aynish/helm
1
0
Fork 0
Code Pull requests Packages Projects Releases Activity

add secrets for freshrss deploy

Browse source
This commit is contained in:
Anish Lakhwara 2022-12-07 20:10:15 +10:00
parent 21dc4a1249
commit cbc5c997ca
5 changed files with 20 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
hosts/helix/hardware-configuration.nix
View file

@ -9,19 +9,19 @@
(modulesPath + "/profiles/qemu-guest.nix") (modulesPath + "/profiles/qemu-guest.nix")
]; ];
boot.initrd.availableKernelModules = [ "ata_piix" "floppy" "virtio_pci" "sr_mod" "virtio_blk" ]; boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ];
boot.initrd.kernelModules = [ ]; boot.initrd.kernelModules = [ ];
boot.kernelModules = [ ]; boot.kernelModules = [ ];
boot.extraModulePackages = [ ]; boot.extraModulePackages = [ ];
fileSystems."/" = fileSystems."/" =
{ {
device = "/dev/disk/by-uuid/7c560634-d545-41cc-b375-42ce3037fd73"; device = "/dev/disk/by-uuid/3b8b2c4b-835e-4822-8ac8-0effdc8270d6";
fsType = "ext4"; fsType = "btrfs";
}; };
swapDevices = [ ]; swapDevices = [ ];
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; nix.settings.max-jobs = lib.mkDefault 1;
nixpkgs.hostPlatform = "x86_64-linux"; nixpkgs.hostPlatform = "x86_64-linux";
} }

8
hosts/lituus/hardware-configuration.nix
View file

@ -9,19 +9,19 @@
(modulesPath + "/profiles/qemu-guest.nix") (modulesPath + "/profiles/qemu-guest.nix")
]; ];
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ]; boot.initrd.availableKernelModules = [ "ata_piix" "floppy" "virtio_pci" "sr_mod" "virtio_blk" ];
boot.initrd.kernelModules = [ ]; boot.initrd.kernelModules = [ ];
boot.kernelModules = [ ]; boot.kernelModules = [ ];
boot.extraModulePackages = [ ]; boot.extraModulePackages = [ ];
fileSystems."/" = fileSystems."/" =
{ {
device = "/dev/disk/by-uuid/3b8b2c4b-835e-4822-8ac8-0effdc8270d6"; device = "/dev/disk/by-uuid/7c560634-d545-41cc-b375-42ce3037fd73";
fsType = "btrfs"; fsType = "ext4";
}; };
swapDevices = [ ]; swapDevices = [ ];
nix.maxJobs = lib.mkDefault 1; hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
nixpkgs.hostPlatform = "x86_64-linux"; nixpkgs.hostPlatform = "x86_64-linux";
} }

2
hosts/profiles/freshrss/default.nix
View file

@ -25,7 +25,7 @@
freshrss-users freshrss freshrss freshrss-users freshrss freshrss
''; '';
# TODO with password # TODO with password
# ensureDatabases = [ "freshrss" ]; ensureDatabases = [ "freshrss" ];
ensureUsers = [ ensureUsers = [
{ name = "freshrss"; ensurePermissions."DATABASE freshrss" = "ALL PRIVILEGES"; } { name = "freshrss"; ensurePermissions."DATABASE freshrss" = "ALL PRIVILEGES"; }
]; ];

9
secrets/freshrss-dbpass.age Normal file
View file

@ -0,0 +1,9 @@
age-encryption.org/v1
-> ssh-ed25519 kgCrKA mLQH468uhh1m8iQKV2/jffzYVulg5jj4RPlzkHACTRU
+COpkATGYfZdvknW47SUO66cG2susG/xU6cJV34fsUc
-> r-grease 5 &J{s<$a- ug
rAWQD4eZYzWTvtoHgf2GuMHPE8MULtfL8AUTgZRtMCREWqylQrLmOwYcXn0/er1i
gE6vH3r6iLWrEZCpHB3uG0k
--- PECN04bxeqDCaqrTE3eB+MIqG/lKrJhYyvIhnVdajVU
;¡zqIÏr¡·02É&K<<3C>nvü Œ<>Ê¥Æ1-Þõ´«Ë°¬
BüÊP©w…ªZ9ËzqÐU•°©ªèE

2
secrets/secrets.nix
View file

@ -4,6 +4,7 @@ let
system = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIMPcqWQ/L5nLTsBFHArl3AJb9xynhfsKenb5h0NNuMV root@curve"; system = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIMPcqWQ/L5nLTsBFHArl3AJb9xynhfsKenb5h0NNuMV root@curve";
mossnet = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAA0bsVbdQR6iWNLKIiID57A1+dVXC58Dtf5cSXg6/JF root@box"; mossnet = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAA0bsVbdQR6iWNLKIiID57A1+dVXC58Dtf5cSXg6/JF root@box";
lituus = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH2lAb33LH3JNuOfBXt971u0tHe+NURFecQdfjwEj+C+ root@lituus"; lituus = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH2lAb33LH3JNuOfBXt971u0tHe+NURFecQdfjwEj+C+ root@lituus";
helix = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAKrL6IDHNnHmxi0q9nzu87NOyidPm3HpE7klU368lEf root@helix";
curve = [ system user ]; curve = [ system user ];
allUserKeys = [ system user mossnet ]; allUserKeys = [ system user mossnet ];
systemOnly = [ system mossnet ]; # lituus systemOnly = [ system mossnet ]; # lituus
@ -15,6 +16,7 @@ in
"box-wg.age".publicKeys = [ mossnet ]; "box-wg.age".publicKeys = [ mossnet ];
# "wallabag.age".publicKeys = [ mossnet ]; # "wallabag.age".publicKeys = [ mossnet ];
"borg-password.age".publicKeys = systemOnly; "borg-password.age".publicKeys = systemOnly;
"freshrss-dbpass.age".publicKeys = [ helix ];
"synapse-config.age".publicKeys = [ lituus ]; "synapse-config.age".publicKeys = [ lituus ];
"synapse-database-password.age".publicKeys = [ lituus ]; "synapse-database-password.age".publicKeys = [ lituus ];
"sealight-mod-password.age".publicKeys = [ lituus ]; "sealight-mod-password.age".publicKeys = [ lituus ];