add secrets for freshrss deploy
This commit is contained in:
		
							parent
							
								
									21dc4a1249
								
							
						
					
					
						commit
						cbc5c997ca
					
				|  | @ -9,19 +9,19 @@ | ||||||
|       (modulesPath + "/profiles/qemu-guest.nix") |       (modulesPath + "/profiles/qemu-guest.nix") | ||||||
|     ]; |     ]; | ||||||
| 
 | 
 | ||||||
|   boot.initrd.availableKernelModules = [ "ata_piix" "floppy" "virtio_pci" "sr_mod" "virtio_blk" ]; |   boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ]; | ||||||
|   boot.initrd.kernelModules = [ ]; |   boot.initrd.kernelModules = [ ]; | ||||||
|   boot.kernelModules = [ ]; |   boot.kernelModules = [ ]; | ||||||
|   boot.extraModulePackages = [ ]; |   boot.extraModulePackages = [ ]; | ||||||
| 
 | 
 | ||||||
|   fileSystems."/" = |   fileSystems."/" = | ||||||
|     { |     { | ||||||
|       device = "/dev/disk/by-uuid/7c560634-d545-41cc-b375-42ce3037fd73"; |       device = "/dev/disk/by-uuid/3b8b2c4b-835e-4822-8ac8-0effdc8270d6"; | ||||||
|       fsType = "ext4"; |       fsType = "btrfs"; | ||||||
|     }; |     }; | ||||||
| 
 | 
 | ||||||
|   swapDevices = [ ]; |   swapDevices = [ ]; | ||||||
| 
 | 
 | ||||||
|   hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; |   nix.settings.max-jobs = lib.mkDefault 1; | ||||||
|   nixpkgs.hostPlatform = "x86_64-linux"; |   nixpkgs.hostPlatform = "x86_64-linux"; | ||||||
| } | } | ||||||
|  |  | ||||||
|  | @ -9,19 +9,19 @@ | ||||||
|       (modulesPath + "/profiles/qemu-guest.nix") |       (modulesPath + "/profiles/qemu-guest.nix") | ||||||
|     ]; |     ]; | ||||||
| 
 | 
 | ||||||
|   boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ]; |   boot.initrd.availableKernelModules = [ "ata_piix" "floppy" "virtio_pci" "sr_mod" "virtio_blk" ]; | ||||||
|   boot.initrd.kernelModules = [ ]; |   boot.initrd.kernelModules = [ ]; | ||||||
|   boot.kernelModules = [ ]; |   boot.kernelModules = [ ]; | ||||||
|   boot.extraModulePackages = [ ]; |   boot.extraModulePackages = [ ]; | ||||||
| 
 | 
 | ||||||
|   fileSystems."/" = |   fileSystems."/" = | ||||||
|     { |     { | ||||||
|       device = "/dev/disk/by-uuid/3b8b2c4b-835e-4822-8ac8-0effdc8270d6"; |       device = "/dev/disk/by-uuid/7c560634-d545-41cc-b375-42ce3037fd73"; | ||||||
|       fsType = "btrfs"; |       fsType = "ext4"; | ||||||
|     }; |     }; | ||||||
| 
 | 
 | ||||||
|   swapDevices = [ ]; |   swapDevices = [ ]; | ||||||
| 
 | 
 | ||||||
|   nix.maxJobs = lib.mkDefault 1; |   hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; | ||||||
|   nixpkgs.hostPlatform = "x86_64-linux"; |   nixpkgs.hostPlatform = "x86_64-linux"; | ||||||
| } | } | ||||||
|  |  | ||||||
|  | @ -25,7 +25,7 @@ | ||||||
|         freshrss-users freshrss freshrss |         freshrss-users freshrss freshrss | ||||||
|       ''; |       ''; | ||||||
|     # TODO with password |     # TODO with password | ||||||
|     # ensureDatabases = [ "freshrss" ]; |     ensureDatabases = [ "freshrss" ]; | ||||||
|     ensureUsers = [ |     ensureUsers = [ | ||||||
|       { name = "freshrss"; ensurePermissions."DATABASE freshrss" = "ALL PRIVILEGES"; } |       { name = "freshrss"; ensurePermissions."DATABASE freshrss" = "ALL PRIVILEGES"; } | ||||||
|     ]; |     ]; | ||||||
|  |  | ||||||
							
