diff --git a/hosts/box/default.nix b/hosts/box/default.nix index 61cf3904..912cfc33 100644 --- a/hosts/box/default.nix +++ b/hosts/box/default.nix @@ -19,6 +19,7 @@ ../profiles/wallabag ../profiles/finance # ../profiles/archivebox + ../profiles/woodpecker-agent ]; # For some reason this doesn't work in the profile, but does over here?? diff --git a/hosts/profiles/woodpecker-agent/default.nix b/hosts/profiles/woodpecker-agent/default.nix index f1ee4fd3..eb50a06c 100644 --- a/hosts/profiles/woodpecker-agent/default.nix +++ b/hosts/profiles/woodpecker-agent/default.nix @@ -1,12 +1,15 @@ +{ pkgs, config, self, ... }: { - users.users.woodpecker-runner = { isSystemUser = true; group = "woodpecker-runner"; }; users.groups.woodpecker-runner = { }; # Allow the exec runner to write to build with nix - nix.allowedUsers = [ "woodpecker-runner" ]; + nix.settings.allowed-users = [ "woodpecker-runner" ]; + + age.secrets.woodpecker-agent-secret.owner = "woodpecker-runner"; + age.secrets.woodpecker-agent-secret.file = "${self}/secrets/woodpecker-agent-secret.age"; systemd.services.woodpecker-runner-exec = { enable = true; @@ -55,7 +58,7 @@ "/nix/" ]; EnvironmentFile = [ - # /run/agenix/woodpecker-agent-secret + /run/agenix/woodpecker-agent-secret ]; ExecStart = "${pkgs.woodpecker-agent}/bin/woodpecker-agent"; User = "woodpecker-runner"; diff --git a/secrets/secrets.nix b/secrets/secrets.nix index e9de2027..374cd2a9 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -25,7 +25,7 @@ in "telegram-matrix-env.age".publicKeys = [ lituus ]; "wallabag.age".publicKeys = [ mossnet ]; - "woodpecker-agent-secret.age".publicKeys = [ lituus helix ]; + "woodpecker-agent-secret.age".publicKeys = [ mossnet helix ]; "woodpecker-client-id.age".publicKeys = [ helix ]; "woodpecker-client-secret.age".publicKeys = [ helix ]; "gitea-dbpass.age".publicKeys = [ helix ]; diff --git a/secrets/woodpecker-agent-secret.age b/secrets/woodpecker-agent-secret.age new file mode 100644 index 00000000..0fb9086f --- /dev/null +++ b/secrets/woodpecker-agent-secret.age @@ -0,0 +1,9 @@ +age-encryption.org/v1 +-> ssh-ed25519 K2vF/Q SYAkEEvz6aqkzh8r+TgvnwfQNJ3pLxGUcYmHK3DaNhM +ayICZI0Ctmw1AtIReiXx5KXUSz8qZtkRZQx9eNS0z1g +-> ssh-ed25519 kgCrKA Ii00pfHYObHJbBJziVQLUR43s61t0JOTT0YZJ9OaqE0 +NUJddte8zIZhrVtSeTU9iq9UW955ANlA6JZm8MQf+P8 +-> QrEy[-grease yS' ]r: PIx`w:SK +uaB9Bdjdf3Sy5fL1qQNsfYZhoCRG51MPDfw75A +--- 8jiDkupjnxMlSfXvJQGK4pVFDTuqNbsvHGsqLzDHjQ0 +eT8p` Gǁt4ѯ2Z/ +fxbTInϝ#R 5T9 4=Yd\aI \ No newline at end of file