diff --git a/configuration.nix b/configuration.nix index 622e0db..1944e5c 100644 --- a/configuration.nix +++ b/configuration.nix @@ -8,8 +8,7 @@ imports = [ # Include the results of the hardware scan. ./hardware-configuration.nix - ./modules-all/ - ./modules-linux/ + ./modules/ ]; # Bootloader. diff --git a/darwin/default.nix b/darwin/default.nix index 8ff0ba7..f693ae1 100644 --- a/darwin/default.nix +++ b/darwin/default.nix @@ -31,8 +31,7 @@ let }; users.users."gregory.hellings".home = "/Users/gregory.hellings"; } - ../modules-all - ../modules-darwin + ../modules ./${name} ] ++ extraMods; }; diff --git a/flake.nix b/flake.nix index 15533ae..59bff99 100644 --- a/flake.nix +++ b/flake.nix @@ -85,9 +85,6 @@ })); overlays = { default = local_overlay; }; - modules = (import ./modules-all {}) // - (import ./modules-linux {}) // - (import ./modules-darwin {}); packages = (import ./overlays/packages.nix { inherit nixunstable flake-utils; }); }; } diff --git a/hosts/default.nix b/hosts/default.nix index ee0e65a..0954582 100644 --- a/hosts/default.nix +++ b/hosts/default.nix @@ -35,8 +35,7 @@ let } inputs.agenix.nixosModules.default hm.nixosModules.home-manager - ../modules-all - ../modules-linux + ../modules ./${name} ] ++ extraMods; }; diff --git a/hosts/genesis/home-assistant.nix b/hosts/genesis/home-assistant.nix index e58acb2..2ba4f4e 100755 --- a/hosts/genesis/home-assistant.nix +++ b/hosts/genesis/home-assistant.nix @@ -76,6 +76,7 @@ in greg.proxies = { "smart.home".target = "http://127.0.0.1:8123/"; + "smart.thehellings.lan".target = "http://127.0.0.1:8123/"; "zwave.home".target = "http://127.0.0.1:8091/"; }; diff --git a/hosts/genesis/networking.nix b/hosts/genesis/networking.nix index bfe416a..2a4c621 100644 --- a/hosts/genesis/networking.nix +++ b/hosts/genesis/networking.nix @@ -26,6 +26,7 @@ let "100.88.91.27 genesis.home jellyfin.home smart.home zwave.home" "100.78.16.88 mm.home" "100.84.183.79 myself.home myself.shire-zebra.ts.net git.thehellings.lan" + "100.78.226.76 gitlab.home gitlab.shire-zebra.ts.net gitlab.thehellings.lan registry.thehellings.lan" # Dev hosts "10.42.101.1 icdm.lan wiki.icdm.lan *.icdm.lan" diff --git a/hosts/myself/container-git.nix b/hosts/myself/container-git.nix index bd46e0e..364ab5c 100644 --- a/hosts/myself/container-git.nix +++ b/hosts/myself/container-git.nix @@ -1,8 +1,13 @@ -{ inputs, registryPort, ...}: -{ config, pkgs, lib, ... }: { +{ inputs, ...}: +{ config, pkgs, lib, ... }: let + registryPort = 5000; + vpnIp = "100.78.226.76"; + containerIp = "192.168.200.2"; +in { imports = [ inputs.agenix.nixosModules.default - ../../modules-linux/proxy.nix + ../../modules/linux/proxy.nix + ../../modules/linux/tailscale.nix ]; age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; @@ -26,17 +31,18 @@ useHostResolvConf = lib.mkForce false; }; - greg.proxies."192.168.200.2" = { + greg.proxies."