								
								
									
										9
									
								
								secrets/freshrss-dbpass.age
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										9
									
								
								secrets/freshrss-dbpass.age
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,9 @@ | ||||||
|  | age-encryption.org/v1 | ||||||
|  | -> ssh-ed25519 kgCrKA mLQH468uhh1m8iQKV2/jffzYVulg5jj4RPlzkHACTRU | ||||||
|  | +COpkATGYfZdvknW47SUO66cG2susG/xU6cJV34fsUc | ||||||
|  | -> r-grease 5 &J{s<$a- ug | ||||||
|  | rAWQD4eZYzWTvtoHgf2GuMHPE8MULtfL8AUTgZRtMCREWqylQrLmOwYcXn0/er1i | ||||||
|  | gE6vH3r6iLWrEZCpHB3uG0k | ||||||
|  | --- PECN04bxeqDCaqrTE3eB+MIqG/lKrJhYyvIhnVdajVU | ||||||
|  | ;¡zqIÏr¡·02É&K<<3C>nvü Œ<>Ê¥Æ1-Þõ´«Ë°¬ | ||||||
|  | BüÊP©w…ªZ9ËzqÐU•°©ªèE | ||||||
|  | @ -4,6 +4,7 @@ let | ||||||
|   system = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIMPcqWQ/L5nLTsBFHArl3AJb9xynhfsKenb5h0NNuMV root@curve"; |   system = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIMPcqWQ/L5nLTsBFHArl3AJb9xynhfsKenb5h0NNuMV root@curve"; | ||||||
|   mossnet = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAA0bsVbdQR6iWNLKIiID57A1+dVXC58Dtf5cSXg6/JF root@box"; |   mossnet = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAA0bsVbdQR6iWNLKIiID57A1+dVXC58Dtf5cSXg6/JF root@box"; | ||||||
|   lituus = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH2lAb33LH3JNuOfBXt971u0tHe+NURFecQdfjwEj+C+ root@lituus"; |   lituus = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH2lAb33LH3JNuOfBXt971u0tHe+NURFecQdfjwEj+C+ root@lituus"; | ||||||
|  |   helix = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAKrL6IDHNnHmxi0q9nzu87NOyidPm3HpE7klU368lEf root@helix"; | ||||||
|   curve = [ system user ]; |   curve = [ system user ]; | ||||||
|   allUserKeys = [ system user mossnet ]; |   allUserKeys = [ system user mossnet ]; | ||||||
|   systemOnly = [ system mossnet ]; # lituus |   systemOnly = [ system mossnet ]; # lituus | ||||||
|  | @ -15,6 +16,7 @@ in | ||||||
|   "box-wg.age".publicKeys = [ mossnet ]; |   "box-wg.age".publicKeys = [ mossnet ]; | ||||||
|   # "wallabag.age".publicKeys = [ mossnet ]; |   # "wallabag.age".publicKeys = [ mossnet ]; | ||||||
|   "borg-password.age".publicKeys = systemOnly; |   "borg-password.age".publicKeys = systemOnly; | ||||||
|  |   "freshrss-dbpass.age".publicKeys = [ helix ]; | ||||||
|   "synapse-config.age".publicKeys = [ lituus ]; |   "synapse-config.age".publicKeys = [ lituus ]; | ||||||
|   "synapse-database-password.age".publicKeys = [ lituus ]; |   "synapse-database-password.age".publicKeys = [ lituus ]; | ||||||
|   "sealight-mod-password.age".publicKeys = [ lituus ]; |   "sealight-mod-password.age".publicKeys = [ lituus ]; | ||||||
|  |  | ||||||
		Loading…
	
		Reference in a new issue