add secrets for freshrss deploy
This commit is contained in:
		
							parent
							
								
									21dc4a1249
								
							
						
					
					
						commit
						cbc5c997ca
					
				|  | @ -9,19 +9,19 @@ | |||
|       (modulesPath + "/profiles/qemu-guest.nix") | ||||
|     ]; | ||||
| 
 | ||||
|   boot.initrd.availableKernelModules = [ "ata_piix" "floppy" "virtio_pci" "sr_mod" "virtio_blk" ]; | ||||
|   boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ]; | ||||
|   boot.initrd.kernelModules = [ ]; | ||||
|   boot.kernelModules = [ ]; | ||||
|   boot.extraModulePackages = [ ]; | ||||
| 
 | ||||
|   fileSystems."/" = | ||||
|     { | ||||
|       device = "/dev/disk/by-uuid/7c560634-d545-41cc-b375-42ce3037fd73"; | ||||
|       fsType = "ext4"; | ||||
|       device = "/dev/disk/by-uuid/3b8b2c4b-835e-4822-8ac8-0effdc8270d6"; | ||||
|       fsType = "btrfs"; | ||||
|     }; | ||||
| 
 | ||||
|   swapDevices = [ ]; | ||||
| 
 | ||||
|   hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; | ||||
|   nix.settings.max-jobs = lib.mkDefault 1; | ||||
|   nixpkgs.hostPlatform = "x86_64-linux"; | ||||
| } | ||||
|  |  | |||
|  | @ -9,19 +9,19 @@ | |||
|       (modulesPath + "/profiles/qemu-guest.nix") | ||||
|     ]; | ||||
| 
 | ||||
|   boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ]; | ||||
|   boot.initrd.availableKernelModules = [ "ata_piix" "floppy" "virtio_pci" "sr_mod" "virtio_blk" ]; | ||||
|   boot.initrd.kernelModules = [ ]; | ||||
|   boot.kernelModules = [ ]; | ||||
|   boot.extraModulePackages = [ ]; | ||||
| 
 | ||||
|   fileSystems."/" = | ||||
|     { | ||||
|       device = "/dev/disk/by-uuid/3b8b2c4b-835e-4822-8ac8-0effdc8270d6"; | ||||
|       fsType = "btrfs"; | ||||
|       device = "/dev/disk/by-uuid/7c560634-d545-41cc-b375-42ce3037fd73"; | ||||
|       fsType = "ext4"; | ||||
|     }; | ||||
| 
 | ||||
|   swapDevices = [ ]; | ||||
| 
 | ||||
|   nix.maxJobs = lib.mkDefault 1; | ||||
|   hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; | ||||
|   nixpkgs.hostPlatform = "x86_64-linux"; | ||||
| } | ||||
|  |  | |||
|  | @ -25,7 +25,7 @@ | |||
|         freshrss-users freshrss freshrss | ||||
|       ''; | ||||
|     # TODO with password | ||||
|     # ensureDatabases = [ "freshrss" ]; | ||||
|     ensureDatabases = [ "freshrss" ]; | ||||
|     ensureUsers = [ | ||||
|       { name = "freshrss"; ensurePermissions."DATABASE freshrss" = "ALL PRIVILEGES"; } | ||||
|     ]; | ||||
|  |  | |||
							
								
								
									
										9
									
								
								secrets/freshrss-dbpass.age
									
									
									
									
									
										Normal file
									
								
							
							
						
						
									
										9
									
								
								secrets/freshrss-dbpass.age
									
									
									
									
									
										Normal file
									
								
							|  | @ -0,0 +1,9 @@ | |||
| age-encryption.org/v1 | ||||
| -> ssh-ed25519 kgCrKA mLQH468uhh1m8iQKV2/jffzYVulg5jj4RPlzkHACTRU | ||||
| +COpkATGYfZdvknW47SUO66cG2susG/xU6cJV34fsUc | ||||
| -> r-grease 5 &J{s<$a- ug | ||||
| rAWQD4eZYzWTvtoHgf2GuMHPE8MULtfL8AUTgZRtMCREWqylQrLmOwYcXn0/er1i | ||||
| gE6vH3r6iLWrEZCpHB3uG0k | ||||
| --- PECN04bxeqDCaqrTE3eB+MIqG/lKrJhYyvIhnVdajVU | ||||
| ;¡zqIÏr¡·02É&K<<3C>nvü Œ<>Ê¥Æ1-Þõ´«Ë°¬ | ||||
| BüÊP©w…ªZ9ËzqÐU•°©ªèE | ||||
|  | @ -4,6 +4,7 @@ let | |||
|   system = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIMPcqWQ/L5nLTsBFHArl3AJb9xynhfsKenb5h0NNuMV root@curve"; | ||||
|   mossnet = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAA0bsVbdQR6iWNLKIiID57A1+dVXC58Dtf5cSXg6/JF root@box"; | ||||
|   lituus = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH2lAb33LH3JNuOfBXt971u0tHe+NURFecQdfjwEj+C+ root@lituus"; | ||||
|   helix = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAKrL6IDHNnHmxi0q9nzu87NOyidPm3HpE7klU368lEf root@helix"; | ||||
|   curve = [ system user ]; | ||||
|   allUserKeys = [ system user mossnet ]; | ||||
|   systemOnly = [ system mossnet ]; # lituus | ||||
|  | @ -15,6 +16,7 @@ in | |||
|   "box-wg.age".publicKeys = [ mossnet ]; | ||||
|   # "wallabag.age".publicKeys = [ mossnet ]; | ||||
|   "borg-password.age".publicKeys = systemOnly; | ||||
|   "freshrss-dbpass.age".publicKeys = [ helix ]; | ||||
|   "synapse-config.age".publicKeys = [ lituus ]; | ||||
|   "synapse-database-password.age".publicKeys = [ lituus ]; | ||||
|   "sealight-mod-password.age".publicKeys = [ lituus ]; | ||||
|  |  | |||
		Loading…
	
		Reference in a new issue