${containerIp}" = { target = "http://unix:/run/gitlab/gitlab-workhorse.socket"; extraConfig = '' proxy_set_header X-Forwarded-Proto https; proxy_set_header X-Forwarded-Ssl on; ''; }; + greg.tailscale.enable = true; + + virtualisation.docker.enable = true; services = { - resolved.enable = true; - openssh.enable = true; gitlab = { enable = true; backup = { @@ -67,7 +73,8 @@ enable = true; certFile = config.age.secrets.gitlab-cert.path; keyFile = config.age.secrets.gitlab-key.path; - externalPort = registryPort; + externalAddress = "registry.thehellings.com"; + externalPort = 443; }; secrets = { secretFile = config.age.secrets.gitlab-secret.path; @@ -77,6 +84,29 @@ }; }; + nginx.virtualHosts."gitlab.shire-zebra.ts.net" = { + listen = [ { + addr = vpnIp; + port = registryPort; + ssl = true; + } ]; + locations."/" = { + proxyPass = "http://127.0.0.1:5000/"; + recommendedProxySettings = true; + }; + extraConfig = builtins.concatStringsSep "\n" [ + "ssl_certificate /etc/certs/gitlab.shire-zebra.ts.net.crt ;" + "ssl_certificate_key /etc/certs/gitlab.shire-zebra.ts.net.key ;" + "client_max_body_size 250m;" + ]; + }; + + # Fetch the SSL certificates for nginx to use + cron = { + enable = true; + systemCronJobs = [ "0 0 1 */2 * cd /etc/certs && tailscale cert gitlab.shire-zebra.ts.net && chown nginx * && systemctl reload nginx" ]; + }; + postgresql = { enable = true; checkConfig = true; @@ -96,6 +126,23 @@ redis.servers.gitlab = { enable = true; }; + resolved.enable = true; + openssh.enable = true; + }; + + # Do not start nginx until we have tailscaled up and running, so it can bind + # to the 100.* addresses + systemd.services.nginx = { + after = [ + "tailscaled.service" + "network.target" + "network-online.target" + ]; + wants = [ + "tailscaled.service" + "network.target" + "network-online.target" + ]; }; system.stateVersion = "24.05"; } diff --git a/hosts/myself/container-runner-qemu.nix b/hosts/myself/container-runner-qemu.nix deleted file mode 100644 index 7ef7574..0000000 --- a/hosts/myself/container-runner-qemu.nix +++ /dev/null @@ -1,47 +0,0 @@ -inputs: -{ config, pkgs, ... }: -let - extraPackages = with pkgs; [ - curl - gawk - git - packer - pup - (python3.withPackages (p: with p; [ pip pyyaml virtualenv ])) - qemu_full - qemu_kvm - shellcheck - xonsh - xorriso - ]; -in { - imports = [ - inputs.agenix.nixosModules.default - ]; - age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; - age.secrets.qemu-runner-reg-1 = { - file = ../../secrets/gitlab/myself-qemu-runner-reg-1.age; - owner = "gitlab-runner"; - }; - - networking.useHostResolvConf = pkgs.lib.mkForce false; - networking.nameservers = [ "100.100.100.100" ]; - services.resolved.enable = true; - - environment.systemPackages = extraPackages; - - services.gitlab-runner = { - enable = true; - settings.concurrent = 5; - services.shell = { - executor = "shell"; - registrationConfigFile = config.age.secrets.qemu-runner-reg-1.path; - tagList = [ "shell" "qemu" ]; - }; - }; - - systemd.services.gitlab-runner.wants = [ "network-online.target" "systemd-resolved.service" ]; - systemd.services.gitlab-runner.after = [ "network.target" "network-online.target" "systemd-resolved.service" ]; - - system.stateVersion = "24.05"; -} diff --git a/hosts/myself/container-runner-vbox.nix b/hosts/myself/container-runner.nix similarity index 81% rename from hosts/myself/container-runner-vbox.nix rename to hosts/myself/container-runner.nix index 0bc60b3..7b5ce8f 100644 --- a/hosts/myself/container-runner-vbox.nix +++ b/hosts/myself/container-runner.nix @@ -1,4 +1,4 @@ -{ inputs, name, extra ? {} }: +{ inputs, name, extra ? {}, packages ? [] }: ({ config, pkgs, lib, ... }: let @@ -32,9 +32,11 @@ lib.attrsets.recursiveUpdate { py shellcheck unzip + xonsh xorriso + vagrant wget - ]; + ] ++ packages; networking = { useHostResolvConf = pkgs.lib.mkForce false; @@ -60,8 +62,15 @@ lib.attrsets.recursiveUpdate { }; systemd.services.gitlab-runner = { - wants = [ "network-online.target" "systemd-resolved.service" ]; - after = [ "network.target" "network-online.target" "systemd-resolved.service" ]; + wants = [ + "network-online.target" + "systemd-resolved.service" + ]; + after = [ + "network.target" + "network-online.target" + "systemd-resolved.service" + ]; }; system.stateVersion = "24.05"; diff --git a/hosts/myself/git.nix b/hosts/myself/git.nix index 8a588b9..32d1bdd 100644 --- a/hosts/myself/git.nix +++ b/hosts/myself/git.nix @@ -4,8 +4,6 @@ let gitlabStateDir = "/var/lib/gitlab"; - registryPort = 8001; - container = input: (lib.attrsets.recursiveUpdate { bindMounts."/etc/ssh".hostPath = "/etc/ssh"; # For agenix secrets privateNetwork = true; @@ -14,7 +12,7 @@ in { networking = { firewall = { enable = true; - allowedTCPPorts = [ 80 registryPort ]; + allowedTCPPorts = [ 80 ]; }; nat = { enable = true; @@ -40,6 +38,10 @@ in { hostPath = gitlabStateDir; isReadOnly = false; }; + "/dev/net/tun" = { + hostPath = "/dev/net/tun"; + isReadOnly = false; + }; }; forwardPorts = [{ hostPort = 2222; @@ -47,7 +49,7 @@ in { }]; hostAddress = "192.168.200.1"; localAddress = "192.168.200.2"; - config = ((import ./container-git.nix) { inherit inputs registryPort; }); + config = ((import ./container-git.nix) { inherit inputs; }); }; systemd.services = { @@ -57,8 +59,11 @@ in { ]; serviceConfig = { DevicePolicy = lib.mkForce "auto"; - ExecPostStop = [ "rmmod kvm_amd kvm" ]; - ExecPreStart = [ "modprobe kvm" ]; + ExecStopPost = [ "${pkgs.kmod}/bin/rmmod kvm_amd kvm" ]; + ExecStartPre = [ + "${pkgs.kmod}/bin/modprobe kvm" + "${pkgs.kmod}/bin/modprobe kvm_amd" + ]; }; }; "container@gitlab-runner-vbox" = { @@ -67,10 +72,20 @@ in { ]; serviceConfig = { DevicePolicy = lib.mkForce "auto"; - ExecPostStop = [ "rmmod vboxnetadp vboxnetflt