diff --git a/hosts/myself/default.nix b/hosts/myself/default.nix index a0920c7..b214b5f 100644 --- a/hosts/myself/default.nix +++ b/hosts/myself/default.nix @@ -1,8 +1,8 @@ { config, pkgs, lib, ... }: - { imports = [ ./hardware-configuration.nix + ./git.nix ]; environment.systemPackages = with pkgs; [ @@ -25,18 +25,6 @@ HTTP_PORT_MAX = builtins.toString (8000 + id); }; extraLabels = [ "nixos" "isaiah" ]; - extraPackages = with pkgs; [ - config.virtualisation.virtualbox.host.package - curl - gawk - packer - pup - (python3.withPackages (p: with p; [ pip virtualenv ])) - qemu_full - qemu_kvm - xonsh - xorriso - ]; name = "isaiah-nix-${builtins.toString id}"; nodeRuntimes = [ "node20" ]; package = pkgs.github-runner; @@ -50,7 +38,7 @@ url = "https://github.com/greg-hellings/vms"; workDir = "/home/runner/${builtins.toString id}"; }; - runner = (import ./runner.nix); + runner = a: {}; in { gh-one = (runner { inherit config lib pkgs; svcName = "gh-one"; cfg = def 1; }); gh-two = (runner { inherit config lib pkgs; svcName = "gh-two"; cfg = def 2; }); @@ -87,14 +75,6 @@ }; users = { users = { - runner = { - extraGroups = [ - "kvm" - "vboxusers" - ]; - group = "runner"; - isNormalUser = true; - }; greg = { extraGroups = [ "kvm" @@ -105,7 +85,6 @@ isNormalUser = true; }; }; - groups.runner = {}; }; system.stateVersion = lib.mkForce "24.05"; boot = { diff --git a/hosts/myself/git.nix b/hosts/myself/git.nix new file mode 100644 index 0000000..802423a --- /dev/null +++ b/hosts/myself/git.nix @@ -0,0 +1,120 @@ +{ config, pkgs, lib, ... }: + +let + extraPackages = with pkgs; [ + config.virtualisation.virtualbox.host.package + curl + gawk + packer + pup + (python3.withPackages (p: with p; [ pip virtualenv ])) + qemu_full + qemu_kvm + xonsh + xorriso + ]; + + secretsList = [ + "secret" + "otp" + "db" + "jws" + ]; + + secretsPaths = { + secret = "/var/lib/secret"; + otp = "/var/lib/otp"; + db = "/var/lib/db"; + jws = "/var/lib/jws"; + key = "/var/lib/registry-key"; + cert = "/var/lib/registry-cert"; + }; + + registryPort = 8001; +in { + age.secrets = { + gitlab-secret.file = ../../secrets/gitlab/secret.age; + gitlab-otp.file = ../../secrets/gitlab/otp.age; + gitlab-db.file = ../../secrets/gitlab/db.age; + gitlab-jws.file = ../../secrets/gitlab/jws.age; + gitlab-key.file = ../../secrets/gitlab/key.age; + gitlab-cert.file = ../../secrets/gitlab/cert.age; + }; + + containers.gitlab = { + autoStart = true; + bindMounts = { + "/var/gitlab/state" = { + hostPath = "/var/lib/gitlab"; + }; + "${secretsPaths.secret}".hostPath = config.age.secrets.gitlab-secret.path; + "${secretsPaths.otp}".hostPath = config.age.secrets.gitlab-otp.path; + "${secretsPaths.db}".hostPath = config.age.secrets.gitlab-db.path; + "${secretsPaths.jws}".hostPath = config.age.secrets.gitlab-jws.path; + "${secretsPaths.key}".hostPath = config.age.secrets.gitlab-key.path; + "${secretsPaths.cert}".hostPath = config.age.secrets.gitlab-cert.path; + }; + privateNetwork = true; + hostAddress = "192.168.200.1"; + localAddress = "192.168.20..2"; + config = { config, pkgs, ... }: { + services = { + gitlab = { + enable = true; + backup = { + keepTime = 288; + startAt = [ "03:00" ]; + }; + host = "10.42.1.6"; # Just for now... + https = false; + initialRootEmail = "greg@thehellings.com"; + initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password"; + pages = { + enable = true; + settings.pages-domain = "pages.thehellings.com"; + }; + puma = { + threadsMax = 6; + threadsMin = 2; + workers = 6; + }; + redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}"; + registry = { + enable = true; + certFile = secretsPaths.cert; + keyFile = secretsPaths.key; + externalPort = registryPort; + }; + secrets = { + secretFile = secretsPaths.secret; + otpFile = secretsPaths.otp; + dbFile = secretsPaths.db; + jwsFile = secretsPaths.jws; + }; + }; + + postgresql = { + enable = true; + checkConfig = true; + ensureDatabases = [ "gitlab" ]; + ensureUsers = [ { + name = "gitlab"; + ensureDBOwnership = true; + } ]; + settings = { + log_connections = true; + log_statement = "all"; + logging_collector = true; + log_filename = "postgresql.log"; + }; + }; + + redis.servers.gitlab = { + enable = true; + logfile = "/var/log/redis-gitlab.log"; + }; + }; + system.stateVersion = "24.05"; + }; + }; +} diff --git a/hosts/myself/runner.nix b/hosts/myself/runner.nix deleted file mode 100644 index fd9b129..0000000 --- a/hosts/myself/runner.nix +++ /dev/null @@ -1,207 +0,0 @@ -{ config -, lib -, pkgs - -, cfg ? config.services.github-runner -, svcName - -, systemdDir ? "${svcName}/${cfg.name}" - # %t: Runtime directory root (usually /run); see systemd.unit(5) -, runtimeDir ? "%t/${systemdDir}" - # %S: State directory root (usually /var/lib); see systemd.unit(5) -, stateDir ? "%S/${systemdDir}" - # %L: Log directory root (usually /var/log); see systemd.unit(5) -, logsDir ? "%L/${systemdDir}" - # Name of file stored in service state directory -, currentConfigTokenFilename ? ".current-token" - -, ... -}: - -with lib; - -let - workDir = if cfg.workDir == null then runtimeDir else cfg.workDir; - package = cfg.package.override { inherit (cfg) nodeRuntimes; }; -in -{ - description = "GitHub Actions runner"; - - wantedBy = [ "multi-user.target" ]; - wants = [ "network-online.target" ]; - after = [ "network.target" "network-online.target" ]; - - environment = { - HOME = workDir; - RUNNER_ROOT = stateDir; - } // cfg.extraEnvironment; - - path = (with pkgs; [ - bash - coreutils - git - gnutar - gzip - ]) ++ [ - config.nix.package - ] ++ cfg.extraPackages; - - serviceConfig = mkMerge [ - { - ExecStart = "${package}/bin/Runner.Listener run --startuptype service"; - - # Does the following, sequentially: - # - If the module configuration or the token has changed, purge the state directory, - # and create the current and the new token file with the contents of the configured - # token. While