diff --git a/README.md b/README.md index 47a72e1..ba98a97 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,5 @@ +[![built with garnix](https://img.shields.io/endpoint.svg?url=https%3A%2F%2Fgarnix.io%2Fapi%2Fbadges%2Fgreg-hellings%2Fnixos-config%3Fbranch%3Dmain)](https://garnix.io) + This is a unified repo to contain my personal configurations for NixOS machines. # How To Use This @@ -11,22 +13,12 @@ Go through the normal process to setup a NixOS system during installation. /etc/nixos folder 5. Run the configuration generator. It should only genreate the hardware-configuration.nix file, which this repo gitignores -6. Symlink the folder for the appropriate host to the location 'host' as such: - `ln -s hosts/myhost host`. -7. Run the nixos installation command +6. Create a folder and file with the machine name in `hosts//default.nix` +7. Add `hosts/default.nix` an appropriate entry for the machine you are building +8. Create a file `home/hosts//default.nix` with the new machine name as well # Adding new hosts To add a new host, create a folder in the directory `hosts/` that matches the name of the target system. Each host must contain, minimally, a `default.nix` file that serves as the basis of configuring that host. - -## Profiles - -Certain shared characteristics can be created in the `profiles/` folder and included in -a particular host's configuration. For instance, any hosts that are running on a -Raspsberry Pi 4 should include the `profiles/rpi4.nix` file to properly configure things -like the kernel and boot parameters. Since I live in the "America/Chicago" timezone, hosts -that run in my home will also include `profiles/home.nix`. That file will also set the -domain that I use for my hosts at home. This allows shared content to be reused across -multiple machines without the need to repeat it. diff --git a/garnix.yaml b/garnix.yaml index ea35e6e..531ec88 100644 --- a/garnix.yaml +++ b/garnix.yaml @@ -1,8 +1,7 @@ builds: include: - - '*.x86_64-linux.*' - - '*.aarch64-linux.*' - - nixosConfigurations.* - darwinConfigurations.* - devShell.x86_64-linux - devShell.aarch64-linux + - homeConfigurations.greghellings.activationPackage + - nixosConfigurations.* diff --git a/home/default.nix b/home/default.nix index 0e50814..ce74127 100644 --- a/home/default.nix +++ b/home/default.nix @@ -4,8 +4,8 @@ ... }: -{ - "gregory.hellings" = +rec { + greghellings = let system = "x86_64-linux"; pkgs = (import inputs.nixunstable { inherit system overlays; }); @@ -20,4 +20,6 @@ username = "gregory.hellings"; }; }; + + "gregory.hellings" = greghellings; } diff --git a/home/hosts/ls23003/default.nix b/home/hosts/ls23003/default.nix new file mode 100644 index 0000000..facb35d --- /dev/null +++ b/home/hosts/ls23003/default.nix @@ -0,0 +1,4 @@ +{ ... }: +{ + +} diff --git a/home/ssh.nix b/home/ssh.nix index 09ed6df..60f111f 100644 --- a/home/ssh.nix +++ b/home/ssh.nix @@ -27,7 +27,7 @@ "chronicles.thehellings.lan" = lib.hm.dag.entryBefore [ "*.thehellings.lan"] nas; gh = { user = "git"; hostname = "github.com"; }; - "src" = { user = "gitea"; hostname = "src.thehellings.com"; }; + "src" = { user = "forgejo"; hostname = "src.thehellings.com"; }; "*.thehellings.lan" = owned; "10.42.