vboxdrv" ]; - ExecPreStart = [ "modprobe vboxdrv vboxnetadp vboxnetflt" ]; + ExecStopPost = [ "${pkgs.kmod}/bin/rmmod vboxnetadp vboxnetflt vboxdrv" ]; + ExecStartPre = [ + "${pkgs.kmod}/bin/modprobe vboxdrv" + "${pkgs.kmod}/bin/modprobe vboxnetadp" + "${pkgs.kmod}/bin/modprobe vboxnetflt" + ]; }; }; + "container@gitlab".serviceConfig = { + DeviceAllow = [ "/dev/net/tun" ]; + ProtectKernelModules = false; + PrivateDevices = false; + }; + gitlab-runner.serviceConfig.EnvironmentFile = config.age.secrets.docker-auth.path; }; ##################################################################################### @@ -82,13 +97,28 @@ in { hostPath = "/dev/kvm"; isReadOnly = false; }; + "/dev/mem" = { + hostPath = "/dev/mem"; + isReadOnly = false; + }; }; extraFlags = [ "--property=DeviceAllow=/dev/kvm" ]; hostAddress = "192.168.201.1"; localAddress = "192.168.201.2"; - config = ((import ./container-runner-qemu.nix) inputs); + config = ((import ./container-runner.nix) { + inherit inputs; + name = "qemu"; + packages = with pkgs; [ qemu_full qemu_kvm ]; + extra = { + virtualisation.libvirtd = { + enable = true; + onBoot = "ignore"; + package = pkgs.libvirt-greg; + }; + }; + }); }; ##################################################################################### @@ -111,7 +141,7 @@ in { }; hostAddress = "192.168.202.1"; localAddress = "192.168.202.2"; - config = ((import ./container-runner-vbox.nix) { + config = ((import ./container-runner.nix) { inherit inputs; name = "vbox"; extra = { @@ -125,6 +155,7 @@ in { enableHardening = false; headless = true; }; + networking.firewall.allowedTCPPorts = [ 18083 ]; # Should be interface for vboxweb }; }); }; @@ -136,7 +167,7 @@ in { autoStart = true; hostAddress = "192.168.203.1"; localAddress = "192.168.203.2"; - config = ((import ./container-runner-vbox.nix) { + config = ((import ./container-runner.nix) { inherit inputs; name = "shell"; }); @@ -146,20 +177,48 @@ in { #################### Local Podman/Docker Runner ##################################### ##################################################################################### age.secrets.runner-reg.file = ../../secrets/gitlab/myself-podman-runner-reg.age; + age.secrets.docker-auth.file = ../../secrets/gitlab/docker-auth.age; services.gitlab-runner = { - enable = false; - settings.concurrent = 5; + enable = true; + settings = { + concurrent = 5; + }; services = { default = { executor = "docker"; registrationConfigFile = config.age.secrets.runner-reg.path; - dockerImage = "debian:stable"; + dockerImage = "gitlab.shire-zebra.ts.net:5000/greg/ci-images/fedora:latest"; + dockerAllowedImages = [ + "alpine:*" + "debian:*" + "docker:*" + "fedora:*" + "python:*" + "ubuntu:*" + + "hashicorp/*:*" + "koalaman/shellcheck:*" + + "registry.gitlab.com/gitlab-org/*" + "registry.thehellings.com/*" + "gitlab.shire-zebra.ts.net:5000/*:*" + ]; + dockerAllowedServices = [ + "docker:*" + "registry.thehellings.com/*" + "gitlab.shire-zebra.ts.net:5000/*:*" + ]; + dockerPrivileged = true; + dockerVolumes = [ + "/certs/client" + "/cache" + ]; }; }; }; virtualisation = { docker.enable = true; oci-containers.backend = "docker"; + virtualbox.host.enable = true; }; - #users.users.gitlab-runner.extraGroups = [ "docker" ]; } diff --git a/modules-all/ci-runner.nix b/modules/ci-runner.nix similarity index 100% rename from modules-all/ci-runner.nix rename to modules/ci-runner.nix diff --git a/modules-darwin/default.nix b/modules/darwin/default.nix similarity index 100% rename from modules-darwin/default.nix rename to modules/darwin/default.nix diff --git a/modules-all/default.nix b/modules/default.nix similarity index 85% rename from modules-all/default.nix rename to modules/default.nix index 68a1f9b..70fac9a 100644 --- a/modules-all/default.nix +++ b/modules/default.nix @@ -1,9 +1,14 @@ { pkgs, lib, ... }: +let + inherit (lib.strings) hasSuffix; + system = pkgs.system; in { imports = [ ./ci-runner.nix - ]; + ] + ++ (if (lib.strings.hasSuffix "darwin" "nope") then [./darwin] else []) + ++ (if (lib.strings.hasSuffix "linux" "linux") then [./linux] else []); # Enable flakes nix = { diff --git a/modules-linux/backup.nix b/modules/linux/backup.nix similarity index 100% rename from modules-linux/backup.nix rename to modules/linux/backup.nix diff --git a/modules-linux/default.nix b/modules/linux/default.nix similarity index 100% rename from modules-linux/default.nix rename to modules/linux/default.nix diff --git a/modules-linux/gnome.nix b/modules/linux/gnome.nix similarity index 100% rename from modules-linux/gnome.nix rename to modules/linux/gnome.nix diff --git a/modules-linux/home.nix b/modules/linux/home.nix similarity index 100% rename from modules-linux/home.nix rename to modules/linux/home.nix diff --git a/modules-linux/kde.nix b/modules/linux/kde.nix similarity index 100% rename from modules-linux/kde.nix rename to modules/linux/kde.nix diff --git a/modules-linux/kiwix-serve.nix b/modules/linux/kiwix-serve.nix similarity index 100% rename from modules-linux/kiwix-serve.nix rename to modules/linux/kiwix-serve.nix diff --git a/modules-linux/linode.nix b/modules/linux/linode.nix similarity index 100% rename from modules-linux/linode.nix rename to modules/linux/linode.nix diff --git a/modules-linux/linux.nix b/modules/linux/linux.nix similarity index 100% rename from modules-linux/linux.nix rename to modules/linux/linux.nix diff --git a/modules-linux/proxy.nix b/modules/linux/proxy.nix similarity index 100% rename from modules-linux/proxy.nix rename to modules/linux/proxy.nix diff --git a/modules-linux/router.nix b/modules/linux/router.nix similarity index 100% rename from modules-linux/router.nix rename to modules/linux/router.nix diff --git a/modules-linux/rpi4.nix b/modules/linux/rpi4.nix