From d7f53e53a34204aff113881b3bc27aa9d0afd610 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Wed, 28 May 2025 00:10:50 -0500 Subject: [PATCH] Expost postgres cluster Expose the postgres cluster outside of the Kubernetes cluster Give myself the option of connecting to postgres from my own machines, so that I can hopefully leverage the improved performance Update some file linting issues in Nix Add necessary gitlab keys so it can be updated properly the next time I deploy to it Add DNS entries for postgres Update the configuraiton of Traefik to expose the appropriate ports --- hosts/genesis/net/hosts | 2 +- hosts/proxmoxtemplate/default.nix | 20 +++++---- .../hardware-configuration.nix | 43 +++++++++++++------ hosts/vm-gitlab/default.nix | 19 +++++--- hosts/vm-gitlab/hardware-configuration.nix | 43 +++++++++++++------ hosts/vm-jellyfin/hardware-configuration.nix | 43 +++++++++++++------ manifests/databases/ingress.yaml | 39 +++++++++++++++++ manifests/databases/kustomization.yaml | 1 + manifests/helm/kustomization.yaml | 1 + manifests/helm/traefik.yaml | 22 ++++++++++ modules/nixos/kubernetes.nix | 3 ++ secrets/gitlab/deterministic-key.age | 39 +++++++++++++++++ secrets/gitlab/primary-key.age | 39 +++++++++++++++++ secrets/gitlab/salt.age | 39 +++++++++++++++++ secrets/secrets.nix | 3 ++ 15 files changed, 298 insertions(+), 58 deletions(-) create mode 100644 manifests/databases/ingress.yaml create mode 100644 manifests/helm/traefik.yaml create mode 100644 secrets/gitlab/deterministic-key.age create mode 100644 secrets/gitlab/primary-key.age create mode 100644 secrets/gitlab/salt.age diff --git a/hosts/genesis/net/hosts b/hosts/genesis/net/hosts index 9041681..cc877ec 100644 --- a/hosts/genesis/net/hosts +++ b/hosts/genesis/net/hosts @@ -32,7 +32,7 @@ 100.88.91.27 genesis.home smart.home zwave.home nixcache.home gitcache.home dashy.home uptime.home speed.home 100.91.131.66 gitlab.home gitlab.shire-zebra.ts.net gitlab.thehellings.lan registry.thehellings.lan git.thehellings.lan 100.68.203.1 hosea.home hosea.shire-zebra.ts.net -100.84.183.79 isaiah.home isaiah.shire-zebra.ts.net pgadmin.kubernetes +100.84.183.79 isaiah.home isaiah.shire-zebra.ts.net pgadmin.kubernetes postgres.kubernetes 100.102.186.39 jeremiah.home jeremiah.shire-zebra.ts.net matrix.kubernetes 100.90.74.19 jude.home 100.115.57.8 linode.home diff --git a/hosts/proxmoxtemplate/default.nix b/hosts/proxmoxtemplate/default.nix index 8a95924..58fd871 100644 --- a/hosts/proxmoxtemplate/default.nix +++ b/hosts/proxmoxtemplate/default.nix @@ -2,13 +2,13 @@ # your system. Help is available in the configuration.nix(5) man page # and in the NixOS manual (accessible by running ‘nixos-help’). -{ config, pkgs, ... }: +{ pkgs, ... }: { - imports = - [ # Include the results of the hardware scan. - ./hardware-configuration.nix - ]; + imports = [ + # Include the results of the hardware scan. + ./hardware-configuration.nix + ]; # Bootloader. boot.loader = { @@ -16,8 +16,10 @@ efi.canTouchEfiVariables = true; }; - environment.systemPackages = with pkgs; [ - ]; + environment.systemPackages = + with pkgs; + [ + ]; greg = { home = true; @@ -43,6 +45,8 @@ nameservers = [ "10.42.1.5" ]; }; + services.qemuGuest.enable = true; + system.stateVersion = "24.11"; # Did you read the comment? # Define a user account. Don't forget to set a password with ‘passwd’. @@ -50,6 +54,6 @@ isNormalUser = true; description = "Greg Hellings"; extraGroups = [ "wheel" ]; - packages = with pkgs; []; + packages = with pkgs; [ ]; }; } diff --git a/hosts/proxmoxtemplate/hardware-configuration.nix b/hosts/proxmoxtemplate/hardware-configuration.nix index 95d03e8..1ef3394 100644 --- a/hosts/proxmoxtemplate/hardware-configuration.nix +++ b/hosts/proxmoxtemplate/hardware-configuration.nix @@ -1,28 +1,43 @@ # Do not modify this file! It was generated by ‘nixos-generate-config’ # and may be overwritten by future invocations. Please make changes # to /etc/nixos/configuration.nix instead. -{ config, lib, pkgs, modulesPath, ... }: +{ + lib, + modulesPath, + ... +}: { - imports = - [ (modulesPath + "/profiles/qemu-guest.nix") - ]; + imports = [ + (modulesPath + "/profiles/qemu-guest.nix") + ]; - boot.initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "ahci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ]; + boot.initrd.availableKernelModules = [ + "uhci_hcd" + "ehci_pci" + "ahci" + "virtio_pci" + "virtio_scsi" + "sd_mod" + "sr_mod" + ]; boot.initrd.kernelModules = [ ]; boot.kernelModules = [ ]; boot.extraModulePackages = [ ]; - fileSystems."/" = - { device = "/dev/disk/by-uuid/507251f1-efe7-448d-8de8-91ee582a9afb"; - fsType = "ext4"; - }; + fileSystems."/" = { + device = "/dev/disk/by-uuid/507251f1-efe7-448d-8de8-91ee582a9afb"; + fsType = "ext4"; + }; - fileSystems."/boot" = - { device = "/dev/disk/by-uuid/7115-EFA6"; - fsType = "vfat"; - options = [ "fmask=0077" "dmask=0077" ]; - }; + fileSystems."/boot" = { + device = "/dev/disk/by-uuid/7115-EFA6"; + fsType = "vfat"; + options = [ + "fmask=0077" + "dmask=0077" + ]; + }; swapDevices = [ ]; diff --git a/hosts/vm-gitlab/default.nix b/hosts/vm-gitlab/default.nix index a52d043..0c4a31d 100644 --- a/hosts/vm-gitlab/default.nix +++ b/hosts/vm-gitlab/default.nix @@ -15,10 +15,10 @@ let containerIp = "192.168.200.2"; in { - imports = - [ # Include the results of the hardware scan. - ./hardware-configuration.nix - ]; + imports = [ + # Include the results of the