aynish/helm
1
0
Fork 0
Code Pull requests Packages Projects Releases Activity

add secrets for freshrss deploy

Browse source
This commit is contained in:
Anish Lakhwara 2022-12-07 20:10:15 +10:00
parent 21dc4a1249
commit cbc5c997ca
5 changed files with 20 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
hosts/helix/hardware-configuration.nix
View file

@ -9,19 +9,19 @@
(modulesPath + "/profiles/qemu-guest.nix")
];
boot.initrd.availableKernelModules = [ "ata_piix" "floppy" "virtio_pci" "sr_mod" "virtio_blk" ];
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{
device = "/dev/disk/by-uuid/7c560634-d545-41cc-b375-42ce3037fd73";
fsType = "ext4";
device = "/dev/disk/by-uuid/3b8b2c4b-835e-4822-8ac8-0effdc8270d6";
fsType = "btrfs";
};
swapDevices = [ ];
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
nix.settings.max-jobs = lib.mkDefault 1;
nixpkgs.hostPlatform = "x86_64-linux";
}

8
hosts/lituus/hardware-configuration.nix
View file

@ -9,19 +9,19 @@
(modulesPath + "/profiles/qemu-guest.nix")
];
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ];
boot.initrd.availableKernelModules = [ "ata_piix" "floppy" "virtio_pci" "sr_mod" "virtio_blk" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{
device = "/dev/disk/by-uuid/3b8b2c4b-835e-4822-8ac8-0effdc8270d6";
fsType = "btrfs";
device = "/dev/disk/by-uuid/7c560634-d545-41cc-b375-42ce3037fd73";
fsType = "ext4";
};
swapDevices = [ ];
nix.maxJobs = lib.mkDefault 1;
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
nixpkgs.hostPlatform = "x86_64-linux";
}

2
hosts/profiles/freshrss/default.nix
View file

@ -25,7 +25,7 @@
freshrss-users freshrss freshrss
'';
# TODO with password
# ensureDatabases = [ "freshrss" ];
ensureDatabases = [ "freshrss" ];
ensureUsers = [
{ name = "freshrss"; ensurePermissions."DATABASE freshrss" = "ALL PRIVILEGES"; }
];

9
secrets/freshrss-dbpass.age Normal file
View file

@ -0,0 +1,9 @@
age-encryption.org/v1
-> ssh-ed25519 kgCrKA mLQH468uhh1m8iQKV2/jffzYVulg5jj4RPlzkHACTRU
+COpkATGYfZdvknW47SUO66cG2susG/xU6cJV34fsUc
-> r-grease 5 &J{s<$a- ug
rAWQD4eZYzWTvtoHgf2GuMHPE8MULtfL8AUTgZRtMCREWqylQrLmOwYcXn0/er1i
gE6vH3r6iLWrEZCpHB3uG0k
--- PECN04bxeqDCaqrTE3eB+MIqG/lKrJhYyvIhnVdajVU
;¡zqIÏr¡·02É&K<<3C>nvü Œ<>Ê¥Æ1-Þõ´«Ë°¬
BüÊP©w…ªZ9ËzqÐU•°©ªèE

2
secrets/secrets.nix
View file

@ -4,6 +4,7 @@ let
system = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIMPcqWQ/L5nLTsBFHArl3AJb9xynhfsKenb5h0NNuMV root@curve";
mossnet = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAA0bsVbdQR6iWNLKIiID57A1+dVXC58Dtf5cSXg6/JF root@box";
lituus = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH2lAb33LH3JNuOfBXt971u0tHe+NURFecQdfjwEj+C+ root@lituus";
helix = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAKrL6IDHNnHmxi0q9nzu87NOyidPm3HpE7klU368lEf root@helix";
curve = [ system user ];
allUserKeys = [ system user mossnet ];
systemOnly = [ system mossnet ]; # lituus
@ -15,6 +16,7 @@ in
"box-wg.age".publicKeys = [ mossnet ];
# "wallabag.age".publicKeys = [ mossnet ];
"borg-password.age".publicKeys = systemOnly;
"freshrss-dbpass.age".publicKeys = [ helix ];
"synapse-config.age".publicKeys = [ lituus ];
"synapse-database-password.age".publicKeys = [ lituus ];
"sealight-mod-password.age".publicKeys = [ lituus ];