similarity index 100% rename from modules-linux/rpi4.nix rename to modules/linux/rpi4.nix diff --git a/modules-linux/tailscale.nix b/modules/linux/tailscale.nix similarity index 100% rename from modules-linux/tailscale.nix rename to modules/linux/tailscale.nix diff --git a/overlays/default.nix b/overlays/default.nix index 7f58711..7c354bc 100644 --- a/overlays/default.nix +++ b/overlays/default.nix @@ -65,6 +65,9 @@ in rec { handbrake = prev.handbrake.override { libbluray = libbluray-custom; }; + libvirt-greg = prev.libvirt.overrideAttrs { + postInstall = prev.libvirt.postInstall + "rm -r $out/lib/systemd/system/libvirtd.service"; + }; pipenv-ivr = prev.callPackage ./pipenv.nix { }; xonsh = prev.xonsh.overridePythonAttrs (old: rec{ diff --git a/secrets/gitlab/docker-auth.age b/secrets/gitlab/docker-auth.age new file mode 100644 index 0000000..38c1637 --- /dev/null +++ b/secrets/gitlab/docker-auth.age @@ -0,0 +1,22 @@ +age-encryption.org/v1 +-> ssh-ed25519 mOmPfg QXPxLsHDv2J5RH8+UjtFMQo4yFdaNfuV6yD1KAz1Rxc +2ll7H/WKCI47w4oPL+9nOaWguHfDEc5Q6AmBHduGurE +-> ssh-ed25519 YJiRbw 8Ai1osukJoUNvAJ4zHGudZUxU/w9uiNdkSSjp8GTIGI +iHhF6rrDbB+PujlvHP2N5K4Zzc3R0jJ2851DJO/xx1g +-> ssh-ed25519 aY2AXA oiNt/hR1iC8sgXvB712J+fWNbFux7+uMEA4BNbobsik +Al83/ckzsB+YS9s7PkrsQy171fzQTJdhdlR7TTIfnCU +-> ssh-ed25519 Nl/5yA /LzefcwM2rezBx4wQmRXdKOkQpV1v0qcSonwY4C8FRI +w1irgyi4qfnumSE9bpaliYK0qjPh6gbufjJRVejjYwk +-> ssh-ed25519 GdLgCQ FX20+pHJNuGQcVXjA87j440vhLi7qfcuvNPHg/pT2hA +G/yNOLdwZ7+4xf60kC75gQuxW0Y603D3DodXGlrRfY8 +-> ssh-ed25519 tOH/HQ E9GVFDmP0GVJf78RkYae7TOl/An2V0kqvaC37yAz8mM +GI18IUsUWNk4dHqnrHAwpZSb5Kcz3Fp78y8lgO/29c4 +-> ssh-ed25519 FpzvfQ Xzp8i9u4O8hmutU397Fe0n1pxlB17Glyaii9p3H0gRU +/ppiXFk8ulxHdT1GGak5gSAPa7hm1tZfsOAiZVLRCwg +-> ssh-ed25519 kdPvzQ RolZ/ogYFdcY2beH/0N8pIr89JeKJpbplpULm8cDnGc +seuEqk/aubrxZ/+vFmW4VjtG7Mlbk6zbB9EWSyB6WZU +-> !5/_-grease +aIxpVrzd/gX7Zj8bDUCFAQAcaK4Xhoc2+27wt6bpexkuRacFCd1gjvXJG2LfLaGA +FkpsQoAktFhm6AzHLPXDPOPAw2e5aHNEqQ +--- xlcSP0mtqnMV4OL8J1CK/Rq/OKDxZDphNXbNx/nuwbQ +rEg*ȂnS5:'n/[TNyHU8[ajֆTncIR9ڰ8COBʅ*BHTpE ֤Ep<2ͥ&vہ.q z<66p2N:_(% '9@C \ No newline at end of file diff --git a/secrets/gitlab/myself-podman-runner-reg.age b/secrets/gitlab/myself-podman-runner-reg.age index 4037117..5b33569 100644 --- a/secrets/gitlab/myself-podman-runner-reg.age +++ b/secrets/gitlab/myself-podman-runner-reg.age @@ -1,22 +1,24 @@ age-encryption.org/v1 --> ssh-ed25519 mOmPfg dG6XENtNMwX6XDSuTypMCv/AftVImzUlmLh+2HbcPBI -zcjDFtOIwSw7zPPCtSNt4vKWi3WescwLKuOC4N4RwO4 --> ssh-ed25519 YJiRbw jX25yf2I0BuHCMw3KGYlaHqh9DMS9H6LJx6xQtoC9zo -dyQchQSxj/jaj4S9+nll8tOZeU3RpPi5944GqvKsAO4 --> ssh-ed25519 aY2AXA T8vp7157DWRCsGwl50UGTXq5eDSuJO9FIxo6XRI95AM -wsP4EbCv21MO8jStyL4QkH/RkYfO0MpfMVT6sOkcSR0 --> ssh-ed25519 Nl/5yA 7kpEkZd35q/QVYTAmsWosqpsDvTDpEC3ZlNj9GCzGjE -0gThG5z1R4XGOkgCQo5K6Tm/VvCHLDyQq1rmkbmtEDw --> ssh-ed25519 GdLgCQ kGpyMmS0Peo5FbuBW/sdVQ0coVK4j5eITvsNk7a5BxM -mc/ru6Fou04KhJWzROUE9DqIoIv/ahGzPFUsMzSAj00 --> ssh-ed25519 tOH/HQ x/UDLE6oFhheZr3e3saRYmecBqug0OND0Vc0K86S9Wc -Y22lNbDf/0A0TFavfmXAl6Y2svGIZVpg3lEbtAXf6Wo --> ssh-ed25519 FpzvfQ IYV/AfZAUBgNSz87UuqumYm5ItTMpb7K8b3UGha/FRk -Bnsvhqjk7sTt6jXL5dP92onYhyoeTumdoSf8ajwdbq4 --> ssh-ed25519 kdPvzQ 2AublM+DYm8oYM6QgFUOSyhw3vOqEMKp04YPFNrHdRI -0z3pWAKZxDzZ7YwuDkD3XK04/20gTr42wlYfdjj/aFc --> =E!