hardware scan. + ./hardware-configuration.nix + ]; age.secrets = let @@ -36,6 +36,9 @@ in gitlab-jws = cfg "jws"; gitlab-key = cfg "key"; gitlab-cert = cfg "cert"; + gitlab-salt = cfg "salt"; + gitlab-primary-key = cfg "primary-key"; + gitlab-deterministic-key = cfg "deterministic-key"; minio_access_key_id = { file = ../../secrets/minio_access_key_id.age; @@ -79,7 +82,6 @@ in tailscale.enable = true; }; - networking = { hostName = "vm-gitlab"; # Define your hostname. firewall.allowedTCPPorts = [ @@ -134,10 +136,13 @@ in externalPort = 443; }; secrets = { - secretFile = config.age.secrets.gitlab-secret.path; - otpFile = config.age.secrets.gitlab-otp.path; + activeRecordDeterministicKeyFile = config.age.secrets.gitlab-deterministic-key.path; + activeRecordPrimaryKeyFile = config.age.secrets.gitlab-primary-key.path; + activeRecordSaltFile = config.age.secrets.gitlab-salt.path; dbFile = config.age.secrets.gitlab-db.path; jwsFile = config.age.secrets.gitlab-jws.path; + otpFile = config.age.secrets.gitlab-otp.path; + secretFile = config.age.secrets.gitlab-secret.path; }; extraConfig = { diff --git a/hosts/vm-gitlab/hardware-configuration.nix b/hosts/vm-gitlab/hardware-configuration.nix index dd7e4cf..a945d9f 100644 --- a/hosts/vm-gitlab/hardware-configuration.nix +++ b/hosts/vm-gitlab/hardware-configuration.nix @@ -1,18 +1,30 @@ # Do not modify this file! It was generated by ‘nixos-generate-config’ # and may be overwritten by future invocations. Please make changes # to /etc/nixos/configuration.nix instead. -{ config, lib, pkgs, modulesPath, ... }: +{ + lib, + modulesPath, + ... +}: { - imports = - [ (modulesPath + "/profiles/qemu-guest.nix") - ]; + imports = [ + (modulesPath + "/profiles/qemu-guest.nix") + ]; # Bootloader. boot = { extraModulePackages = [ ]; initrd = { - availableKernelModules = [ "uhci_hcd" "ehci_pci" "ahci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ]; + availableKernelModules = [ + "uhci_hcd" + "ehci_pci" + "ahci" + "virtio_pci" + "virtio_scsi" + "sd_mod" + "sr_mod" + ]; kernelModules = [ ]; }; loader = { @@ -21,16 +33,19 @@ }; }; - fileSystems."/" = - { device = "/dev/disk/by-uuid/507251f1-efe7-448d-8de8-91ee582a9afb"; - fsType = "ext4"; - }; + fileSystems."/" = { + device = "/dev/disk/by-uuid/507251f1-efe7-448d-8de8-91ee582a9afb"; + fsType = "ext4"; + }; - fileSystems."/boot" = - { device = "/dev/disk/by-uuid/7115-EFA6"; - fsType = "vfat"; - options = [ "fmask=0077" "dmask=0077" ]; - }; + fileSystems."