diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml deleted file mode 100644 index 05a052c..0000000 --- a/.gitlab-ci.yml +++ /dev/null @@ -1,23 +0,0 @@ -stages: - - eval - - build - - push - -"Evaluate for builds": - stage: eval - tags: - - kubernetes - image: "$CI_REGISTRY/greg/ci-images/builder:latest" - artifacts: - paths: - - gitlab-ci-continue.yml - script: nix run ".#gen-build" > gitlab-ci-continue.yml - -"Trigger builds": - stage: build - trigger: - include: - - artifact: gitlab-ci-continue.yml - job: "Evaluate for builds" - variables: - PARENT_PIPELINE_ID: $CI_PIPELINE_ID diff --git a/home/baseline/nushell/functions.nu b/home/baseline/nushell/functions.nu index 0efb5f9..96da615 100644 --- a/home/baseline/nushell/functions.nu +++ b/home/baseline/nushell/functions.nu @@ -1,5 +1,5 @@ # vim: set filetype=nushell : -let servers = [isaiah jeremiah zeke genesis vm-gitlab] +let servers = [isaiah jeremiah zeke genesis] def par-map [ items: list, c: closure ] { let results = $items | par-each -k $c diff --git a/home/baseline/xonsh_footer.xsh b/home/baseline/xonsh_footer.xsh index a1436ca..c4a895f 100644 --- a/home/baseline/xonsh_footer.xsh +++ b/home/baseline/xonsh_footer.xsh @@ -38,11 +38,6 @@ def _ivr2(args): vpn("gregory_hellings@ra.ivrtechnology.com", "IVR Technology") aliases['ivr2'] = _ivr2 -def _glrestart(args): - sudo nixos-container run gitlab -- systemctl restart gitlab - sudo nixos-container run gitlab -- systemctl restart nginx -aliases['glrestart'] = _glrestart - def _aws_creds(args): $AWS_ACCESS_KEY_ID=$(bw get username "AWS Access Key") $AWS_SECRET_ACCESS_KEY=$(bw get password "AWS Access Key") diff --git a/hosts/default.nix b/hosts/default.nix index eddf4ca..3142fb7 100644 --- a/hosts/default.nix +++ b/hosts/default.nix @@ -45,16 +45,6 @@ in }) ) ) -// (lib.genAttrs - (builtins.attrNames (lib.filterAttrs (_: v: v == "directory") (builtins.readDir ./vm))) - ( - name: - (unstable { - inherit name; - extraMods = [ ./vm/${name} ]; - }) - ) -) // { # nix build '.#nixosConfigurations.wsl.config.system.build.installer' #nixos = wsl { name = "wsl"; }; @@ -63,26 +53,4 @@ in # name = "wsl"; # system = "aarch64-linux"; #}; - - builder-aarch = lib.nixosSystem { - system = "aarch64-linux"; - modules = [ - "${top.nixunstable}/nixos/modules/profiles/nix-builder-vm.nix" - { - virtualisation.host.pkgs = import top.nixunstable { system = "aarch64-darwin"; }; - boot.loader.grub.devices = [ "/dev/vda" ]; - } - ]; - }; - - builder-x86 = lib.nixosSystem { - system = "x86_64-linux"; - modules = [ - "${top.nixunstable}/nixos/modules/profiles/nix-builder-vm.nix" - { - virtualisation.host.pkgs = import top.nixunstable { system = "aarch64-darwin"; }; - boot.loader.grub.devices = [ "/dev/vda" ]; - } - ]; - }; } diff --git a/hosts/unstable/exodus/default.nix b/hosts/unstable/exodus/default.nix index 672b429..405c695 100644 --- a/hosts/unstable/exodus/default.nix +++ b/hosts/unstable/exodus/default.nix @@ -43,10 +43,6 @@ enable = true; tags = [ "mobile" ]; }; - runner = { - enable = true; - qemu = true; - }; }; hardware = { diff --git a/hosts/unstable/genesis/net/hosts b/hosts/unstable/genesis/net/hosts index 1025e81..0459145 100644 --- a/hosts/unstable/genesis/net/hosts +++ b/hosts/unstable/genesis/net/hosts @@ -22,8 +22,6 @@ # VMs 10.42.4.1 matrix matrix.thehellings.lan -#10.42.4.2 vm-jellyfin vm-jellyfin.thehellings.lan -10.42.4.3 git gitlab git.thehellings.lan gitlab.thehellings.lan # VIP 10.42.5.1 longhorn.cluster matrix.cluster pgadmin.cluter postgres.cluster immich.cluster @@ -37,7 +35,6 @@ 100.88.91.27 dns.home 100.70.99.91 exodus.home exodus.shire-zebra.ts.net 100.96.198.104 genesis.home genesis.shire-zebra.ts.net smart.home zwave.home nixcache.home gitcache.home dashy.home uptime.home speed.home -100.117.28.111 gitlab.home gitlab.shire-zebra.ts.net gitlab.thehellings.lan registry.thehellings.lan git.thehellings.lan 100.68.203.1 hosea.home hosea.shire-zebra.ts.net grafana.home 100.84.183.79 isaiah.home isaiah.shire-zebra.ts.net pgadmin.kubernetes longhorn.kubernetes 100.102.186.39 jeremiah.home jeremiah.shire-zebra.ts.net matrix.kubernetes immich.kubernetes postgres.kubernetes buildbot.home diff --git a/hosts/unstable/isaiah/default.nix b/hosts/unstable/isaiah/default.nix index 2a63d66..357164b 100644 --- a/hosts/unstable/isaiah/default.nix +++ b/hosts/unstable/isaiah/default.nix @@ -43,10 +43,6 @@ tags = [ "home" ]; }; remote-builder.enable = true; - runner = { - enable = true; - qemu = true; - }; gitea-runner = { enable = true; extraLabels = [ "bare-metal:host" ]; diff --git a/hosts/unstable/jeremiah/default.nix b/hosts/unstable/jeremiah/default.nix index c1a10dd..270ac3c 100644 --- a/hosts/unstable/jeremiah/default.nix +++ b/hosts/unstable/jeremiah/default.nix @@ -22,8 +22,6 @@ in ]; age.secrets = { - runner-reg.file = ../../../secrets/gitlab/nixos-qemu-shell.age; - gitea-buildbotWorkersFile = mk ../../../secrets/gitea/buildbotWorkersFile.age; gitea-oauthToken = mk ../../../secrets/gitea/oauthToken.age; gitea-oauthSecret = mk ../../../secrets/gitea/oauthSecret.age; @@ -95,11 +93,6 @@ in tags = [ "home" ]; }; remote-builder.enable = true; - runner = { - enable = true; - threads = 3; - qemu = true; - }; }; hardware = { diff --git a/hosts/unstable/linode/default.nix b/hosts/unstable/linode/default.nix index d579ee1..b7534c5 100644 --- a/hosts/unstable/linode/default.nix +++ b/hosts/unstable/linode/default.nix @@ -66,20 +66,4 @@ immichUrl = "https://immich.shire-zebra.ts.net"; }; }; - - security.sudo.extraRules = [ - { - users = [ "gitlab-runner" ]; - commands = [ - { - command = "/run/current-system/sw/bin/systemctl"; - options = [ "NOPASSWD" ]; - } - { - command = "/run/current-system/sw/bin/podman"; - options = [ "NOPASSWD" ]; - } - ]; - } - ]; } diff --git a/hosts/unstable/linode/nginx.nix b/hosts/unstable/linode/nginx.nix index e0a933c..11af23f 100644 --- a/hosts/unstable/linode/nginx.nix +++ b/hosts/unstable/linode/nginx.nix @@ -24,7 +24,6 @@ in virtualisation.oci-containers = { backend = "podman"; containers."homepage" = { - # needs explicit port to match what gitlab-runner sees when pulling image = "registry.thehellings.com:443/greg/homepage/gregs-homepage:latest"; ports = [ "${homepage}:80" ]; }; diff --git a/hosts/unstable/zeke/default.nix b/hosts/unstable/zeke/default.nix index 968194b..0b9e329 100644 --- a/hosts/unstable/zeke/default.nix +++ b/hosts/unstable/zeke/default.nix @@ -28,10 +28,6 @@ }; nebula.enable = true; remote-builder.enable = true; - runner = { - enable = true; - vbox = false; - }; tailscale = { enable = true; tags = [ "home" ]; diff --git a/hosts/vm/gitlab/default.nix b/hosts/vm/gitlab/default.nix deleted file mode 100644 index aace489..0000000 --- a/hosts/vm/gitlab/default.nix +++ /dev/null @@ -1,273 +0,0 @@ -# Edit this configuration file to define what should be installed on -# your system. Help is available in the configuration.nix(5) man page -# and in the NixOS manual (accessible by running ‘nixos-help’). - -{ - config, - pkgs, - lib, - ... -}: - -let - registryPort = 5000; - vpnIp = "100.117.28.111"; -in -{ - imports = [ - ./hardware-configuration.nix - ]; - - age.secrets = - let - cfg = n: { - file = ../../../secrets/gitlab/${n}.age; - owner = "gitlab"; - group = "gitlab"; - mode = "0444"; - }; - in - { - gitlab-secret = cfg "secret"; - gitlab-otp = cfg "otp"; - gitlab-db = cfg "db"; - gitlab-db-password = cfg "db-password"; - gitlab-jws = cfg "jws"; - gitlab-key = cfg "key"; - gitlab-cert = cfg "cert"; - gitlab-salt = cfg "salt"; - gitlab-primary-key = cfg "primary-key"; - gitlab-deterministic-key = cfg "deterministic-key"; - - minio_access_key_id = { - file = ../../../secrets/minio_access_key_id.age; - owner = "gitlab"; - group = "gitlab"; - mode = "0444"; - }; - minio_secret_access_key = { - file = ../../../secrets/minio_secret_access_key.age; - owner = "gitlab"; - group = "gitlab"; - mode = "0444"; - }; - }; - - greg = { - backup.jobs.nas-backup = { - src = "/var/gitlab/state/backup/"; - dest = "gitlab"; - }; - home = true; - tailscale = { - enable = true; - tags = [ "home" ]; - }; - }; - - networking = { - hostName = "gitlab"; # Define your hostname. - firewall.allowedTCPPorts = [ - 80 - registryPort - ]; - }; - - services = { - gitlab = { - enable = true; - backup = { - keepTime = 288; - startAt = [ "03:00" ]; - }; - databaseHost = "postgres.kubernetes"; - databaseName = "gitlab"; - databaseUsername = "gitlab"; - databasePasswordFile = config.age.secrets.gitlab-db-password.path; - databaseCreateLocally = false; - extraConfig = { - registry.port = null; - gitlab = { - trustedProxies = [ - "${vpnIp}/32" # The system itself - "100.109.86.8/32" # Public server's IP - ]; - }; - object_store = { - enabled = true; - proxy_download = true; # Tell them to reach out to object storage themselves! - connection = { - provider = "AWS"; - endpoint = "http://s3.thehellings.lan:9000"; - region = "us-east-1"; - aws_access_key_id = { - _secret = config.age.secrets.minio_access_key_id.path; - }; - aws_secret_access_key = { - _secret = config.age.secrets.minio_secret_access_key.path; - }; - path_style = true; # True for MinIO - aws_signature_version = 2; - }; - #storage_options = ...; - objects = builtins.listToAttrs ( - builtins.map - ( - x: lib.attrsets.nameValuePair x { bucket = "gitlab-${builtins.replaceStrings [ "_" ] [ "-" ] x}"; } - ) - [ - "artifacts" - "ci_secure_files" - "dependency_proxy" - "external_diffs" - "lfs" - "packages" - "pages" - "terraform_state" - "uploads" - ] - ); - }; - }; - host = "src.thehellings.com"; - https = true; - initialRootEmail = "greg@thehellings.com"; - initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password"; - pages = { - enable = true; - settings.pages-domain = "pages.thehellings.com"; - }; - port = 443; - puma = { - threadsMax = 6; - threadsMin = 2; - workers = 6; - }; - redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}"; - registry = { - enable = true; - certFile = config.age.secrets.gitlab-cert.path; - keyFile = config.age.secrets.gitlab-key.path; - externalAddress = "registry.thehellings.com"; - externalPort = 443; - }; - secrets = { - activeRecordDeterministicKeyFile = config.age.secrets.gitlab-deterministic-key.path; - activeRecordPrimaryKeyFile = config.age.secrets.gitlab-primary-key.path; - activeRecordSaltFile = config.age.secrets.gitlab-salt.path; - dbFile = config.age.secrets.gitlab-db.path; - jwsFile = config.age.secrets.gitlab-jws.path; - otpFile = config.age.secrets.gitlab-otp.path; - secretFile = config.age.secrets.gitlab-secret.path; - }; - }; - - nginx = { - enable = true; - clientMaxBodySize = "25000m"; - virtualHosts = { - "vm-gitlab.shire-zebra.ts.net" = { - listen = [ - { - addr = "0.0.0.0"; - port = 443; - ssl = true; - } - ]; - locations."