-grease uD%0 \!WY E@ )8GeC -jwdHZOwP5/8rOOTlboiuTlVXp1uJf22RYG1aunA1FKb8JtTIaI3dEeW7r2UnPmtM -q6DWdgbUcmUrM1M6p/x3qBLLrlIzHpIWm6Q9mw ---- bOKSHwBeikGFD/BDdRPyM3NBTUS+mW93aGimgTy5ESQ -InT zG\TC3*Ț%clAɻn9T,v1UOl ౕ`pLW YRyZ8Zې,K"J3*" UM_=4kCuy \ No newline at end of file +-> ssh-ed25519 mOmPfg v6H/iYsxSharpYdE3zaQWwe4upObwg6SoqS2DHccEmQ +q89KCC+dsrPhz8k55s4tnLRddFpGEmKi6X8bixSzADI +-> ssh-ed25519 YJiRbw qqyTMJde1bZ1SueoOGOcFzyJT0HCk9vFVKDf2yyzjwI +g3bFCSRPWXiArnt2AIg0cEGyFueqKHEUtwo0GhZ8+Qs +-> ssh-ed25519 aY2AXA ulJXsgoZzBk4aMdJY5J5Z2+IvH+q4DFV9WSSsMmGP0U +g6oT0hwN7H0Ns0ZYIkHpo2xMjp6DCHgiAGj766TOA8w +-> ssh-ed25519 Nl/5yA SqmK8QCxKqu0w8ZpRsM7T+Osl22qMHAE17avW1CgWjU +IPFrLZk1/e4+h5DgiEjBHZis/Goftk8NL3JGBikfT3I +-> ssh-ed25519 GdLgCQ Hksz6e56bab8WaH7YcPu0P50UVbkPriAbB7k4OsY0xc +qHKzIoDAvAkwFtBU9jSVoYMrLeei+2XkmW2w0q6giZo +-> ssh-ed25519 tOH/HQ bQrB5zxKxlIt2SjIzq7aELT59XpAVZanmZakOimgVE0 +gtDbQGFWgs7eA1eYwSE7mWnKePDfD0tzcBTq5RwhjhM +-> ssh-ed25519 FpzvfQ 1u5GDj3/GLbCuYXYPdbCoS+gdEf2H5fB4IHs76r3U1I +gjM3BYBcX6Dzk82KikQWF47fvp9hkFpCQ3BvQcFSfnA +-> ssh-ed25519 kdPvzQ 8o47gHxb83pPErakkstW04h1MycsK/bAqBNfQnpolzU +ikG06kyazNW7GeEQmXBCNTnLs3zDg0o9/2eQ3FWh+fE +-> GwrHkr"-grease 5DqzJj W_O4EW +tVyYwwIGgkcsdyYLoHigZ2vfz4wAwNTk+kAVA9evxoN0q/DPq9OOoPqPvzEhcWc/ +IGl7UyexYDprXqAn1ph2VLkaHQ7oX4QXN0dvnC7lDo/vDFElRPDnW3ML+XzELIM +--- YUiM/kVJaOCRy/mu1VvlqiRTFn8WMgD9NAAGXwsqbWs +2x*5HAuߚU'%{N7ӯfE +LKQ;f5*N Fn'k(ý[]OޗIͽ]ٖ +dtXQ'/p"!.w43F|8mf$>  90x ҒLͨNd1f[d᜞9A?󬥊l\MHIنH4TuN|"ZѬ8[ 3 :YBpUK_%TQP[E%vgIE׺pi \ No newline at end of file diff --git a/secrets/gitlab/myself-qemu-runner-reg-1.age b/secrets/gitlab/myself-qemu-runner-reg.age similarity index 100% rename from secrets/gitlab/myself-qemu-runner-reg-1.age rename to secrets/gitlab/myself-qemu-runner-reg.age diff --git a/secrets/secrets.nix b/secrets/secrets.nix index d71e864..ee8c668 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -49,9 +49,10 @@ in # Then pipe the resulting files to agenix -e "gitlab/key.age".publicKeys = everyone; "gitlab/cert.age".publicKeys = everyone; - "gitlab/myself-qemu-runner-reg-1.age".publicKeys = everyone; + "gitlab/myself-qemu-runner-reg.age".publicKeys = everyone; "gitlab/myself-vbox-runner-reg.age".publicKeys = everyone; "gitlab/myself-podman-runner-reg.age".publicKeys = everyone; "gitlab/myself-shell-runner-reg.age".publicKeys = everyone; "gitlab/myself-vmware-runner-reg.age".publicKeys = everyone; + "gitlab/docker-auth.age".publicKeys = everyone; }