both files have the same content, only the later is accessible by - # the service user. - # - Configure the runner using the new token file. When finished, delete it. - # - Set up the directory structure by creating the necessary symlinks. - ExecStartPre = - let - # Wrapper script which expects the full path of the state, working and logs - # directory as arguments. Overrides the respective systemd variables to provide - # unambiguous directory names. This becomes relevant, for example, if the - # caller overrides any of the StateDirectory=, RuntimeDirectory= or LogDirectory= - # to contain more than one directory. This causes systemd to set the respective - # environment variables with the path of all of the given directories, separated - # by a colon. - writeScript = name: lines: pkgs.writeShellScript "${svcName}-${name}.sh" '' - set -euo pipefail - - STATE_DIRECTORY="$1" - WORK_DIRECTORY="$2" - LOGS_DIRECTORY="$3" - - ${lines} - ''; - runnerRegistrationConfig = getAttrs [ "name" "tokenFile" "url" "runnerGroup" "extraLabels" "ephemeral" "workDir" ] cfg; - newConfigPath = builtins.toFile "${svcName}-config.json" (builtins.toJSON runnerRegistrationConfig); - currentConfigPath = "$STATE_DIRECTORY/.nixos-current-config.json"; - newConfigTokenPath = "$STATE_DIRECTORY/.new-token"; - currentConfigTokenPath = "$STATE_DIRECTORY/${currentConfigTokenFilename}"; - - runnerCredFiles = [ - ".credentials" - ".credentials_rsaparams" - ".runner" - ]; - unconfigureRunner = writeScript "unconfigure" '' - copy_tokens() { - # Copy the configured token file to the state dir and allow the service user to read the file - install --mode=666 ${escapeShellArg cfg.tokenFile} "${newConfigTokenPath}" - # Also copy current file to allow for a diff on the next start - install --mode=600 ${escapeShellArg cfg.tokenFile} "${currentConfigTokenPath}" - } - clean_state() { - find "$STATE_DIRECTORY/" -mindepth 1 -delete - copy_tokens - } - diff_config() { - changed=0 - # Check for module config changes - [[ -f "${currentConfigPath}" ]] \ - && ${pkgs.diffutils}/bin/diff -q '${newConfigPath}' "${currentConfigPath}" >/dev/null 2>&1 \ - || changed=1 - # Also check the content of the token file - [[ -f "${currentConfigTokenPath}" ]] \ - && ${pkgs.diffutils}/bin/diff -q "${currentConfigTokenPath}" ${escapeShellArg cfg.tokenFile} >/dev/null 2>&1 \ - || changed=1 - # If the config has changed, remove old state and copy tokens - if [[ "$changed" -eq 1 ]]; then - echo "Config has changed, removing old runner state." - echo "The old runner will still appear in the GitHub Actions UI." \ - "You have to remove it manually." - clean_state - fi - } - if [[ "${optionalString cfg.ephemeral "1"}" ]]; then - # In ephemeral mode, we always want to start with a clean state - clean_state - elif [[ "$(ls -A "$STATE_DIRECTORY")" ]]; then - # There are state files from a previous run; diff them to decide if we need a new registration - diff_config - else - # The state directory is entirely empty which indicates a first start - copy_tokens - fi - # Always clean workDir - find -H "$WORK_DIRECTORY" -mindepth 1 -delete - ''; - configureRunner = writeScript "configure" '' - if [[ -e "${newConfigTokenPath}" ]]; then - echo "Configuring GitHub Actions Runner" - args=( - --unattended - --disableupdate - --work "$WORK_DIRECTORY" - --url ${escapeShellArg cfg.url} - --labels ${escapeShellArg (concatStringsSep "," cfg.extraLabels)} - --name ${escapeShellArg cfg.name} - ${optionalString cfg.replace "--replace"} - ${optionalString (cfg.runnerGroup != null) "--runnergroup ${escapeShellArg cfg.runnerGroup}"} - ${optionalString cfg.ephemeral "--ephemeral"} - ) - # If the token file contains a PAT (i.e., it starts with "ghp_" or "github_pat_"), we have to use the --pat option, - # if it is not a PAT, we assume it contains a registration token and use the --token option - token=$(<"${newConfigTokenPath}") - if [[ "$token" =~ ^ghp_* ]] || [[ "$token" =~ ^github_pat_* ]]; then - args+=(--pat "$token") - else - args+=(--token "$token") - fi - ${package}/bin/Runner.Listener configure "''${args[@]}" - # Move the automatically created _diag dir to the logs dir - mkdir -p "$STATE_DIRECTORY/_diag" - cp -r "$STATE_DIRECTORY/_diag/." "$LOGS_DIRECTORY/" - rm -rf "$STATE_DIRECTORY/_diag/" - # Cleanup token from config - rm "${newConfigTokenPath}" - # Symlink to new config - ln -s '${newConfigPath}' "${currentConfigPath}" - fi - ''; - setupWorkDir = writeScript "setup-work-dirs" '' - # Link _diag dir - ln -s "$LOGS_DIRECTORY" "$WORK_DIRECTORY/_diag" - - # Link the runner credentials to the work dir - ln -s "$STATE_DIRECTORY"/{${lib.concatStringsSep "," runnerCredFiles}} "$WORK_DIRECTORY/" - ''; - in - map (x: "${x} ${escapeShellArgs [ stateDir workDir logsDir ]}") [ - "+${unconfigureRunner}" # runs as root - configureRunner - setupWorkDir - ]; - - # If running in ephemeral mode, restart the service on-exit (i.e., successful de-registration of the runner) - # to trigger a fresh registration. - Restart = if cfg.ephemeral then "on-success" else "no"; - # If the runner exits with `ReturnCode.RetryableError = 2`, always restart the service: - # https://github.com/actions/runner/blob/40ed7f8/src/Runner.Common/Constants.cs#L146 - RestartForceExitStatus = [ 2 ]; - - # Contains _diag - LogsDirectory = [ systemdDir ]; - # Default RUNNER_ROOT which contains ephemeral Runner data - RuntimeDirectory = [ systemdDir ]; - # Home of persistent runner data, e.g., credentials - StateDirectory = [ systemdDir ]; - StateDirectoryMode = "0700"; - WorkingDirectory = workDir; - - InaccessiblePaths = [ - # Token file path given in the configuration, if visible to the service - "-${cfg.tokenFile}" - # Token file in the state directory - "${stateDir}/${currentConfigTokenFilename}" - ]; - - KillSignal = "SIGINT"; - } - (mkIf (cfg.user != null) { User = cfg.user; }) - cfg.serviceOverrides - ]; -} - diff --git a/secrets/gitlab/cert.age b/secrets/gitlab/cert.age new file mode 100644 index 0000000..80a6d0f Binary files /dev/null and b/secrets/gitlab/cert.age differ diff --git a/secrets/gitlab/db.age b/secrets/gitlab/db.age new file mode 100644 index 0000000..b55f095 --- /dev/null +++ b/secrets/gitlab/db.age @@ -0,0 +1,19 @@ +age-encryption.org/v1 +-> ssh-ed25519 mOmPfg 5aqdEg4OJNg6Pw10HFpFKoRWZLvaiqsh0UWW2N5ql1Y +JfnQad6DgEqvRT7GJpjg+kFjgkz9P/Dc+rE3azeArOs +-> ssh-ed25519 YJiRbw R7DVCK0kirWs/OhPg4zUGqLMdO1usfDZNnmY5jndSQM +D47/wwjjRuzVSBdd5BG6nL4s1TtAGCBvrdGuwanyV68 +-> ssh-ed25519 Nl/5yA JkVW7aHVpsqPKY9wPoxS2MNCfmYv20Sk+844sNGjQxM +VojCPfa0dUGph/PJjocKVIGC1k9XYLiNfv7CPJyM8BY +-> ssh-ed25519 GdLgCQ WULneYbP+M1DrFX5JLVeCtkHycxtFBm9/x+oUXTu7Uk +2ez2hdvzXfhOePZsVzrVL+9XanmhyqcK/XkLdV43x68 +-> ssh-ed25519 tOH/HQ hHa+OtsIBPtYkDChXg2vhWhYdSqruooaWiPbdk9RgVQ +Ku6StrR8ZICUQEnXeZZ6gXAQp49tbluPKQIAa3KfuCc +-> ssh-ed25519 FpzvfQ DhdgZQSDKgmMmcitO4dHMJAbe+c67tfd8gDScp4Tvgc +h8PAX2B9t6VcqG9W1b0Z5moxD1b9P7Qgex6+ousoi3E +-> ssh-ed25519 kdPvzQ sSSfEIPPvA99/ziU676wPt9uLrHBIXECTuUmszYcZSk +TcssCYpN5wQTPCay8/gOeot1f6FyUK7sEBkhdwPIG3g +-> !Zmpi]O-grease KVI iU\+ he'#C +2O3D +--- Z3aUd7U6jlt1NiGY2oCzZKeD26gsiqB/Ysr+wRp7Y5E +T*#X )>D=>G|ZO2 `Fퟚ`f̎Z3+g=$ҫj1YԌxumqƅ \ No newline at end of file diff --git a/secrets/gitlab/jws.age b/secrets/gitlab/jws.age new file mode 100644 index 0000000..81cef5b --- /dev/null +++ b/secrets/gitlab/jws.age @@ -0,0 +1,19 @@ +age-encryption.org/v1 +-> ssh-ed25519 mOmPfg kNX5PaaipRVvjzMrXxjhlTSJD550eSGoa5zDbI4zQVc +VAWoBCGuVqKgDw7yEi0YkeIlO+YwdxFoEdLVPXO9y0s +-> ssh-ed25519 YJiRbw 9r/cKqXdhpXcDL9S8CDRGLD65Y8yopFGiMmWILtbXG4 +uifiAw7UCRkHc/uvwEnlzc7+2mKuLCYiAMREHzXdWZs +-> ssh-ed25519 Nl/5yA eVSbQEyXXYEBBiMenLZ6uEP/NNlB4pW4GYMaww6KJTg +8L2cYg6eYSFHAeY1jgk3GPDOYQYHsRcSXZDMxDW0hBQ +-> ssh-ed25519 GdLgCQ HDciLBHQg0Nhd8/QVfgY/6aOEfHdWMs2CwWjieKgIBM +/U/EP99DxhcMrhIa9ggQJSczTQCpDf2mzDJI0uXUYZo +-> ssh-ed25519 tOH/HQ ZHmlo/urIFxi8zShOTUqJRuVpFm9RdNtDi6+Fc79dE0 +RC+z3vkORLSFETGPoSbaml7kfA5GG/NK1IwNwn2XD0c +-> ssh-ed25519 FpzvfQ kQHudI+8AYPU9gWEp5rR5UeBoppKtdNONPgNpAGM0mo +025maJUyvy7QQpvv+eW7F0rOBMF3BBrwYHHnvwz67dk +-> ssh-ed25519 kdPvzQ lUYVBtzSufAD2XZmIH3J788y9oTunIFSNjKIOjuFCBM +bvW8hq+4iFgTpDf0zBIcxWwKMq6xkdKgnjm8q3YYYDk +-> NJL_l7-grease y4c : +kVPvEEpHy8iy//hr42NPPa1DWxgrk2+iAy3KqTZ4oQ +--- /muOWusu9T+JEtIWyMOb78bya/kLZ7AJ9VTNJeZrKLw +a{(F!&h,Ncy!66-<˃6tqi3 *WtXi|r?E'42YJ \ No newline at end of file diff --git a/secrets/gitlab/key.age b/secrets/gitlab/key.age new file mode 100644 index 0000000..38d0f7e Binary files /dev/null and b/secrets/gitlab/key.age differ diff --git a/secrets/gitlab/otp.age b/secrets/gitlab/otp.age new file mode 100644 index 0000000..6f3c7d3 --- /dev/null +++ b/secrets/gitlab/otp.age @@ -0,0 +1,20 @@ +age-encryption.org/v1 +-> ssh-ed25519 mOmPfg LVJSQ+R7PMpUpKdscHK4alpoivahuvF6hISGdY7gujU +XsmhzzTlEIWo8trvWg7wL6uI6bnHmc71tS8OIz61Xus +-> ssh-ed25519 YJiRbw