/" = { - proxyPass = "http://unix:/run/gitlab/gitlab-workhorse.socket"; - recommendedProxySettings = true; - }; - extraConfig = '' - ssl_certificate /etc/certs/vm-gitlab.shire-zebra.ts.net.crt ; - ssl_certificate_key /etc/certs/vm-gitlab.shire-zebra.ts.net.key ; - client_max_body_size 10000m ; - ''; - }; - "registry" = { - listen = [ - { - addr = "0.0.0.0"; - port = registryPort; - ssl = true; - } - ]; - locations."/" = { - proxyPass = "http://127.0.0.1:4567/"; - recommendedProxySettings = true; - }; - extraConfig = '' - ssl_certificate /etc/certs/vm-gitlab.shire-zebra.ts.net.crt ; - ssl_certificate_key /etc/certs/vm-gitlab.shire-zebra.ts.net.key ; - client_max_body_size 25000m ; - ''; - serverAliases = [ - "vm-gitlab.shire-zebra.ts.net" - ]; - }; - }; - }; - - openssh.enable = true; - - postgresql.enable = true; - - qemuGuest.enable = true; - - redis.servers.gitlab = { - enable = true; - }; - - #resolved.enable = true; - }; - - # Do not start nginx until we have tailscaled up and running, so it can bind - # to the 100.* addresses - systemd = { - services = { - certRefresh = - let - script = pkgs.writeShellApplication { - name = "cert-refresh"; - runtimeInputs = [ pkgs.tailscale ]; - - text = '' - cd /etc/certs - tailscale cert vm-gitlab.shire-zebra.ts.net - chown nginx ./* - systemctl reload nginx - ''; - }; - in - { - script = lib.getExe script; - serviceConfig = { - Type = "oneshot"; - User = "root"; - }; - }; - - nginx = rec { - after = [ "network-online.target" ]; - requires = [ "network-online.target" ]; - wants = after; - serviceConfig = { - RestartMaxDelaySec = "30s"; - RestartSteps = "5"; - }; - }; - tailscaled.partOf = [ "network-online.target" ]; - }; - - timers = { - "cert-refresh" = { - wantedBy = [ "cert-refresh.service" ]; - timerConfig = { - OnCalendar = "monthly"; - Persistent = true; - }; - }; - }; - }; - system.stateVersion = lib.mkForce "24.11"; -} diff --git a/hosts/vm/gitlab/hardware-configuration.nix b/hosts/vm/gitlab/hardware-configuration.nix deleted file mode 100644 index 7ff9d2c..0000000 --- a/hosts/vm/gitlab/hardware-configuration.nix +++ /dev/null @@ -1,58 +0,0 @@ -# Do not modify this file! It was generated by ‘nixos-generate-config’ -# and may be overwritten by future invocations. Please make changes -# to /etc/nixos/configuration.nix instead. -{ - lib, - modulesPath, - ... -}: - -{ - imports = [ - (modulesPath + "/profiles/qemu-guest.nix") - ]; - - # Bootloader. - boot = { - extraModulePackages = [ ]; - initrd = { - availableKernelModules = [ - "uhci_hcd" - "ehci_pci" - "ahci" - "virtio_pci" - "virtio_scsi" - "sd_mod" - "sr_mod" - ]; - kernelModules = [ ]; - }; - loader = { - efi.canTouchEfiVariables = true; - systemd-boot.enable = true; - }; - }; - - fileSystems."/" = { - device = lib.mkDefault "/dev/disk/by-uuid/1fdbe86e-ce6f-4af3-a876-aec35731adab"; - fsType = "ext4"; - }; - - fileSystems."/boot" = { - device = "/dev/disk/by-uuid/1E6A-C3BB"; - fsType = "vfat"; - options = [ - "fmask=0077" - "dmask=0077" - ]; - }; - - swapDevices = [ ]; - - # Enables DHCP on each ethernet and wireless interface. In case of scripted networking - # (the default) this is the recommended approach. When using systemd-networkd it's - # still possible to use this option, but it's recommended to use it in conjunction - # with explicit per-interface declarations with `networking.interfaces..useDHCP`. - networking.useDHCP = lib.mkDefault true; - # networking.interfaces.enp6s18.useDHCP = lib.mkDefault true; -} diff --git a/manifests/bitwarden/deployment.yaml b/manifests/bitwarden/deployment.yaml index 5b0938b..1a91b0a 100644 --- a/manifests/bitwarden/deployment.yaml +++ b/manifests/bitwarden/deployment.yaml @@ -21,9 +21,6 @@ spec: spec: containers: - name: bitwarden-cli - # Since my gitlab instance depends on the database hosted in k3s, and - # the database depends on this image, I need a way to bootstrap the - # system if # I am doing disaster recovery. And this is it. image: "ghcr.io/greg-hellings/nixos-config/img-bitwarden:latest" #image: >- # registry.thehellings.com/greg/nixos-config/img-bitwarden:latest diff --git a/manifests/databases/ingress.yaml b/manifests/databases/ingress.yaml index a2c1f52..bc9a823 100644 --- a/manifests/databases/ingress.yaml +++ b/manifests/databases/ingress.yaml @@ -14,14 +14,12 @@ spec: - 100.88.91.27 # dns? - 100.80.99.48 # exodus - 100.88.91.27 # genesis - - 100.117.28.111 # gitlab - 100.68.203.1 # hosea - 100.84.183.79 # isaiah - 100.102.186.39 # jeremiah - 100.90.74.19 # zeke - 100.115.57.8 # linode - 100.65.5.38 # matrix - #- 100.127.55.22 # jellyfin --- apiVersion: traefik.io/v1alpha1 kind: IngressRouteTCP diff --git a/manifests/databases/kustomization.yaml b/manifests/databases/kustomization.yaml index 3d46a2d..f1cea26 100644 --- a/manifests/databases/kustomization.yaml +++ b/manifests/databases/kustomization.yaml @@ -4,7 +4,6 @@ resources: - namespace.yaml - secrets.yaml - postgres-cluster.yaml - - postgres-gitlab.yaml - postgres-pgadmin.yaml - postgres-matrix.yaml - ingress.yaml diff --git a/manifests/databases/postgres-cluster.yaml b/manifests/databases/postgres-cluster.yaml index d1c0b6e..1713ed5 100644 --- a/manifests/databases/postgres-cluster.yaml +++ b/manifests/databases/postgres-cluster.yaml @@ -11,13 +11,6 @@ spec: managed: roles: - - name: gitlab - ensure: present - comment: Gitlab user - login: true - superuser: false - passwordSecret: - name: postgres-user-gitlab - name: pgadmin ensure: present comment: PG Admin user diff --git