*" = owned; diff --git a/hosts/default.nix b/hosts/default.nix index fd2cd79..ee0e65a 100644 --- a/hosts/default.nix +++ b/hosts/default.nix @@ -49,7 +49,6 @@ in { }; icdm-root = unstable { name = "icdm-root"; }; linode = machine { name = "linode"; }; - lappy = machine { name = "lappy"; }; mm = unstable { name = "mm"; }; myself = unstable { name = "myself"; }; iso = machine { name = "iso"; }; diff --git a/hosts/genesis/networking.nix b/hosts/genesis/networking.nix index 496e3dc..bfe416a 100644 --- a/hosts/genesis/networking.nix +++ b/hosts/genesis/networking.nix @@ -7,29 +7,30 @@ let routerIP = "10.42.1.2"; extraHosts = builtins.concatStringsSep "\n" [ # Local hosts - "10.42.0.1 switch" + "10.42.0.1 switch switch.thehellings.lan" "10.42.1.1 pve1.thehellings.lan" "10.42.1.2 opnsense router opnsense.thehellings.lan router.thehellings.lan" - "10.42.1.3 printer" - "10.42.1.4 chronicles nas" + "10.42.1.3 printer.thehellings.lan" + "10.42.1.4 chronicles chronicles.thehellings.lan nas.thehellings.lan" "10.42.1.5 genesis genesis.thehellings.lan dns dns.thehellings.lan smart smart.thehellings.lan jellyfin jellyfin.thehellings.lan" + "10.42.1.6 isaiah isaiah.thehellings.lan" "10.42.1.12 tv" + "10.42.100.6 isaiahbmc isaiahbmc.thehellings.lan" + # Tailscale hosts - "100.90.74.19 jude.shire-zebra.ts.net" - "100.88.91.27 dns.shire-zebra.ts.net" - "100.119.228.115 chronicles.shire-zebra.ts.net" - "100.115.57.8 linode.shire-zebra.ts.net" - "100.88.91.27 genesis.shire-zebra.ts.net jellyfin.home smart.home zwave.home" - "100.78.16.88 mm.shire-zebra.ts.net" + "100.90.74.19 jude.home" + "100.88.91.27 dns.home" + "100.119.228.115 chronicles.home nas.home" + "100.115.57.8 linode.home" + "100.88.91.27 genesis.home jellyfin.home smart.home zwave.home" + "100.78.16.88 mm.home" + "100.84.183.79 myself.home myself.shire-zebra.ts.net git.thehellings.lan" # Dev hosts "10.42.101.1 icdm.lan wiki.icdm.lan *.icdm.lan" ]; - extraConfig = builtins.concatStringsSep "\n" [ - ]; - adblockUpdate = pkgs.writeShellScriptBin "adblockUpdate" (builtins.readFile ./adblockUpdate.sh); proxyPort = 3128; dnsPort = 53; @@ -87,9 +88,9 @@ in { ]; }; nftables.enable = true; - extraHosts = "${extraHosts}"; }; + environment.etc."hosts.d/local".text = extraHosts; fileSystems."/media" = { device = "10.42.1.4:/volume1/video/"; @@ -148,6 +149,7 @@ in { dhcp-host = [ # Static IPs for personal work "00:00:de:ad:be:ef,10.42.2.254" + "01:a8:a1:59:c7:8a:12,10.42.2.253" # BMC management interface for isaiah # Static IPs for things in the IOT range "b4:b0:24:9a:02:4a,192.168.66.5" # LD125 @@ -181,10 +183,11 @@ in { expand-hosts = true; log-dhcp = true; log-queries = true; + no-hosts = true; # Do not read /etc/hosts, which makes genesis resolve to 127.0.0.2 addn-hosts = "/etc/adblock_hosts"; + hostsdir = "/etc/hosts.d/"; server = dnsServers; }; - extraConfig = "${extraConfig}"; }; # Update adblock list @@ -206,6 +209,8 @@ in { #}; environment.systemPackages = with pkgs; [ + bind curl # Used by dnsmasq fetching + sqlite ]; } diff --git a/hosts/myself/container-git.nix b/hosts/myself/container-git.nix new file mode 100644 index 0000000..c68fe88 --- /dev/null +++ b/hosts/myself/container-git.nix @@ -0,0 +1,95 @@ +{ inputs, registryPort, ...