Nl46Ujkg1RQDQ3jo6MoOWvOuiAce2Vhmk43wDiKC03M +Si/YWv3MSpQAwiD+IQWUD8eWPsWwI19ojsi46+ENr7Y +-> ssh-ed25519 Nl/5yA XDT/tyZ+W5dT1VkBNQcpYMtebHc/37K0hY6kMrtOzl0 +ugulqsgQ5Wp9t7nwhbYvdmL/9YAkpiTF0hJSVPiOvEA +-> ssh-ed25519 GdLgCQ hlBfw0CRRL+d7g5Xxp9zjOVGkO5wy8PAA7ukMCAb5Vg +MDrDCysJ3LJ7o0y/bXkxnx41Bq6Wr0EYEpqeBkbtbPc +-> ssh-ed25519 tOH/HQ 8QGmTG8sbWch2xOFqf9SfLiMY8hLmwIfWMOuHUg+AE4 +3cMeP+NMohzZ8ecMqKEvOo3vta+m1aUtQPBg+jCjyQs +-> ssh-ed25519 FpzvfQ cCNXN61RMnEqcGw199t2xZHug3qVrdtaSkbnqO4Onx8 +MfJHCpsMULqxj2/NSJob24uhFZR0ZhbIh1Arncs9bPw +-> ssh-ed25519 kdPvzQ SDan5OS6ZlZ6+btBx/nDwrPt1kAucMDVZZNlYnAFYA4 +cW6PL2fA8xazBvEe7SjW14o8R4djmCDmtuU8Z1+AEGw +-> }d^ +l78JedCUzpJH0PazQTE3FhpXmW39G5W78avwFQ +--- OvRr3P4ypXczMWZTi7HrsbPEz17jPYAS/k+XScuzEJM +v)WHr/w% +3+rǫK/ￍ*^{:2dbXCd aQ( +7"|L43E=?t߁ \ No newline at end of file diff --git a/secrets/gitlab/secret.age b/secrets/gitlab/secret.age new file mode 100644 index 0000000..19f0a95 Binary files /dev/null and b/secrets/gitlab/secret.age differ diff --git a/secrets/secrets.nix b/secrets/secrets.nix index f3f31e5..64d3428 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -1,7 +1,8 @@ let linode = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMv9Zud3kZOl86gtmkn+uj3D4kiXWDPtyUL02VVLNR4Q"; jude = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOos0zQePsa+T6Z2dsKbPOvEdrBQ8a6mx3s7pN6ysCI0 root@jude"; - systems = [ linode jude ]; + myself = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHleYKtfV4W1Z63Ysu9w5Rbglqlz4F92YcZoMkucoTNf"; + systems = [ linode jude myself ]; user1 = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQDLQRq55JKqLifX+31kEXyuoB8gfM+5thAlgR7XLPvvdu6g2a5cCWyozQ1I2oGbPRfJtzcJ5ifM7Ii2PuqAj3MdYFLHBEDOhIpBBWme9Ts2YB9HJ4NorBvB4zEfJd0Q7k2MmylyeBOwdwGz3bVqPRDcJbxWFMDHqr33FEs6SXdfyAQ5SvhWGARI84qz8zUUdOp6M4e3aIGO3cx1gA+YzYQ4FbUtL8+m1NFO8VoNFMZBMf5q0iF/SgEu5bmGWUCePia6DvfeBFQ2/y4Y7WmOj980WE+JmFTkIvmGruMYeGI8FuDQ2JIIIcehddy9bQbPF4VlGnTFsHqJYVRUUWc+vH1cPNMn01oB8s27ogf9e1lyhIN+cZOgp/jDt4eXcO4Wr04uwj7CI6m+d8iMQOa5Jv0hmNgqqiwOMVBlKeo0FCxlovzwvn/Lia9WZ74JqM6JwLCD8SZ0oFgiSIHOTHrQhr7iaCmj7X/0ey7VR8FnCrpeAJpG+ELTfWGshF1d9QR2zW7u4EsXTDLiuOmdJ+/KxwMvjMcWdlg2+Qch6SwulTQRxWaED2IWJo+YiAql8eaiVXu/eZJGLoiskGFZnONoLrzIT4pSjakPlrSpn/M/GkP1pDpaMkr24OhJsGpJNEU3F1ZcOMqy2iJzIxlPmU8Xg0I/OrnbJplpaXeRCqnmouJUJhWkaPzawaVyW7dtvprLWcpQtUgTRet18WLyOrLKlq1jwvNRMTPKUJ2IFJMpk2pNEP6bdiUxyMa4vrRIEU2p1zsYSUJpCRLtccZ/i/+yAqwnTA2L5TdAORi9nD2uCdM/Ljz52V3A14QapS6oqcoWx2soWKgnsbVXoG8DxmUTpll77Ze9t7Y5216SMInWuOu0vstP8ZcgFmWsiBgIYIuLA58abWHMxgD251phYidua6R3Gtkf8J/kYqTR1P6eJF1bt5efEg7FD2aL1QQZsYJo3CRNz7yVe1XqMdPbfe2mFXQVF9TDX5x6r9Ir3d0KiEmTlBdByz8nSyPJ8IQxC58NT4LNVQs3p2XH2Zcf6B4JOBSmV4NNBnLseFobsxniWjkWwZigED/D2iu3OXuuhmskCbw0hKy2rBcKffaSNMioVqYIiYNfKlMlSvAacQKqc/1HCpqgX8PwAcSgNSLy4K7/gIrTHmjY+g+CH7onzatWzkLo+0vsZRa/D/qwhhK2CU2FeU07mhnWxWuzqpJuqVaAwDTaEforK7nQUtAOFAZZP6qGhIoqsynYt4THb+QORb3QYfaP0PVgQwXfVU5Q8eUQFZ8A+siPtOASFjDumsIbseB5VzkF+UhvdseJwkX2+4pVFu8eHFDyvArYsHeGK6fBcQGJFQc2jSs6doIP9HD9IO2R