a/manifests/databases/postgres-gitlab.yaml b/manifests/databases/postgres-gitlab.yaml deleted file mode 100644 index f41796f..0000000 --- a/manifests/databases/postgres-gitlab.yaml +++ /dev/null @@ -1,9 +0,0 @@ -apiVersion: postgresql.cnpg.io/v1 -kind: Database -metadata: - name: database-gitlab -spec: - name: gitlab - owner: gitlab - cluster: - name: postgres diff --git a/manifests/databases/secrets.yaml b/manifests/databases/secrets.yaml index 946b660..0039fbc 100644 --- a/manifests/databases/secrets.yaml +++ b/manifests/databases/secrets.yaml @@ -1,39 +1,5 @@ apiVersion: external-secrets.io/v1 kind: ExternalSecret -metadata: - name: postgres-user-gitlab - namespace: db -spec: - target: - name: postgres-user-gitlab - deletionPolicy: Delete - template: - type: Opaque - data: - username: |- - {{ .username }} - password: |- - {{ .password }} - data: - - secretKey: username - sourceRef: - storeRef: - name: bitwarden-login - kind: ClusterSecretStore - remoteRef: - key: 5282ad16-c2dc-49d3-8fb3-b2e9012bab57 - property: username - - secretKey: password - sourceRef: - storeRef: - name: bitwarden-login - kind: ClusterSecretStore - remoteRef: - key: 5282ad16-c2dc-49d3-8fb3-b2e9012bab57 - property: password ---- -apiVersion: external-secrets.io/v1 -kind: ExternalSecret metadata: name: postgres-user-matrix namespace: db diff --git a/manifests/gitlab-runner/chart.yaml b/manifests/gitlab-runner/chart.yaml deleted file mode 100644 index 4d8d58b..0000000 --- a/manifests/gitlab-runner/chart.yaml +++ /dev/null @@ -1,64 +0,0 @@ -apiVersion: source.toolkit.fluxcd.io/v1 -kind: HelmRepository -metadata: - name: gitlab-runner -spec: - interval: "24h" - url: https://charts.gitlab.io ---- -apiVersion: helm.toolkit.fluxcd.io/v2 -kind: HelmRelease -metadata: - name: gitlab-runner -spec: - interval: 10m - chart: - spec: - chart: gitlab-runner - version: "0.83.1" - sourceRef: - kind: HelmRepository - name: gitlab-runner - interval: "1h" - dependsOn: - - name: external-secrets - namespace: external-secrets - - name: tailscae - namespace: tailscale - values: - crds: - create: true - includeCRDs: true - gitlabUrl: https://src.thehellings.com - runners: - secret: gitlab-runner - imagePullSecrets: - - name: image-pull-secrets - rbac: - create: true - serviceAccount: - create: true - metrics: - enabled: true - extraEnv: - CACHE_TYPE: s3 - CACHE_SHARED: "true" - CACHE_S3_BUCKET_NAME: gitlab-runner-cache - CACHE_S3_INSECURE: "true" - extraEnvFrom: - PACKER_GITHUB_API_TOKEN: - secretKeyRef: - name: gitlab-runner - key: PACKER_GITHUB_API_TOKEN - CACHE_S3_SERVER_ADDRESS: - secretKeyRef: - name: gitlab-runner - key: CACHE_S3_SERVER_ADDRESS - CACHE_S3_ACCESS_KEY: - secretKeyRef: - name: s3-access - key: username - CACHE_S3_SECRET_KEY: - secretKeyRef: - name: s3-access - key: password diff --git a/manifests/gitlab-runner/kustomization.yaml b/manifests/gitlab-runner/kustomization.yaml deleted file mode 100644 index 195cdcd..0000000 --- a/manifests/gitlab-runner/kustomization.yaml +++ /dev/null @@ -1,6 +0,0 @@ -namespace: gitlab-runner - -resources: - - namespace.yaml - - secrets.yaml - - chart.yaml diff --git a/manifests/gitlab-runner/namespace.yaml b/manifests/gitlab-runner/namespace.yaml deleted file mode 100644 index 15d2f7d..0000000 --- a/manifests/gitlab-runner/namespace.yaml +++ /dev/null @@ -1,4 +0,0 @@ -apiVersion: v1 -kind: Namespace -metadata: - name: gitlab-runner diff --git a/manifests/gitlab-runner/secrets.yaml b/manifests/gitlab-runner/secrets.yaml deleted file mode 100644 index 6c2094e..0000000 --- a/manifests/gitlab-runner/secrets.yaml +++ /dev/null @@ -1,101 +0,0 @@ -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: gitlab-runner - namespace: gitlab-runner -spec: - secretStoreRef: - name: bitwarden-fields - kind: ClusterSecretStore - target: - name: gitlab-runner - deletionPolicy: Delete - template: - type: Opaque - data: - runner-registration-token: "" - runner-token: "{{ .runnerToken }}" - PACKER_GITHUB_API_TOKEN: "{{ .PACKER_GITHUB_API_TOKEN }}" - CACHE_S3_SERVER_ADDRESS: "{{ .CACHE_S3_SERVER_ADDRESS }}" - data: - - secretKey: runnerToken - remoteRef: - key: &key 53719920-b100-4355-8c80-b2f9002fad22 - property: CI_SERVER_TOKEN - - secretKey: PACKER_GITHUB_API_TOKEN - remoteRef: - key: *key - property: PACKER_GITHUB_API_TOKEN - - secretKey: CACHE_S3_SERVER_ADDRESS - remoteRef: - key: *key - property: CACHE_S3_SERVER_ADDRESS - # Includes - # CI_SERVER_TOKEN - # PACKER_GITHUB_API_TOKEN - # CACHE_S3_SERVER_ADDRESS ---- -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: s3-access - namespace: gitlab-runner -spec: - secretStoreRef: - name: bitwarden-login - kind: ClusterSecretStore - target: - name: s3-access - deletionPolicy: Delete - data: - - secretKey: username - remoteRef: - key: &key 04dd39c2-268d-4a33-aa4c-b1550166139f - property: username - - secretKey: password - remoteRef: - key: *key - property: password ---- -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: image-pull-secrets - namespace: gitlab-runner -spec: - secretStoreRef: - name: bitwarden-login - kind: ClusterSecretStore - target: - deletionPolicy: Delete - template: - type: kubernetes.io/dockerconfigjson - data: - .dockerconfigjson: >- - { - "auths": { - "https://index.docker.io/v1/": { - "username": "{{ .user }}", - "password": "{{ .password }}", - "email": "greg.hellings@gmail.com", - "auth": "{{ .auth }}" - } - } - } - data: - - secretKey: user - remoteRef: - key: &key