}: +{ config, pkgs, lib, ... }: { + imports = [ + inputs.agenix.nixosModules.default + ../../modules-linux/proxy.nix + ]; + + age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; + age.secretsMountPoint = "/run/derp"; + age.secrets = let + cfg = n: { file = ../../secrets/gitlab/${n}.age; owner = "github"; mode = "0444"; }; + in { + gitlab-secret = cfg "secret"; + gitlab-otp = cfg "otp"; + gitlab-db = cfg "db"; + gitlab-jws = cfg "jws"; + gitlab-key = cfg "key"; + gitlab-cert = cfg "cert"; + }; + + networking = { + firewall = { + enable = true; + allowedTCPPorts = [ 80 registryPort ]; + }; + useHostResolvConf = lib.mkForce false; + }; + + greg.proxies."192.168.200.2".target = "http://unix:/run/gitlab/gitlab-workhorse.socket"; + + services = { + resolved.enable = true; + openssh.enable = true; + gitlab = { + enable = true; + backup = { + keepTime = 288; + startAt = [ "03:00" ]; + }; + host = "src.thehellings.com"; + https = true; + port = 443; + extraConfig = { + gitlab = { + trustedProxies = [ "192.168.200.1/32" ]; + }; + }; + initialRootEmail = "greg@thehellings.com"; + initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password"; + pages = { + enable = true; + settings.pages-domain = "pages.thehellings.com"; + }; + puma = { + threadsMax = 6; + threadsMin = 2; + workers = 6; + }; + redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}"; + registry = { + enable = true; + certFile = config.age.secrets.gitlab-cert.path; + keyFile = config.age.secrets.gitlab-key.path; + externalPort = registryPort; + }; + secrets = { + secretFile = config.age.secrets.gitlab-secret.path; + otpFile = config.age.secrets.gitlab-otp.path; + dbFile = config.age.secrets.gitlab-db.path; + jwsFile = config.age.secrets.gitlab-jws.path; + }; + }; + + postgresql = { + enable = true; + checkConfig = true; + ensureDatabases = [ "gitlab" ]; + ensureUsers = [ { + name = "gitlab"; + ensureDBOwnership = true; + } ]; + settings = { + log_connections = true; + log_statement = "all"; + logging_collector = true; + log_filename = "postgresql.log"; + }; + }; + + redis.servers.gitlab = { + enable = true; + }; + }; + system.stateVersion = "24.05"; +} diff --git a/hosts/myself/container-runner-qemu.nix b/hosts/myself/container-runner-qemu.nix new file mode 100644 index 0000000..551d1da --- /dev/null +++ b/hosts/myself/container-runner-qemu.nix @@ -0,0 +1,63 @@ +inputs: +{ config, pkgs, ... }: +let + extraPackages = with pkgs; [ + curl + gawk + git + packer + pup + (python3.withPackages (p: with p; [ pip pyyaml virtualenv ])) + qemu_full + qemu_kvm + shellcheck + xonsh + xorriso + ]; +in { + imports = [ + inputs.agenix.nixosModules.default + ]; + age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; + age.secrets = let + file = num: { + file = ../../secrets/gitlab/myself-qemu-runner-reg-${num}.age; + owner = "gitlab-runner"; + }; + in { + qemu-runner-reg-1 = file "1"; + qemu-runner-reg-2 = file "2"; + qemu-runner-reg-3 = file "3"; + qemu-runner-reg-4 = file "4"; + qemu-runner-reg-5 = file "5"; + }; + + networking.useHostResolvConf = pkgs.lib.mkForce false; + networking.nameservers = [ "100.100.100.100" ]; + services.resolved.enable = true; + + environment.systemPackages = extraPackages; + + services.gitlab-runner = { + enable = true; + settings.concurrent = 5; + services = let + r = num: { + executor = "shell"; + registrationConfigFile = config.age.secrets."qemu-runner-reg-${num}".path; + tagList = [ "shell" "qemu" ]; + }; + in { + shell1 = r "1"; + shell2 = r "2"; + shell3 = r "3"; + shell4 = r "4"; + shell5 = r "5"; + }; + }; + + systemd.services.gitlab-runner.wants = [ "network-online.target" ]; + systemd.services.gitlab-runner.after = [ "network.target" "network-online.target" ]; + + system.stateVersion = "24.05"; +} diff --git a/hosts/myself/container-runner-vbox.nix b/hosts/myself/container-runner-vbox.nix new file mode 100644 index 0000000..93c46f7 --- /dev/null +++ b/hosts/myself/container-runner-vbox.nix @@ -0,0 +1,84 @@ +{ inputs, name, extra}: + +({ config, pkgs, lib, ... }: +let + py = (pkgs.python3.withPackages (p: with p; [ + pip + pyyaml + virtualenv + ])); +in ( + lib.attrsets.recursiveUpdate { + + imports = [ + inputs.agenix.nixosModules.default + ]; + + age = { + identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; + secrets.runner-reg = { + file = ../../secrets/gitlab/myself-${name}-runner-reg.age; + owner = "gitlab-runner"; + }; + }; + + environment.systemPackages = with pkgs; [ + curl + gawk + git + packer + pup + py + shellcheck + xorriso + ]; + + networking = { + useHostResolvConf = pkgs.lib.mkForce false; + nameservers = [ "100.100.100.100" ]; + }; + + nixpkgs.config.allowUnfree = true; + + services = { + gitlab-runner = { + enable = true; + settings.concurrent = 5; + services = { + shell = { + executor = "shell"; + limit = 5; + registrationConfigFile = config.age.secrets.runner-reg.path; + tagList = [ "shell" name ]; + }; + }; + }; + resolved.enable = true; + }; + + systemd.services.gitlab-runner = { + wants = [ "network-online.target" ]; + after = [ "network.target" "network-online.target" ]; + serviceConfig = { + User = "root"; + DynamicUser = lib.mkForce false; + }; + }; + + system.stateVersion = "24.05"; + users.users.gitlab-runner = { + isNormalUser = true; + group = "gitlab-runner"; + extraGroups = [ + "root" + "sudo" + "vboxusers" + "wheel" + ]; + }; + users.groups.gitlab-runner = {}; + } + + extra +) # End of attrsets.recursiveUpdate +) # End of outter function wrapper diff --git a/hosts/myself/default.nix b/hosts/myself/default.nix index 48c2c8d..040759f 100644 --- a/hosts/myself/default.nix +++ b/hosts/myself/default.nix @@ -36,16 +36,6 @@ "10.42.1.5" ]; }; - virtualisation = { - libvirtd = { - enable = false; - onBoot = "ignore"; - }; - virtualbox.host = { - enable = true; - enableExtensionPack = true; - }; - }; users = { users = { greg = { diff --git a/hosts/myself/git.nix b/hosts/myself/git.nix index db426c6..90a97fe 100644 --- a/hosts/myself/git.nix +++ b/hosts/myself/git.nix @@ -1,22 +1,15 @@ { config, pkgs, lib, inputs, ... }: let - extraPackages = with pkgs; [ - config.virtualisation.virtualbox.host.package - curl - gawk - packer - pup - (python3.withPackages (p: with p; [ pip virtualenv ])) - qemu_full - qemu_kvm - xonsh - xorriso - ]; gitlabStateDir = "/var/lib/gitlab"; registryPort = 8001; + + container = input: (lib.attrsets.recursiveUpdate { + bindMounts."/etc/ssh".hostPath = "/etc/ssh"; # For agenix secrets + privateNetwork = true; + } input); in { networking = { firewall = { @@ -30,108 +23,92 @@ in { }; }; - greg.proxies."isaiah.thehellings.lan".target = "http://192.168.200.2"; + greg.proxies."git.thehellings.lan".target = "http://192.168.200.2"; system.activationScripts.makeGitlabDir = lib.stringAfter [ "var" ] "mkdir -p ${gitlabStateDir} && touch ${gitlabStateDir}/touch"; - containers.gitlab = { + containers.gitlab = container { autoStart = true; bindMounts = { "/var/gitlab/state" = { hostPath = gitlabStateDir; isReadOnly = false; }; - "/etc/ssh".hostPath = "/etc/ssh"; }; - privateNetwork = true; + forwardPorts = [{ + hostPort = 2222; + containerPort = 22; + }]; hostAddress = "192.168.200.1"; localAddress = "192.168.200.2"; - config = { config, pkgs, ... }: { - imports = [ - inputs.agenix.nixosModules.default - ../../modules-linux/proxy.nix - ]; + config = ((import ./container-git.nix) { inherit inputs registryPort; }); + }; - age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; - age.secretsMountPoint = "/run/derp"; - age.secrets = let - cfg = n: { file = ../../secrets/gitlab/${n}.age; owner = "github"; mode = "0444"; }; - in { - gitlab-secret = cfg "secret"; - gitlab-otp = cfg "otp"; - gitlab-db = cfg "db"; - gitlab-jws = cfg "jws"; - gitlab-key = cfg "key"; - gitlab-cert = cfg "cert"; + systemd.services."container@gitlab-runner-qemu".serviceConfig = { + DevicePolicy = lib.mkForce "auto"; + ExecPostStop = [ + "rmmod kvm_amd kvm" + ]; + ExecPreStart = [ + "modprobe kvm" + ]; + }; + systemd.services."container@gitlab-runner-qemu".conflicts = [ "container@gitlab-runner-vbox.service" ]; + + containers.gitlab-runner-qemu = container { + bindMounts = { + "/dev/kvm" = { + hostPath = "/dev/kvm"; + isReadOnly = false; }; - - networking = { - firewall = { - enable = true; - allowedTCPPorts = [ 80 registryPort ]; - }; - useHostResolvConf = lib.mkForce false; - }; - - greg.proxies."192.168.200.2".target = "http://unix:/run/gitlab/gitlab-workhorse.socket"; - - services = { - resolved.enable = true; - gitlab = { - enable = true; - backup = { - keepTime = 288; - startAt = [ "03:00" ]; - }; - host = "isaiah.thehellings.lan"; # Just for now... - https = false; - initialRootEmail = "greg@thehellings.com"; - initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password"; - pages = { - enable = true; - settings.pages-domain = "pages.thehellings.com"; - }; - puma = { - threadsMax = 6; - threadsMin = 2; - workers = 6; - }; - redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}"; - registry = { - enable = true; - certFile = config.age.secrets.gitlab-cert.path; - keyFile = config.age.secrets.gitlab-key.path; - externalPort = registryPort; - }; - secrets = { - secretFile = config.age.secrets.gitlab-secret.path; - otpFile = config.age.secrets.gitlab-otp.path; - dbFile = config.age.secrets.gitlab-db.path; - jwsFile = config.age.secrets.gitlab-jws.path; - }; - }; - - postgresql = { - enable = true; - checkConfig = true; - ensureDatabases = [ "gitlab" ]; - ensureUsers = [ { - name = "gitlab"; - ensureDBOwnership = true; - } ]; - settings = { - log_connections = true; - log_statement = "all"; - logging_collector = true; - log_filename = "postgresql.log"; - }; - }; - - redis.servers.gitlab = { - enable = true; - }; - }; - system.stateVersion = "24.05"; }; + extraFlags = [ + "--property=DeviceAllow=/dev/kvm" + ]; + hostAddress = "192.168.201.1"; + localAddress = "192.168.201.2"; + config = ((import ./container-runner-qemu.nix) inputs); + }; + + systemd.services."container@gitlab-runner-vbox".serviceConfig = { + DevicePolicy = lib.mkForce "auto"; + ExecPostStop = [ + "rmmod vboxnetadp vboxnetflt vboxdrv" + ]; + ExecPreStart = [ + "modprobe vboxdrv vboxnetadp vboxnetflt" + ]; + }; + systemd.services."container@gitlab-runner-vbox".conflicts = [ "container@gitlab-runner-qemu.service" ]; + + containers.gitlab-runner-vbox = container { + bindMounts = { + "/dev/vboxdrv" = { + hostPath = "/dev/vboxdrv"; + isReadOnly = false; + }; + "/dev/vboxdrvu" = { + hostPath = "/dev/vboxdrvu"; + isReadOnly = false; + }; + "/dev/vboxnetctl" = { + hostPath = "/dev/vboxnetctl"; + isReadOnly = false; + }; + }; + hostAddress = "192.168.202.1"; + localAddress = "192.168.202.2"; + config = ((import ./container-runner-vbox.nix) { + inherit inputs; + name = "vbox"; + extra = { + virtualisation.virtualbox.host = { + enable = true; + enableExtensionPack = true; + enableHardening = false; + headless = true; + }; + }; + }); }; } diff --git a/modules-linux/default.nix b/modules-linux/default.nix index 8b6757f..2ac57da 100644 --- a/modules-linux/default.nix +++ b/modules-linux/default.nix @@ -30,7 +30,7 @@ networking = { search = [ "thehellings.lan" - "shire-zebra.ts.net" + "home" ]; networkmanager.enable = true; }; diff --git a/secrets/gitlab/myself-qemu-runner-reg-1.age b/secrets/gitlab/myself-qemu-runner-reg-1.age new file mode 100644 index 0000000..0418295 --- /dev/null +++ b/secrets/gitlab/myself-qemu-runner-reg-1.age @@ -0,0 +1,21 @@ +age-encryption.org/v1 +-> ssh-ed25519 mOmPfg yedBTcoEi6XUymLmQdhQfMwPz6ZMhsMEfOgZCUZ/OiE +UFU8QhdzixX/f6nAypvKHdkQ9tdGdHP+PsVUphOJODo +-> ssh-ed25519 YJiRbw nHmyayy1IKwaQ9wkWIa92TeW/MHJoFyqzOnphmsUWHg +cEMhQ/owjFoReZm+SJ2u4iUrocSBNkZxn8Bu8JiU5LY +-> ssh-ed25519 aY2AXA nu7sv2QwvlbtRCYv84hIwCf9GY6TIHq2psDBATisjUI +sm6+2g+fcmiACyxSnVxGnqaBDCSInGGevnC9Nwd/1rU +-> ssh-ed25519 Nl/5yA 5xIPsvRdo7qHHIH+zNLk6RwgKmjD7s8HigfHrvMD+WQ +tDqT7o6cenlB+Pkc6q5SnHHwvd4qWSm7V1LzvObDKrY +-> ssh-ed25519 GdLgCQ qG1wePre+Vn3nDQtIX+Q4LQ46Xntt/1Xq5yk7iMWwBc +rrIqq70J/8drLZ2V2R8KtAjdnLlMmFEbF1BcAxXkMpA +-> ssh-ed25519 tOH/HQ 8diwiaQwh8w+6U9hiNnOzgbUogeuH9CG6obxIeZQa1k +EfT5VDbmRVrITEDE9YPnvSg4W8cKk/Db3jD9XrxF9nw +-> ssh-ed25519 FpzvfQ xPe0pDhsxlA9NPZN6Ss24dQgWQowpkexwfxyZSbBjEI +JZxyu3y+bjf5mwwOSZZmDwnQUJ6Ql9hFHjWln/x/iew +-> ssh-ed25519 kdPvzQ Uzftnj2exQJMgjkoO9I6DZYjCXYUtPZqwf3023rmAWQ +8fWu2mZbPoJlLhKJN7Ns9RhKXHGuOy6RQFHISZn4Pcg +-> ZOzxv-grease 1>wp U@ D2 +BaR+f/XM20cT+Ybw35peBoaM +--- zeE8ObGuQdkRECFv6jGTom/xGVE0h1AQJJlGECUGcKw +,s dV"Y)<8@z\&W d r+r;_:y셱%z*G'w{ZW`6'.Mt at7K%ӵv^J \ No newline at end of file diff --git a/secrets/gitlab/myself-qemu-runner-reg-2.age b/secrets/gitlab/myself-qemu-runner-reg-2.age new file mode 100644 index 0000000..e2d7314 --- /dev/null +++ b/secrets/gitlab/myself-qemu-runner-reg-2.age @@ -0,0 +1,23 @@ +age-encryption.org/v1 +-> ssh-ed25519 mOmPfg QRKinSglUT5mjchw4/mDO91hAUm8oEXGrUkrQTjcPic +/NB/ucCSX6dNmHYLO4HMxucilwt7hxTHeUIKDc8kuh0 +-> ssh-ed25519 YJiRbw yE7YWVJ3jgW7sPlygMTezfkeS6TAjRdGxdV53K5JOVY +QdwrGrM0oUyIN2KXFFTmw+wcbLASirz54wLtrsyTf38 +-> ssh-ed25519 aY2AXA kY842plwuQkpLhVF/NSF0fgibmy4fDKT29BI8QPSuFY +52hfgDE3BE5BlMeoXEL7DbFpKx8WiGHFj+g1GCNHo/o +-> ssh-ed25519 Nl/5yA aXblBrmFnTOYlaDt5ULrxBSudS1lkc5Y4GRBDzYEwE0 +sh+dbHuQ/GPViOEu/iwrQVmwMEFZt2U4cd8fqtBhips +-> ssh-ed25519 GdLgCQ qOepkvfW8tb5zx8mx0ZEfHlsTQqbAVuSNzltRtFXyBI +T4dHO/iGupNu7QpJB88AyfWGUiy18lUlBjEMEE1TBNc +-> ssh-ed25519 tOH/HQ 58lz7Qw3cMgSQuSbRfLwvv+RLtqyZCmKiSQuStmVCDg +lZ4PpHldp9Kmh9u+JuUuHp5CtBEQ0s8qcrhJY+qL1ro +-> ssh-ed25519 FpzvfQ pIu/O2EfGHOdIIv9C5RudJe0wE0tF2a2zN+uBFwqpWg +FwU79gBV4WXtPK3XO/EEcMagF5MX66qIZekgdh6VxIg +-> ssh-ed25519 kdPvzQ WgoFNx6cxQ3OaneO3s9wjAJhU8r232rsEmSekU1GXAk +LagJMqiT6t21PfgXaz1c9Vb3Us2mxB+rUByBUhD5SyM +-> XWz-grease ~X,$Oko +qcqccJwfeg +--- Q+UD1YpBDrJ3Ltv283DDrr3AY/MN46qqU/DHb3EcMj0 + +o8缹lOX"aq"E(_fɗ ,t4pNJYX{o^M +Іws 85yُl \ No newline at end of file diff --git a/secrets/gitlab/myself-qemu-runner-reg-3.age b/secrets/gitlab/myself-qemu-runner-reg-3.age new file mode 100644 index 0000000..50e0948 Binary files /dev/null and b/secrets/gitlab/myself-qemu-runner-reg-3.age differ diff --git a/secrets/gitlab/myself-qemu-runner-reg-4.age b/secrets/gitlab/myself-qemu-runner-reg-4.age new file mode 100644 index 0000000..a7bdcce Binary files /dev/null and b/secrets/gitlab/myself-qemu-runner-reg-4.age differ diff --git a/secrets/gitlab/myself-qemu-runner-reg-5.age b/secrets/gitlab/myself-qemu-runner-reg-5.age new file mode 100644 index 0000000..3b9b1e4 --- /dev/null +++ b/secrets/gitlab/myself-qemu-runner-reg-5.age @@ -0,0 +1,21 @@ +age-encryption.org/v1 +-> ssh-ed25519 mOmPfg w03rWuYjifXp2/Kdv39PU6Fx8ttD+BcPMVZkJdfRWEE +iXmxJd9pW1Xc8XtvMF6wOtyjvPzGeDiaKuF28W0+MiM +-> ssh-ed25519 YJiRbw YDx0gI3Gk5YBLImABvTh+Vl8WVURbPjdZbme0zNmkXI +OMty1bEO4Mlr01GSwZ9Ig3DBylsObUcck67B6kE7zEk +-> ssh-ed25519 aY2AXA 57Mvd6nFNFw7Sh8JOm4kuaetSNatG8f6J+ExIsHp03s +pCqA6SmOWvPaP/ydWz24ZeFqP+Z11hm94F1Bey4s+uk +-> ssh-ed25519 Nl/5yA TwMhEFDBL9Y8jSgF6F2SE+QunjaVWGm+LCdEuLEl/j0 +oinaKzMAlTejndkZUjCMnIgS7FLxWOfO/w24TCS3IrA +-> ssh-ed25519 GdLgCQ aMAkHj3LfAobDICK4OMaAeyYFMLt1Evx5WmVl1bBMHg +/cVfO29x1jTdyeSpauhKNzt1C9+T4z1kIujIPORtn/c +-> ssh-ed25519 tOH/HQ daRvGZwMGnFRFKAxHcOR3Pgb2E+h8y7cQK5G+vDXVls +olWk4ahhkH/dNPyUhxI8iWTlNca6hpxVZqkbvJCU9mQ +-> ssh-ed25519 FpzvfQ zcUzSRK67CLrn6KBe2AHIb0hop3smip4y2+2rC3yznU +ea3y+ZhzzT7Kk37g84G6Lm5Hmo+7l8wxuwmnatIM5xo +-> ssh-ed25519 kdPvzQ f7bGPzHX2pxUSxMI78M15deiV3rXN+v3p2E52v6JiS4 +UETYJIs0xo4UakXgqjf+gthl6L2VuTBeQTRyv7/C3k0 +-> I-grease nF) +EyWKPe3DezYJKTUV/fFxjTZ0MEVYnEWmuSH7bGzqqEBLfoI +--- manrceW5TDDoWUUWloP3bIGIkk1jXY4YA8vI82W8P04 +ƝPdٕ޵%1|' ZK'[@yF?'i{ !f> bt~zq$$]HBRL#r+@\ \ No newline at end of file diff --git a/secrets/gitlab/myself-vbox-runner-reg.age b/secrets/gitlab/myself-vbox-runner-reg.age new file mode 100644 index 0000000..40818f0 --- /dev/null +++ b/secrets/gitlab/myself-vbox-runner-reg.age @@ -0,0 +1,22 @@ +age-encryption.org/v1 +-> ssh-ed25519 mOmPfg 1+SrnSmUVltI+CShLbsLlXukVf3L/W4Zewwu6kYS020 +AYynTBanXxis2sadfTbCEfbK071mbYAp52H0GgdswO0 +-> ssh-ed25519 YJiRbw ++Rpjl9AUg1iiKueeoPwceiuAUsmhEzHNKj6zAwrQFo +oKRmh0LZS8XOGsQ55BvIvLFvybWkTuOj8ZN+f4FcqN8 +-> ssh-ed25519 aY2AXA IUkslHupkzLK2oXpcj17LfzsCdJ5RaIt2V13OKQEnzw +VLHEbGXmIPiJa49/oS1FCzpIQWjlG2XJ3SnVRyPcdZg +-> ssh-ed25519 Nl/5yA HWZHuESxYQIX0Ol1Cd0SQGHsAlBSCcvt6zyKtyROIy0 +kNDdxcZ+MA+CDk2fU1wLu0iCL/6528gVIGy3EyrgX7Y +-> ssh-ed25519 GdLgCQ ZQgnEBjjWXo9CKvA8VayduzEqzhu2LL5OzKbF6R8PmE +6BMycP8rCP9xb2tLscpiC7o0ORXju3EVPhge6O8o7QU +-> ssh-ed25519 tOH/HQ Pw0XAGp2pCJEGH8KqjBbPFZqecUaOBJTBWc7Vbbe4T0 +IOsaS11c6MF0uAJAAkeE4vn63mLCaqlOG8/2G2XtAsk +-> ssh-ed25519 FpzvfQ nG48AJt+9ArEPeFSfhbem4H8Oxd7d7oOMNm15oosF20 +IslIFcLR9d4wfGgdOhzHd8O2Vpc+WTW4h1YNnPy1oyI +-> ssh-ed25519 kdPvzQ 7CUogLrCwPqHowodCayIUKVebjrTP5/NNoJXFCEegXo +ep+5sIDKuoxY50DlWUMS2MgKUwoG8PjgHaTeBKmd87o +-> x+-grease 1 Wd/1m/ +Fmb8Vc497/c5m3sWBtcg11fdQsK/YTDXBEg+DToWFvA8C8GMYGk2VIaCcC4IHH3y +6onJXg9p9e6P825Tavxbdgu74ZAcsIZtvkt7 +--- +spumB58VEThrLeLalw56bfovG0jxH+AZhRwyM7O8lQ +HdJDhLx1HDx귟#y!uA'[CxS7]"<\]{2IHew ;67!tUlb)rԁ`eƍ{7az \ No newline at end of file diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 64d3428..25a4be8 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -49,4 +49,10 @@ in # Then pipe the resulting files to agenix -e "gitlab/key.age".publicKeys = everyone; "gitlab/cert.age".publicKeys = everyone; + "gitlab/myself-qemu-runner-reg-1.age".publicKeys = everyone; + "gitlab/myself-qemu-runner-reg-2.age".publicKeys = everyone; + "gitlab/myself-qemu-runner-reg-3.age".publicKeys = everyone; + "gitlab/myself-qemu-runner-reg-4.age".publicKeys = everyone; + "gitlab/myself-qemu-runner-reg-5.age".publicKeys = everyone; + "gitlab/myself-vbox-runner-reg.age".publicKeys = everyone; }