ghelling@unknown38BAF87CD102"; @@ -9,15 +10,17 @@ let user5 = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQDR4vmc5TiymSjMB7E+oYsiTxOg+2xwnLAILYjQKPA7dIvz/A/HW31R1aVVxNEgkHm8qeqmgE1bUysMMl128zvdKmwkMmq2uagx9hboyfCwOYRaQOtpS0dlgSllhM654vL9553t94sTuMIfNUiXBD3EV2Z5JJ1RteCkBTJjzmXQnV9he0xozBYOdGv35UGneQzAr7Pps9iK81mR4yW+vLcW3pAaPmDBbN7C6WFxqcEBWsaJZK0rLCTrQo+6B130XgH6gPgh4GyDaRmtRJl63yANiP/RfkDFTPKOh87slLLZaHJUe94P2CTZw0e9xSzWuzx71nBp9JhkoZkI9XD+AnbHIZ9X3twIADUf+D0fivzOH+Yzne0gNRFa+O4x8xd/xj8QeM+Rr1ATikBf/FRfyx+RzHgHS1ZyOKfIpQbrm44E8Smv7FzS5RcCfAScSn0npOqP0cilYjtDCEoeMVsx4XQy4+iYLOA/EaMICSz2PwQFG/KXe7NK30Cc5flq5qUiz8TX1Mzlxuro4qTktYSXZBs5YyEg3Za/hcqMV52kVn0W8S1DatHOL4TlRKYeKsg1hWNvtm2MRqJvWkqK9vNNL86Ew5D5hgXdCk+AiRzOhQxfprPYMea2Vx1Mkaq3VYHWmJBWc/m4aOKUSajhFu8KG7l8bc4IkgC+qQCYzr6pCUDlCaCEF1iQ3lItSkbJJmRBHKEOb85lsIJ/SZ0bhsMl8bc9z33zY+bwv2NezG/aKVGrny4ZTAI1BKkZN/60L0yzJihyKamEa442jjnvG1jzC2wEtd/0gCGWScfZsQWqDu97spbeq8jrc67U9xqlGTrWyyNsCW2lpu26cQWWRC8ufl5zBNRDFDSYKceBaJ2+sx1GPj3YYdJSlTt5JvxNyBg0BGfGqCTd0w4IXF3KP9IZRWWAKPaOZcil2MRZwYhWEd7p+CtKVAL93uW0sE+0C13+iFMnBUkFBJ2dZH+tWpywCRYcrVNvrBlsHe2XniwBwvQHUFgKaQAB8upFTK1xBWTh2S+CVyNed/fckAUrPDj4sI2NERGcyPC5Oi6r0fUPtcWvKRfA/yXx5A0iNWc6acTqd5wwSO3s8rOCjIwdczZmkmnjAf3UKhmtDnwRd9rbO5Hanom80re9Dk0W+z9E2+70b9iYvZ60pbw+cG4WqEQnr02RS8hKvU0CsYFoDMTzV4snqTKNrl0IeD+Fmjl7oDkcC4YQbZd2902qVL3WHHvW+p0WQ1B/rk8BPVRYVmrUQbqwPFCQlmTe3Zy+LpqbWYemhQJGVSiEiioVNCc7pHO6RyWLCoEQKwKHAoNleKtkG94hT/d0z+1RYpB/nbJ51BPihK5EMlXbw/Hu1SVaaDLOSL6p greg@mm"; user_genesis_virt = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFWPSFQT0AH77wrwRhiskcBS0w4ZakBRdJywYYBsnm3S greg@genesis"; + user_ivr = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMYzms+KIe5/bYF3uCyFjA5e1AgMPLIA3c4k417coqBe gregory.hellings@ls23003"; user_jude = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINnRc/kBhxcjpUtiRQY+BXnSObdp0jFL1395wAQxJip7 greg@jude"; user_linode = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINAX6pNx5mbwIa8X+GzktyNijfYmJUpgROFpRxSW9js0 greg@linode"; - user_ivr = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMYzms+KIe5/bYF3uCyFjA5e1AgMPLIA3c4k417coqBe gregory.hellings@ls23003"; + user_myself = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAl6DJVrPSujvJSAEA5Q8tRrzfJs/c6DMwqwQEUFffIR greg@myself"; users = [ user_genesis_virt + user_ivr user_jude user_linode - user_ivr + user_myself ]; everyone = systems ++ users; @@ -36,4 +39,14 @@ in "linode-forgejo-runner.age".publicKeys = everyone; "jude-forgejo-runner.age".publicKeys = everyone; + + + "gitlab/secret.age".publicKeys = everyone; + "gitlab/otp.age".publicKeys = everyone; + "gitlab/db.age".publicKeys = everyone; + "gitlab/jws.age".publicKeys = everyone; + # openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.crt -days 365 -nodes -subj '/CN=issuer' + # Then pipe the resulting files to agenix -e + "gitlab/key.age".publicKeys = everyone; + "gitlab/cert.age".publicKeys = everyone; }