f560ae38-368c-4e58-898c-aeb90012d597 - property: username - - secretKey: password - remoteRef: - key: *key - property: password - - secretKey: auth - sourceRef: - storeRef: - name: bitwarden-fields - kind: ClusterSecretStore - remoteRef: - key: *key - property: auth diff --git a/manifests/kustomization.yaml b/manifests/kustomization.yaml index 223266c..7bb25f3 100644 --- a/manifests/kustomization.yaml +++ b/manifests/kustomization.yaml @@ -7,7 +7,6 @@ resources: - mariadb-operator - databases - matrix - #- gitlab-runner - immich - monitoring - pinchflat diff --git a/modules/nixos/default.nix b/modules/nixos/default.nix index 47a9ebd..a0676c5 100644 --- a/modules/nixos/default.nix +++ b/modules/nixos/default.nix @@ -10,7 +10,6 @@ ./ceph.nix ./db.nix ./gitea-runner.nix - ./gitlab-runner.nix ./gnome.nix ./home.nix ./kde.nix diff --git a/modules/nixos/gitlab-runner.nix b/modules/nixos/gitlab-runner.nix deleted file mode 100644 index 4723064..0000000 --- a/modules/nixos/gitlab-runner.nix +++ /dev/null @@ -1,82 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: -let - cfg = config.greg.runner; - environmentVariables = { - EFI_DIR = "${pkgs.OVMF.fd}/FV/"; - STORAGE_URL = "s3.thehellings.lan:9000"; - }; - runnerCfg = file: { - inherit environmentVariables; - authenticationTokenConfigFile = file; - executor = "shell"; - limit = cfg.threads; - }; -in -# We want exactly one of these to be true, but not both. Neither can both be false -{ - options.greg.runner = { - enable = lib.mkEnableOption "Enable as a gitlab-runner with both libvirt and virtualbox"; - - threads = lib.mkOption { - default = 5; - type = lib.types.int; - description = "The maximum number of concurrent jobs"; - }; - - qemu = lib.mkEnableOption "Enable the qemu host (mutually exclusive with vbox)"; - vbox = lib.mkEnableOption "Enable the vbox host (mutually exclusive with qemu)"; - }; - - config = lib.mkIf cfg.enable ({ - # assertions = [ - # { - # assertion = cfg.qemu || cfg.vbox && (cfg.qemu != cfg.vbox); - # message = "You must enable exactly one of qemu or vbox"; - # } - # ]; - # Shared configurations - age.secrets = { - qemu.file = ../../secrets/gitlab/nixos-qemu-shell.age; - vbox.file = ../../secrets/gitlab/nixos-vbox-shell.age; - }; - - services.gitlab-runner = { - enable = false; - settings.concurrent = cfg.threads; - services = { - qemu = lib.mkIf cfg.qemu (runnerCfg config.age.secrets.qemu.path); - vbox = lib.mkIf cfg.vbox (runnerCfg config.age.secrets.vbox.path); - }; - }; - - systemd.services.gitlab-runner = { - serviceConfig = { - DevicePolicy = lib.mkForce "auto"; - User = "root"; - DynamicUser = lib.mkForce false; - }; - }; - - users.extraGroups.vboxusers.members = lib.optional cfg.vbox "greg"; - - virtualisation = { - libvirtd = lib.mkIf cfg.qemu { - enable = true; - allowedBridges = [ - "br0" - "virbr0" - ]; - onBoot = "ignore"; # only restart VMs labeled 'autostart' - }; - virtualbox.host = lib.mkIf cfg.vbox { - enable = true; - enableExtensionPack = true; - }; - }; - }); -} diff --git a/modules/nixos/syncthing.nix b/modules/nixos/syncthing.nix index be78739..e41f668 100644 --- a/modules/nixos/syncthing.nix +++ b/modules/nixos/syncthing.nix @@ -18,7 +18,6 @@ with lib; devices = { chronicles.id = "7FI6Y3M-C7YQEDI-IB345L6-RKLXMB6-AEIV57Y-3J2RCXQ-MK6QRNK-EINPXAE"; genesis.id = "YDTH4SD-GUAC5AA-SSYWYPZ-YMJW5LK-LE7PZKJ-GV2UJFZ-CU7LZAD-GTYWCQK"; - gitlab.id = "GKNOZWI-CNC2Q2F-R5GGGDX-RYFGHK4-CCC37LC-GVOEMJI-46QPC6G-AWFEOQE"; linode.id = "IJMMXPR-WNALZBD-FMJH5W5-WV7XGJY-HLJTKGT-5TKHJIH-75LT56D-UUZCYQE"; }; options = { diff --git a/network.json b/network.json index 00baae0..8cecb1d 100644 --- a/network.json +++ b/network.json @@ -121,9 +121,6 @@ "external": true, "system": "x86_64-linux" }, - "gitlab": { - "system": "x86_64-linux" - }, "wsl": { "external": true, "system": "aarch64-linux" diff --git a/secrets/gitlab/cert.age b/secrets/gitlab/cert.age deleted file mode 100644 index 3d94af0..0000000 Binary files a/secrets/gitlab/cert.age and /dev/null differ diff --git a/secrets/gitlab/db-password.age b/secrets/gitlab/db-password.age deleted file mode 100644 index bdae96b..0000000 --- a/secrets/gitlab/db-password.age +++ /dev/null @@ -1,37 +0,0 @@ -age-encryption.org/v1 --> ssh-ed25519 87huqg Eh2E7tXjZj6ydDOSsFD8UKMjSjLWW6YZg/5bzcdMaSU -0vXZ9AGU3N8Jbep6TRijGKoo89jK0yauG1LmErtdT70 --> ssh-ed25519 8UnW5Q UxbfpTqUcjkdevd0WwFtUxifEtDvedj8l+V2wFVjThw -6aYQDmzFj1fin7G7e0cUCn55PBU8bDolkw4l+5A25qY --> ssh-ed25519 UFfTmg Dfm/r13wimRQT2hQSWKhyr14BZliLrLGn/sZq3G3yTY -qzZLiowHu+HnSY31yXBOFPEYn2lJSJ5MyWvKSe2QZcI --> ssh-ed25519 xNtnoA AltIha0Z9BqZY4V8LOzCcr5KPWAvoNoyktReER3Glgs -ac51BT1NGldAn6N/s7KEkNrRLhmntwx09SguGdZRR5o --> ssh-ed25519 aY2AXA EmE9Bjzme13LSSMZDnJsPFvpXGamtc/H3DOziP+d+Cg -VN5z1+EzLF6N232QwkO5TT5Kf9NpoPDL2T50qCpCfgc --> ssh-ed25519 AQhf1g Z3Ezie7ikLb/8u+iNALI8x327lFqLN1NRIqHLfjqNFs -QQDDH6Dio4zc0FCsLDRWl3ywaEdkp4zwGG+Iaegmi3I --> ssh-ed25519 mOmPfg mSW3OSIm9/8myqUxEJlsf0LT7vCO9i6/D3WkWKCD7l4 -U6TkEVyzxnb+9B2wLeEkQ4g6w5s31Q30/Q4ehQplf3c --> ssh-ed25519 YJiRbw Gs9VBwzEPr1QA1PcaQUCUwS+jwXYVniqe5TaZBjrJmQ -rFS24MN8bzA+vj6/sJHuEC4yYglpf0OJT0GgUVm0HTs --> ssh-ed25519 0/WsKg MbcckXyUg5JfGafnhidk4dH6mEuhZOPac4YncYeYOR4 -oeFwgCrjDPauQSCgE1Q1/Smz6SI44TVfuNH0oP9WcdM --> ssh-ed25519 Nl/5yA 9xL4/5nxpciN9HFFO/X3xQ1oMe+EvLohnI6631amwhw -n4As363EPOxuzN5f5RNuUrlEDFgmhVvjtEosQKTPVII --> ssh-ed25519 GdLgCQ P+jwMHdoS74jIdGQjOx4sDngWs+zxNpnzSgrDXD7Vkk -NuGd8agrw/8PT+dw9RirCYATZRPnF5rKDSfyDaJ17iw --> ssh-ed25519 tOH/HQ u7gM8oYWpfFFW54TqoisGDEeX5MKxaVxT+ozl4miF0I -avmdzbzCSDv4ovYMMmqx//G5FVEuz+hOJpr9/49w1Rk --> ssh-ed25519 FpzvfQ 3bDfVBMNavjfMFaKO8C5VvXiDMQxfB4WYp9mJ1LnIQI -bl1KwNL5M8gJlqE/R5/lY7UlLOgeftiwinyC8yDb71A --> ssh-ed25519 kdPvzQ 2Y9lCbnjBhF3N0BTzhBqxJ/NDe7Z9/Vpkd8bbL29D0k -pL4VMb6jnQv4bwt5SjcORlTWsvSWOhTNZXNYEkCZH5E --> ssh-ed25519 onmXpg 2Nw16oXRct8XDRqs6TRiOK6tBk9kNZcR2VDLy9GvOkM -N95+6Ia9lpbKenojMDDAuLrT4cqjENsWzrwplcBKiUs --> ssh-ed25519 CnhD0g j7udTMCoQHrqYnH/mxGgRzor7RaTm2HjaSwuoVQqCGw -ivg32RGKKCqe2yBjq58ym8shWlrYNfcvuK7xy1F2mmg --> ssh-ed25519 4ep2UA bBdPC5asgGcu60Y/i0yVKvAQc9U+7Jruik0xT8rDUA0 -ul6uiMBstdXVVmuIpgsZPSt6MQiyklPGYSbxOTLndeQ ---- 5mAFqAG9hgU00QxYRKkhNl3fJ1KwDevvTnUhf0xYUog -TW" ȧ]h|ndDŽQFWv੻oiZSG`|Д"8n}::6 \ No newline at end of file diff --git a/secrets/gitlab/db.age b/secrets/gitlab/db.age deleted file mode 100644 index ac3f254..0000000 --- a/secrets/gitlab/db.age +++ /dev/null @@ -1,37 +0,0 @@ -age-encryption.org/v1 --> ssh-ed25519 87huqg KMaYb+ubBiCqBKr08lmrIhiuNcvH/WnnEDYYvdgnvgk -lJM8dGwT3LYvI9NtPZOzY94bFhk6sxO6F4NCMJBDBuA --> ssh-ed25519 8UnW5Q rUXfXe6S1jgTfJJGhT3NfIGhvYaf4aUAuD7wAa5GaxU -OCe5kE+IM1MHqMPfLpgO5spYxDm1SDp5euubLkOF6K4 --> ssh-ed25519 UFfTmg 8ZIBc9wr/hoQE/ItltZhSbqlZ3qEQMyLajy0cORbOQo -DocUbgXT5m8CgExF1ICAJv+Nu4rBogwaYz5vJKNRQhs --> ssh-ed25519 xNtnoA x0uU0K78XzA9yYXg+jR6MIJASRxsJ9eMZctm276tP08 -SGZYFFkfbQpLVqV9OUQMMbOmv+0qNS3bO7IkWWjqohE --> ssh-ed25519 aY2AXA D5xP6cDYNLUsGeLgLO2x2gkBzfPByR58G2PjjGs/rxA -wiqNVVjyQPnZop7q0PXmOOw7cJr8WKQVl1mk7zL+/cM --> ssh-ed25519 AQhf1g MJuVLCVIdZ7fKnXVvtJvSLriX1Q+2u20Y+aNI7N75hM -EocXr6NlaanErb3Nmc9R+3DSdfoCAyHa5gDYzBX+xJk --> ssh-ed25519 mOmPfg wbQrmVm8CEeAHpJIjCyFI7Mfhn3i9bER7FppanAneTQ -jAvjziCLYUl//6ZlZ5d3gE1ONRjhEnPLTabvTJEhFg4 --> ssh-ed25519 YJiRbw 6ZAb7+mWKPCkYZrpcW1g1JoL9Q72rWwLIEZJtPx4ayY -WtKeYr7wxCVisATDyejwnasFcVRtGa175wJoXNzhyKk --> ssh-ed25519 0/WsKg yyQBUeYAFIJUuH6xsMYztjO8zeswUWFCgqiNoMqxijY -y5azJJfyU9NgyY8kuIoWRfY1kMJUzgxx8UtqJ3XBNvI --> ssh-ed25519 Nl/5yA Ffb3McX/NVo56cJXA51n9yrpeSTvD5/0S9n7ObeYrXA -Wg1EhU0nk/Wh3Jf3+LY6dVLXBNbAM8miuC8gYdabIwY --> ssh-ed25519 GdLgCQ x/k3xO9fHAPFeOdeAwgWVNqWtU9u6RVXXNUnhUXk1B8 -aNeOSmnUILJTjof6+7sN8h2zA+pqBmU6cpmD81xcmtw --> ssh-ed25519 tOH/HQ ZEBu38T0q6tZkZSZIbGc3Kn9acTGqSbquPC6xlXt90o -LPvS9dVaPUiE5nxVV8LsAjfRdyKBNmCwGTxOcyCxWMA --> ssh-ed25519 FpzvfQ iU+7myrJIbc+xbVZf7OxGSBy7Vq+FqItVYECvrvV7V4 -YkMvBRDnkGf+zznWTVSbFbR/2BaqOT1ja7piiyRL+uM --> ssh-ed25519 kdPvzQ cuzIgrPaJK1SY4soXT2lQkF8Ji7GZq+ihH2vYmbyDXY -E7cA3PDHBsqm7Z9SbflHXQXMzv7B0uxYR4UQv9NHZ70 --> ssh-ed25519 onmXpg aNcwAfrg7CfnC9Whp/qjikADbZzeSVM0m+kLkjExg1A -1RWx1F4Q6zA91UHxBmvuxqABv+mZZwNayAVAz0EqGQg --> ssh-ed25519 CnhD0g LrFzQX5UKZAizqYkDCT/k6CWdFZYFqPguyLjgfcfQ2U -O7Ta5mpAcLI2XswerqtW2fC0evmy/gdSQqLgW7L99zo --> ssh-ed25519 4ep2UA 8B0v6mE+hB0iKaZNrkvdlI4E2y4lWNR4zJ8oJS75jR0 -l5M6WSWKGuHMCiL5V5PCyDfFCElGNmR5UIkXRivSl5Y ---- 1PM/nhbi3rtn26S1rtNwUT97plbJJvHOmPNzIYAsK4w -W'Se>p_ǪvcHN9š 6L,_[3 _a>D0lF4.Ӓ5:ú0 \ No newline at end of file diff --git a/secrets/gitlab/deterministic-key.age b/secrets/gitlab/deterministic-key.age deleted file mode 100644 index 0dcc80d..0000000 Binary files a/secrets/gitlab/deterministic-key.age and /dev/null differ diff --git a/secrets/gitlab/jws.age b/secrets/gitlab/jws.age deleted file mode 100644 index 5ea215f..0000000 --- a/secrets/gitlab/jws.age +++ /dev/null @@ -1,37 +0,0 @@ -age-encryption.org/v1 --> ssh-ed25519 87huqg 3CNYW4sCTBsHWQaRdsyRomLXQ5V9jjzV+V9vHcKtqjc -ZjGxC8Fqddlzmdd4uZxQWs9aAut+COJ9zWXZFQvRdG8 --> ssh-ed25519 8UnW5Q rgmZ4hwUDXX8VdQQWxZn5NO70j4IuJ1l9aD6uXjAWiE -SfmW+u09bGEP164j1awAoGpvchg9UZS7tgtSdLeepB8 --> ssh-ed25519 UFfTmg MPZCtrzXXzusawPkfZ+fBWepH7MZihKXlz9ztfp/bBU -RkLU9HPTJjyiaRczJU3sYMT0RT+oSvL3TozGRxOZM6s --> ssh-ed25519 xNtnoA HqhyTh67Yww4wHVR9i5+K7388nvAYwkPr1T95Sn3WDk -entg7nxJXWqq+N0LMUwv+psL+O6ivZjnGo+KbgKthxM --> ssh-ed25519 aY2AXA XTpM0SssYVVEtnWPCfooazXvVccdO4IX+Zmp7dxoDUY -mz6v4rzOpLT4fu+XYC5BwkXndNoBbEpazUt2wh0tutk --> ssh-ed25519 AQhf1g bUAsCyBen89j8JqUV3qAVTZ5QrxluYOmUO7D68Sd50k -14ebyL+xFEK8NMBzxAArVaxCPZwBPLNBLdalC9TGB/I --> ssh-ed25519 mOmPfg Mv+p2kGC4PunQGSVD28emoEDra/ohZHK/xxTQVhafTM -gUrUjDQCxMfgcjWkbGWmi1A2GF5X07pUKdZuuaXWdcE --> ssh-ed25519 YJiRbw 0jxrJSU71zCnF1bDUieGOsc/TAeR9gv/1ks2kPN2sD0 -yho+rheLys+ET7uKrrlsljQZQ8VuUnzg5eUj7gVMgAk --> ssh-ed25519 0/WsKg yxsm0H6tRCron9th/e9KfX+zFl5T3DH0/B602ak0s28 -kkmfbZ1SyXLJxlM/EeBRJEf0Rb+15w3nXZEZ35xuCug --> ssh-ed25519 Nl/5yA IoFwKIz+jrNUm4PB3wX5okeqtPKANPP+/lcZaJ+mZ00 -0ChPqTpzLCCz7die5lgOnO+Yz8JQIqjTX5oLwXv/IbU --> ssh-ed25519 GdLgCQ Fo9YJGiJMTpnhRQKd2cQ7XfQXLvOQ8+V5rlZvqOhWgQ -Lhie4dV3210DbNvbkBWFStgycrH3xgE3tt5PYF0OjEU --> ssh-ed25519 tOH/HQ 7BXNJ/wYMc9HIswKCTkXQF42UXKXCCqcD7/RQINx5g0 -G2HbqhnEuoCGmuowye/EWQJ1UWojp1cFLoyu6b5AaGA --> ssh-ed25519 FpzvfQ l5jORObNye/4CGt9D0pkP7CAqhWZPPlEhCSmuc5JxVE -5P/S8vQEzlYgXcM+TxlQnlyO6fK0lUkxBElfTZ8dR14 --> ssh-ed25519 kdPvzQ rbwguFPeDqBJye6fzNAR+zqo3vA13o8VBqTDMtq/xF0 -0wjGYDkSgeB1H4GvjFfM5HIxCFs1s6R/6US0TFv/o0I --> ssh-ed25519 onmXpg GB5Hi8wAOxRaoyzcDuHK96+JNd/zfBdmR6oJdpYkmi8 -svDcX5tYRR8IzuQi36TpxqKu/vKiDj290e1Hx/RoBAs --> ssh-ed25519 CnhD0g 4vM1+uQTV/dYAbYP7Nsj9DZFjFVc1yFqNzKxWyz1OWQ -G7ifv77YIefxMqK1vSEzxPCxQaf8Sd2cdpyoy3DxGZg --> ssh-ed25519 4ep2UA V+2q8xrX8eAQzuNV8Se/BUtut4EbkRsy/svnbRVO1TM -WYJTqLxIqFC3a4z3UtMp4z7CAXEZ2NJUGzxftIvgoeQ ---- t27r1Bedv2MW11oCtfWXl0ijG9/aiiWMdEbgymIqdSY -66^VUu6$ Q[aUW*&s9I23HROJҧ)CXeRŽXi6yB:b\+ \ No newline