "sentinel"; extra.wireguard.proxy-sentinel.client.via = "sentinel";
networking.nftables.firewall = { networking.nftables.firewall = {

1
hosts/ward/microvms/loki/secrets/host.pub Normal file
View file

@ -0,0 +1 @@
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICDDvvF3+KwfoZrPAUAt2HS7y5FM9S5Mr1iRkBUqoXno

BIN
hosts/ward/secrets/acme-credentials.age
View file

Binary file not shown.

9
hosts/ward/secrets/loki-basic-auth-password.age
View file

@ -1,9 +0,0 @@
age-encryption.org/v1
-> X25519 WrGssql6ABmtiNPFxIuKmjEjNWp8yQ9CbIdaPkE1BmU
lX/mIQPjjBp62RZyZV3WZrzzM/RAVEVMslOvQiO3ztw
-> piv-p256 xqSe8Q A+/jWovwGhsvkNHNvfnhEOSKu6qkfQGCKnVYRJo1IWFM
oWybJl7iZ6pkBAGmv3SmE9q1eEpkDtnIxR+3MCKi6bo
-> a6-grease O~| \B n <1fV!LUr
y0AAIziu
--- 0K+cIttoHGYTWwzdoYJn1rIdtDqiBGz/jLOvPnns2CM
Bu ¶;{þº:qJ�6„¼’]rL(@Û�¨×£C8Áñ¸ì*ü¾–]ªù¡¾£=j1îãØ €kk¯â<4"[�Üj©bLÅ;U�2wc-4