at end of file diff --git a/secrets/gitlab/key.age b/secrets/gitlab/key.age deleted file mode 100644 index aca976e..0000000 Binary files a/secrets/gitlab/key.age and /dev/null differ diff --git a/secrets/gitlab/kubernetes-k3s-local.age b/secrets/gitlab/kubernetes-k3s-local.age deleted file mode 100644 index bdea8c6..0000000 Binary files a/secrets/gitlab/kubernetes-k3s-local.age and /dev/null differ diff --git a/secrets/gitlab/linode-deployer-runner-reg.age b/secrets/gitlab/linode-deployer-runner-reg.age deleted file mode 100644 index 15e210f..0000000 Binary files a/secrets/gitlab/linode-deployer-runner-reg.age and /dev/null differ diff --git a/secrets/gitlab/nixos-qemu-shell.age b/secrets/gitlab/nixos-qemu-shell.age deleted file mode 100644 index 8a647bd..0000000 Binary files a/secrets/gitlab/nixos-qemu-shell.age and /dev/null differ diff --git a/secrets/gitlab/nixos-vbox-shell.age b/secrets/gitlab/nixos-vbox-shell.age deleted file mode 100644 index 6eb6084..0000000 Binary files a/secrets/gitlab/nixos-vbox-shell.age and /dev/null differ diff --git a/secrets/gitlab/otp.age b/secrets/gitlab/otp.age deleted file mode 100644 index 219e501..0000000 --- a/secrets/gitlab/otp.age +++ /dev/null @@ -1,37 +0,0 @@ -age-encryption.org/v1 --> ssh-ed25519 87huqg 6Yf7i221QUp6qN/CZOSjHzaycZUgAGSwTRjlKZ8Pw3g -xQWKonF6dDP5hXg3tFNPim6zb6XxcJ7T96+YQ16ziMo --> ssh-ed25519 8UnW5Q 8dkjCC6pl0z5l/ZB/M3JC9eUOyB6WipF08rJB7Sa40I -kVuyfXIBCR1iu6tp/a8CBOQcXHv0Pvn/7PXuFvpnKQo --> ssh-ed25519 UFfTmg Sa/x4f5tvvQjI1ZdEhklMIimXiDkId/6nXJwlo5z3Gs -jXkH3gVRv7f1dsZMdVDHMh2BQ5Or66eIrwfoHm/C/Os --> ssh-ed25519 xNtnoA GueQcHnvRtnftKkVehS9GeL4YVe6PonxbY6hMGdGhmc -lM3gdP9edOI2mBJrHnD91g7R1ucR4xP3IfDLLrMeizY --> ssh-ed25519 aY2AXA 42K0aTzZIKipmq7d8XGGgyIMB/dJALos4AZsl4tQaBo -/k8yNXeksAXy7EzNVXQTGNJ18lVc7SxJDJhr9E5F15Q --> ssh-ed25519 AQhf1g ql3uiFEScr0CbIALP0oD3+X56ti/egAjj4T6usJfkjM -S3ZgjLc0ALm1PsSgxqAYECRDzqRF9BOCGZhT95Nin2c --> ssh-ed25519 mOmPfg 70rXi96dEVYo+Vb0ekr0POh1RWWVE7QcySWIHmfNol4 -iGuntLq8pBbrOpdrfrhSfBHpnPxadDD0F28yeyFehmA --> ssh-ed25519 YJiRbw 0e6SH2cQmLZStVR8zMixESrCnHFGiuFNvY5rr5cKgkQ -mQDjego0IL9bATA5BkNjWhMRj+zwgjyZsrDDnV+d/5Y --> ssh-ed25519 0/WsKg 0kLNpZmoY18kHQHcnfmcl9jbCuXhCwHObsUtSXK7IlA -P73mC2PUI4LODn+0c5UBZvDmUqb4nuvNq07aqI5oR/I --> ssh-ed25519 Nl/5yA bVpuj8uhAEKFTD04b3irvAJWcNOdFQzaUY/5LlyT8BY -wLUHnoHvzRiYGd7WlYBamPzbsKnUYOxLgoQbp0f4S1Y --> ssh-ed25519 GdLgCQ 9m6Y7d3PFFeOw7DngkZIFqBl86lL20cBr+IiNMTc4XE -I9cHA5tTpUeTkglotot2aBetRhJrpTHEl629/I6GImA --> ssh-ed25519 tOH/HQ yH4uXFXonl3GdB6qNMI1Bai9Dm7TAjbuHkpipGQJC0Y -E7WK4YWwR+CzoO3827NhburCB0O6U8ioFZrvlnzvm+c --> ssh-ed25519 FpzvfQ qKBmiRCSDG1P/ijVqIv3vMI/3k3Owf4faDzh0DBKMWE -cAbGPLI6b1+2juLbY/eB8zr2/1hKPD/G++igdkWF06c --> ssh-ed25519 kdPvzQ cCSoUaZSwYd03DAblZp8lVF1KqKgH/0Tgm9EnveJ80E -FcLYsv9JmE9RuK+080kJxSj+/5trUIj0EDPf75bl/BU --> ssh-ed25519 onmXpg h2aRUyrSFBupqLERDanFEVXReOut4Y94aq7EVmj4JgM -yfDYFFI6p/M4bWcvHBSFe449WDg/0FlCCGeFkGgUWNk --> ssh-ed25519 CnhD0g amEQyS8R7p/qJIlKNOdsHgukKMCVj1ypsPqWTsnuoCk -+ZRH39P3lLs0W7S5iuLPBs9UIPmp7tw/gXvJhhPXahg --> ssh-ed25519 4ep2UA hjodTPrxShfnJJpHLK7qD4f4m+jR2Pc43s3bRASoHg0 -GXiO0cSAG/aes2yqq9abdWqKH/9ZIk04TAVdiLpg1uY ---- JGKP15sCEBNrbkcbzcQmkNjSUvyuONGaM2SiRGK3WW4 - Uf2&Ymk*ܣc4Tʫ?.\< Xz,өNhXR16hr1MfJVRv* \ No newline at end of file diff --git a/secrets/gitlab/primary-key.age b/secrets/gitlab/primary-key.age deleted file mode 100644 index 661e762..0000000 --- a/secrets/gitlab/primary-key.age +++ /dev/null @@ -1,37 +0,0 @@ -age-encryption.org/v1 --> ssh-ed25519 87huqg pxinVlRwRapBcR4go0sPkLXzqQoGfqnXy2xFdTsiclo -iik2P9JMR6rE7Dz7eACovjT6OCG07AD6kxbuAmKrPqw --> ssh-ed25519 8UnW5Q 2dDafRkl6O3JY4dg1fEF0OVAAkHTXxOvn7L0wyeJmXw -0tj+wY2S8G26Lpvn6wWGxx888VRNqvHC0+d7pfaZqDI --> ssh-ed25519 UFfTmg 4pP9ht7a/ZcQkpZTacUBK0euaUbI6z13l74vpjpDgS8 -1kiQcsgUBhc5wDAzQqeHHtaNBQ0NgOa/nWzdvKqjgKM --> ssh-ed25519 xNtnoA is0caVhVtHiGINKHJaXYn018HtF78KcXGzlGYnRhehY -BBe830cvdSS4WHn+2AGZ4SuxspBaVErw1Pu95d9Zw5o --> ssh-ed25519 aY2AXA VDMqxKqzMo1BrcSnc26pkXhlisxnfo0jEKyKKQ70sl4 -km1hfV+9sx2WDtDQMdA1Q2KdQ3lw/nmaUAOL0v4bQe4 --> ssh-ed25519 AQhf1g ye8KsZ7/Qmmo3gMmTRxCRux+0X/TDIkMfJfwEF56CwM -ZWTF/Wl3G1pVPIxCBoLpq4eWuf4pcKSoQM7+p7vsJOg --> ssh-ed25519 mOmPfg d5I0xYKepGdgVQ4f9A0+FLwxA0XRpyjpZ4YQoQ12/2Q -e9O2/ROORHHuDhnZgn0KegO8QqXNycBu06ZD00qIZRk --> ssh-ed25519 YJiRbw oydLfhPROsG3AIjcaSR/3rRXJCnljtQ33t7p2OFMYSY -Q+7cbIZ+E2S591aIB/zcDmOnPHto3zxRlEYwRejOTjM --> ssh-ed25519 0/WsKg RFPRDaH1bWOqy9T+IfTkeehB+b1xr+3VzHnMJy1ezAE -DRxwHAcJ5g7aryUFiE9YzgMBXGlwCrzfspeB9ZLZCto --> ssh-ed25519 Nl/5yA XBWei39hiN3SKNmXUKkv2ve5Us78lRLq4qsdQ5uoXTY -HSiYWXkHhsT9aVJBVYJn7lAU6mkuDoO4pZj4TKHs3CM --> ssh-ed25519 GdLgCQ FmskZXs0zQizSLjetVFUeekOB5MffZQu34kgzhpdX04 -b1P7JaVmwPqPQZohFHmDoe9n6WtSvOBD3/Puon7N81Q --> ssh-ed25519 tOH/HQ MrCEOqQbdQktOmeC4sEEy7vX6SjhqunMpmnZ+ogDahU -XDxLRZ2aiaEnq+t12SgSCbv3ZZclkJFmeFX47TzM38M --> ssh-ed25519 FpzvfQ MlDNZs1/L8sAdDv0iAHiAKHC0ORn1XnS5st6l7Nd3kg -kcZEp5WRPtZATThbThjiSLU21Xmfu6BwiB03kTUOTRE --> ssh-ed25519 kdPvzQ dUWPf++1B9TU3jpaC3O2aFXCMlF4YvzZCAjASc5Rjwo -5Hg9oalicLh09YSb7FokQSqkBcLMZ3ePGnzKCMCjjcE --> ssh-ed25519 onmXpg 9WQusW0nfo/gUChf6plb3xQLAdu8Zdovlt+SHFFP+Fk -RYHWttktn30aUkTSpRiY6jvVp6kZGDru6Ce7FWpYUmE --> ssh-ed25519 CnhD0g etVMbgOUosTxt5J+oO2z4f4Zaf9XmzKZKiYzyRON0Eo -bjo0/trYvXCNG4nFSl4VmKke2Dr2sJvD2Ps3KVnz9K0 --> ssh-ed25519 4ep2UA W9MEIlu/M1bQQFT/F0ns78lBvyVonXBpCSQysMV0hyc -oH3V4KxWtL2eJvqxjxKcd/pGgaNilwxStNpKo29wPFs ---- +nY/B5L7D+piJGp7RbzbFeAw3EM0X5QJ6aEAlaVU1Mo -#y!c*W 4R2,^렘`m~å$LJs*p.+L{]=uS \ No newline at end of file diff --git a/secrets/gitlab/salt.age b/secrets/gitlab/salt.age deleted file mode 100644 index 0e2846e..0000000 --- a/secrets/gitlab/salt.age +++ /dev/null @@ -1,37 +0,0 @@ -age-encryption.org/v1 --> ssh-ed25519 87huqg WtxBR7tl7c5kqqNY5RZrQIthLIG58hZx/ngR8cYdURs -G7+mhXcqFOdOioKJFdykwOrakVbhtK5efxtisd11yw8 --> ssh-ed25519 8UnW5Q s8GNXAmhc1a+luGrtXDj/AvIm+YwIpZwKyKhkFx6dSU -AvE+KIJzNJxSWHOCqp7lt3yqal7lt0EyqzvFlOi93qI --> ssh-ed25519 UFfTmg a2kAjGgd44RH5l782bx+ZE5kyoOychrl0HNR4CMNtCM -4fzO1n99/S4hjrKGUPcQ6RDfNOp03hW9TSLvXm9Gmvk --> ssh-ed25519 xNtnoA AQHswbi52dxuyx0xcNQszHZiqmWYet408Vk4xwdAAWE -TbtKqouXNL4ibrA/5ysqRukgrlVpQva0qBYW+lNg/lg --> ssh-ed25519 aY2AXA am3EZYO/A2NgPgSfXmv4oBWG31Ylneo5aAhE3fxyrDA -FD87d17FaaP4Zxc6bUW7EPOdlNbpZW6nL2SLL3pvuzs --> ssh-ed25519 AQhf1g lpI5cpau4ld8sKIeL2rUzvfMgoKpYFL3K1x05tI0hAo -9FS6CCEh+ozunq1b+wb6/4XJTDD4a/FclmfEPXJ17bM --> ssh-ed25519 mOmPfg Na+4qv+953ioMI8SBAqWkZoiOFwddLrQbQ9ht8OQ4HM -0Wy3e5+Qbu/A/vTX9c87c0AWB0d/oCB16b73OZ/QvAE --> ssh-ed25519 YJiRbw y0sOGLFgINIwTMOvwHbf2UF7CmtjeQh78CauAbdpKTQ -FjQigm97STgQnCzvKJTHfmIc1dd5ipECzi/0mCG2x1A --> ssh-ed25519 0/WsKg rpxWL89TERJ3QVc7eU/aKTt4hkEXuwaCsGLxc/MWVmM -ywI9bG65CcNTtWizrPL56jE3kF0bkM+3Y4JY8d8FY8M --> ssh-ed25519 Nl/5yA tawS9A4aoCw63qALl3cnNLXEpHafDqQTwcfkfk6BOVQ -FcJYQu54IgibrjK8TMK+MijSxylmIITv60jHhi4xrq4 --> ssh-ed25519 GdLgCQ HazAqkEjG3n/zJ1OKI30EtVjuLh7N1ThOlI/KUOZF0k -YJNWVPWB+2ega6CPQd4VX7dKwt+/jsd6zgwujO/rep0 --> ssh-ed25519 tOH/HQ BD4L9RxVDyhrGs314dbl85VKVWwG8gV+mUo9il6c3Wg -SNG3HFG0rEXasfabMWxzOS7hU0H64a4jz93hJhVHLIw --> ssh-ed25519 FpzvfQ OuagwUFjEkdwuE7CvhxG6rX4cHhULqJiiXe8A0YkjAk -XZxhnisJC9vin1t5EBkAYk2UFvGiqhkQAwtW+MD/ZUQ --> ssh-ed25519 kdPvzQ INs91qrXdBsMfPq4rFlqXBOaAH/YGNB3krOzl6+UNhA -0cZTjvo84WMFDLo9MOhRt/tY3xfBLl9WKVapgA2ecRg --> ssh-ed25519 onmXpg mIwVuIwLVOHfs81bmScGFc+ztwYLoL7nXtw79lGhW2U -SYgy4giBk8C+OrOj5TGCyn0Bh/jWciT1mtUTsu5B6T4 --> ssh-ed25519 CnhD0g 080GDLh3bH6ils+v/Yh2wTM5mNTiLDKeOGAEtvLC0x8 -IHMimypNNW5BYk0rJhlrLS5pcVXiAsgSrcWE9jflQBg --> ssh-ed25519 4ep2UA SyPq6Akc95C785pmpa0jn/FUDDXIw/W5StmtbPKk7mE -lxa5YbmvxvO1OPmT6BHSRWw+VYZL5irA2Hxrl3bbTwo ---- oPPMefKWvJVhcKuSHDg9Lk34q9+GKM4LHU5ejAp9hTU -6I!Ek7Wzyp?3_ [UDgM)\ [+i gh4H \ No newline at end of file diff --git a/secrets/gitlab/secret.age b/secrets/gitlab/secret.age deleted file mode 100644 index 5e1978b..0000000 Binary files a/secrets/gitlab/secret.age and /dev/null differ diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 0870b45..15986ec 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -8,14 +8,12 @@ let # jude = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOos0zQePsa+T6Z2dsKbPOvEdrBQ8a6mx3s7pN6ysCI0 root@jude"; # isaiah = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHleYKtfV4W1Z63Ysu9w5Rbglqlz4F92YcZoMkucoTNf"; # genesis = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEI9jbTPmEWQ0F2bLYmnIOLmBnag1fkKxHRjz3X8lB/k root@genesis"; - # gitlab = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC7hesFWwlmSbWPJWUiF8fIppy5a83yXw84O0Ytz+Zyq"; # hosea = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKLIwkTTXA56sUlUjEulXXZRvZy5H4a5ZwgKWLlpkQDz"; # jeremiah = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOjQjXq9WYU2Ki27BR9WwJ4ZruS/lJXbjC1b0Q42Adi0"; # matrix = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMIbvNNYrsT9sSBSwIL9c0LiHDaOiztlTJZAGgTDGUHq root@vm-matrix"; # exodus = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFxmnCj2E9DxcnefPW+n4yCuLShxqr0p024riogdeXA3"; # systems = [ - # gitlab # genesis # linode # jude @@ -36,7 +34,6 @@ let ) ); - user_gitlab = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEwX8DZRRbZ+Iwo90dROg/61lisazAAGK/W8aqWfWcJr greg@nixos"; user_genesis_virt = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFWPSFQT0AH77wrwRhiskcBS0w4ZakBRdJywYYBsnm3S greg@genesis"; user_ivr = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMYzms+KIe5/bYF3uCyFjA5e1AgMPLIA3c4k417coqBe gregory.hellings@ls23003"; user_jude = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINnRc/kBhxcjpUtiRQY+BXnSObdp0jFL1395wAQxJip7 greg@jude"; @@ -48,7 +45,6 @@ let user_exodus = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC189EnvWjNUp3xSzPMAtw85oQEsvP1tQR1TK640nLx6 greg@exodus"; users = [ - user_gitlab user_genesis_virt user_ivr user_jude @@ -104,23 +100,6 @@ in "gitea/workerPassword.age".publicKeys = everyone; "gitea/runner-isaiah-podman.age".publicKeys = everyone; - "gitlab/secret.age".publicKeys = everyone; - "gitlab/otp.age".publicKeys = everyone; - "gitlab/db.age".publicKeys = everyone; - "gitlab/db-password.age".publicKeys = everyone; - "gitlab/jws.age".publicKeys = everyone; - # openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.crt -days 365 -nodes -subj '/CN=issuer' - # Then pipe the resulting files to agenix -e - "gitlab/key.age".publicKeys = everyone; - "gitlab/cert.age".publicKeys = everyone; - "gitlab/salt.age".publicKeys = everyone; - "gitlab/primary-key.age".publicKeys = everyone; - "gitlab/deterministic-key.age".publicKeys = everyone; - "gitlab/nixos-qemu-shell.age".publicKeys = everyone; - "gitlab/nixos-vbox-shell.age".publicKeys = everyone; - "gitlab/kubernetes-k3s-local.age".publicKeys = everyone; - "gitlab/linode-deployer-runner-reg.age".publicKeys = everyone; - "acme_password.age".publicKeys = everyone; "ca/intermediate_key.age".publicKeys = everyone; "ca/root_key.age".publicKeys = everyone;