/boot" = { + device = "/dev/disk/by-uuid/7115-EFA6"; + fsType = "vfat"; + options = [ + "fmask=0077" + "dmask=0077" + ]; + }; swapDevices = [ ]; diff --git a/hosts/vm-jellyfin/hardware-configuration.nix b/hosts/vm-jellyfin/hardware-configuration.nix index 95d03e8..1ef3394 100644 --- a/hosts/vm-jellyfin/hardware-configuration.nix +++ b/hosts/vm-jellyfin/hardware-configuration.nix @@ -1,28 +1,43 @@ # Do not modify this file! It was generated by ‘nixos-generate-config’ # and may be overwritten by future invocations. Please make changes # to /etc/nixos/configuration.nix instead. -{ config, lib, pkgs, modulesPath, ... }: +{ + lib, + modulesPath, + ... +}: { - imports = - [ (modulesPath + "/profiles/qemu-guest.nix") - ]; + imports = [ + (modulesPath + "/profiles/qemu-guest.nix") + ]; - boot.initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "ahci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ]; + boot.initrd.availableKernelModules = [ + "uhci_hcd" + "ehci_pci" + "ahci" + "virtio_pci" + "virtio_scsi" + "sd_mod" + "sr_mod" + ]; boot.initrd.kernelModules = [ ]; boot.kernelModules = [ ]; boot.extraModulePackages = [ ]; - fileSystems."/" = - { device = "/dev/disk/by-uuid/507251f1-efe7-448d-8de8-91ee582a9afb"; - fsType = "ext4"; - }; + fileSystems."/" = { + device = "/dev/disk/by-uuid/507251f1-efe7-448d-8de8-91ee582a9afb"; + fsType = "ext4"; + }; - fileSystems."/boot" = - { device = "/dev/disk/by-uuid/7115-EFA6"; - fsType = "vfat"; - options = [ "fmask=0077" "dmask=0077" ]; - }; + fileSystems."/boot" = { + device = "/dev/disk/by-uuid/7115-EFA6"; + fsType = "vfat"; + options = [ + "fmask=0077" + "dmask=0077" + ]; + }; swapDevices = [ ]; diff --git a/manifests/databases/ingress.yaml b/manifests/databases/ingress.yaml new file mode 100644 index 0000000..f75c920 --- /dev/null +++ b/manifests/databases/ingress.yaml @@ -0,0 +1,39 @@ +apiVersion: traefik.io/v1alpha1 +kind: MiddlewareTCP +metadata: + name: local-hosts-only + namespace: db +spec: + ipAllowList: + sourceRange: + - 127.0.0.1/32 # Localhost, obviously + - 10.42.0.0/16 # My internal net + - 10.211.0.0/16 # Kubernetes IPs + # Tailscale hosts + - 100.119.228.115 # chronicles + - 100.88.91.27 # dns? + - 100.80.99.48 # exodus + - 100.88.91.27 # genesis + - 100.91.131.66 # gitlab + - 100.68.203.1 # hosea + - 100.84.183.79 # isaiah + - 100.102.186.39 # jeremiah + - 100.90.74.19 # jude + - 100.115.57.8 # linode + - 100.65.5.38 # matrix + - 100.127.55.22 # jellyfin +--- +apiVersion: traefik.io/v1alpha1 +kind: IngressRouteTCP +metadata: + name: ingress-route-postgres + namespace: db +spec: + entryPoints: + - postgres + routes: + - match: HostSNI(`*`) + priority: 10 + services: + - name: postgres-rw + port: 5432 diff --git a/manifests/databases/kustomization.yaml b/manifests/databases/kustomization.yaml index f6f06b6..d8e8a11 100644 --- a/manifests/databases/kustomization.yaml +++ b/manifests/databases/kustomization.yaml @@ -5,3 +5,4 @@ resources: - postgres-gitlab.yaml - postgres-pgadmin.yaml - postgres-matrix.yaml + - ingress.yaml diff --git a/manifests/helm/kustomization.yaml b/manifests/helm/kustomization.yaml index ed49217..c6ae679 100644 --- a/manifests/helm/kustomization.yaml +++ b/manifests/helm/kustomization.yaml @@ -1,4 +1,5 @@ resources: - flux.yaml + - traefik.yaml - external-secrets.yaml - cloudnative-pg.yaml diff --git a/manifests/helm/traefik.yaml b/manifests/helm/traefik.yaml new file mode 100644 index 0000000..ee24569 --- /dev/null +++ b/manifests/helm/traefik.yaml @@ -0,0 +1,22 @@ +apiVersion: "helm.cattle.io/v1" +kind: "HelmChartConfig" +metadata: + name: "traefik" + namespace: "kube-system" +spec: + valuesContent: |- + additionalArguments: + - "--entryPoints.postgres.address=:5432/tcp" + - "--api.dashboard=true" + - "--api.insecure=true" + - "--log.level=DEBUG" + ports: + postgres: + expose: + default: true + port: 5432 + exposedPort: 5432 + protocol: TCP + traefik: + expose: + default: true diff --git a/modules/nixos/kubernetes.nix b/modules/nixos/kubernetes.nix index b142bd7..a30cf49 100644 --- a/modules/nixos/kubernetes.nix +++ b/modules/nixos/kubernetes.nix @@ -37,6 +37,9 @@ in networking.firewall = { allowedTCPPorts = [ + 80 + 443 + 5432 6443 ] ++ ( diff --git a/secrets/gitlab/deterministic-key.age b/secrets/gitlab/deterministic-key.age new file mode 100644 index 0000000..443bda7 --- /dev/null +++ b/secrets/gitlab/deterministic-key.age @@ -0,0 +1,39 @@ +age-encryption.org/v1 +-> ssh-ed25519 64uajw pGArtr7GB1lyaooKK46PBygPCtdQmFfEpk1rA0molCA +8ssJyIFriGAp9BQCYMyTf+S2HmMeOC1UH2QXqbqBFLQ +-> ssh-ed25519 oyEmTw AZbFjT/AjhDQOVHQYiZAKwZyUZar5uMiM2r2B3IpN3A +FQ3cu6l6KZbHB6vSatiLWV/ntDoc1zVT4/QUinPVZCc +-> ssh-ed25519 mOmPfg Ru0AM8rjvVpn3PjWp7KPf/wtdBAphHfpNJ9bbZZVdmM +sphzkfNpy3GiLSXo5U9ct8t55tLGE+Lt2MVglsMCu/E +-> ssh-ed25519 YJiRbw UuAcR0LT/TWfWI1Ba8cm6iv/aYY+eADglTwPBAyjP1Q +NxxO5o0G+PQZBRTC1pdAFNr28+ijKUEXAZJDsbF2sLg +-> ssh-ed25519 aY2AXA 4Y8xviHTR9/fjycJHzcHLzN1txHl1+bGHG099CNnDm4 +Y9IQVYf5KQ1qDdFwPKpWxsCwdy46OYRlYCncvEMHXO0 +-> ssh-ed25519 xNtnoA CWVPYtuxcHQLtSd9cWLs7yuPgAuaY1hRGMesA+HhGCE +5LFGLF5uRxHkbSp0WenWH5pBpEDNr269GmTOrSA5F90 +-> ssh-ed25519 AQhf1g bjCjRVRxIWGPIbXg6QvNwXjiXajyuwMXbLu/3EDxp3Y +zHlX3WzfAccjVyksrzsdWfVsx2ia2oXBdTWLGroP1BA +-> ssh-ed25519 B8wa7Q zr+NOkU1OAJPvpN/MXECQAowUKWIbnNLJJsGeGUydww ++we1cguTwDROfIAJJYrExz9Towmr18JXVY3oRkpv14w +-> ssh-ed25519 8UnW5Q QjneH4f6Oly7tnAMLiLMwUIjAsaSi5ZFoC8TQG6GkmY +kspnipzqALYSiT1jJRhF1yZecxbkXv70vlBKMUxBPZw +-> ssh-ed25519 0/WsKg Ep9gDq0DtcGbdQh/PrYe+iBv6OSeLPWxICjXbKjFJnE +2g526leouu0mRQBJSebsQ2h/3UF2fqQe6P8PnSLEhWA +-> ssh-ed25519 Nl/5yA ki1Df4IbjbBJsBuu0i7mlCDkIcp/238uCzTq2xxo3SU +0KPSkglgV55rtv0cJ0ZHxXXrrd/kFWPieM1RSSz+KKU +-> ssh-ed25519 GdLgCQ L+YIJXArLcYoRNBOEgSrpM0fNQHWTZn3AKmuue9s1Hs +Y7dOqUW2+/6DTVHfitXWPRQTn8dAXFaO848XhiarYYI +-> ssh-ed25519 tOH/HQ rohrw+mCT7L76YNfHG2kZ//3+0BvLE5adIv4iDCYPXo +7VsJeUR655/7Rl5+aT3OUK1iUHL2xaz88VblWxyzDbk +-> ssh-ed25519 FpzvfQ v8DOcm6/7afe7hqJLs4yS9QsoaKrtmft1nUbVMIQbiY +zPtH/T7vUG0TYAImLK4a4i8ta/n4Iu5qUIHNzj4AExk +-> ssh-ed25519 kdPvzQ TVIyKHig7iMyCx25roaLgF+wbm8r/FdDmYzsn47mQFY +7FGAj3og7JONhSZFjywwoc41lGSaUvJb2BaFjc7Ymlw +-> ssh-ed25519 onmXpg yr5rUSP7BVin9iRa8dbhsqkhzMNBgk03kSj0ne+9cxw +5fYMGMVh4lxXuZzNIOUhXj9B43RIEzI2mCy9urSSEng +-> ssh-ed25519 CnhD0g 7hvSFju7gEZ3z/wh7vYErWG545rqx2Vw+uoOk/QplEs +UOPP23HMYyJ5w/3qbtEmHZU36F8kwiCVBsaZHTeOJgk +-> ssh-ed25519 4ep2UA SSi6Na4Zkz15jv9AIQV9UW0xr2YFmoT5s96Fz0X0nmk +BoSwO6G8pMUt/N8RRLdVxzmQsn6RK655j27shIV5xq8 +--- FsKrB9/IGIe8BxDxJDSnAnm84SoJAPZFawQjoAUTbUE +\86IrwN[]$`u8BބHփ.a#|biҮ*>Kpq \ No newline at end of file diff --git a/secrets/gitlab/primary-key.age b/secrets/gitlab/primary-key.age new file mode 100644 index 0000000..f05290b --- /dev/null +++ b/secrets/gitlab/primary-key.age @@ -0,0 +1,39 @@ +age-encryption.org/v1 +-> ssh-ed25519 64uajw 65up4NePHDRo97ryHxOcL/ZulVqH6bE8o0HRwKaS/zI +c4XtvR4EeZ8G4iT7sEj9prfvAoDDMnp8dUF2JSc/qPU +-> ssh-ed25519 oyEmTw QiQFAuLBYBQmiJ8TAGagLqfDFktf4mwsOhmJ7ZBIM0s +fdpvwfAKAWJUrFcGNA5NmH14Weixfp8NUqoPA/mw+4I +-> ssh-ed25519 mOmPfg dPYBhH6jodNFeTNTMwPuEq46i7DzKq67tMlYWkw3+T8 +Z4Uh0YhUL8KWqUCmr/AFILazC7v9L2poNC7IUbE6Uu8 +-> ssh-ed25519 YJiRbw RvWUVFSFOvz7q5mNBg1FoYLi1jbpMPvImUlJSy5zBTQ +nNuNQnN/RhtFUOsbezo8LP8ceY/yqFSYDCo7igujiqM +-> ssh-ed25519 aY2AXA LbCZXvEeHWVtlvecusaJVdRSUjsCONHhD2ADA73FGy8 +4zNv08Z7vvS1c2/BOdL0JxAX/Y+kU4q/WWlfxmA6fVk +-> ssh-ed25519 xNtnoA fZVGgBdLb47UmapPENDK6nxICXx+KeIEhBQ3UKIi7HM +dTJO+0qXtgpzjCe6K4+FQa0nynH5qEXebyERRQEBDzE +-> ssh-ed25519 AQhf1g 8Srs6GErqaEibInARo/dzXwXdNqNTFBk/kgPyXGlEAM +K0Ol9j/Uxw1up7xEapKwtoTAc2ZgoHuqKiHFcdrM4IY +-> ssh-ed25519 B8wa7Q PZekZdp5Dj84fnRopshQYTZu7ue8A92PMfMqGMyPIUk +Y6WvNhXo2nQI/nmI2gGdO9XCjjafpAai+fEGeYSGCHA +-> ssh-ed25519 8UnW5Q AsNtL1dQUNeKHaatp/85nVUe1jLL5WsviNpKXQEBqkY +z/9Q/DJQqVGNYHHJ3fU/EFPfTREZSJMxxlm6fhVGpME +-> ssh-ed25519 0/WsKg 4TV+ryC7wbPQGTnU7TzuwCJz+iZEluBFAlnk23deA0U +h9JoILNlSPX+dePFjSYM8vvetXINWAJ+DIXcStM+D6M +-> ssh-ed25519 Nl/5yA uw7SLz+XPRnHb5ux2mp1VEL/cwnMFMhc86UnglcwARI +k7lt+0yFMqAcepklurzW0MoB+yr3HL9DLTa+1+PPETg +-> ssh-ed25519 GdLgCQ t5aY2s4XfLnlmAjB5k8UpEy2iMm2K8NFeowDyP9nliY ++x0yKD0pDecGPnU/ijJ7WRUm/UNoQu4EX4/azB9Og6Y +-> ssh-ed25519 tOH/HQ Cc06HO0i/Yy65bNTREl2r0qd8sM+vhLyVxB7Pm8pemY +qy1juC+a7BjtMZ2XoFvfCkIEI8ihTCs9ThAkTSvEsVg +-> ssh-ed25519 FpzvfQ MdxHv8FxO4tRbiup4k6N4JUFtnofB6WJ8xn8KTUSjyM +Mx+0cPM5bq/qJxKXSmzneL/Pg5CBiO7bjHjyFT05exw +-> ssh-ed25519 kdPvzQ Tww+Oh8cQV9/qUw+2FWpRJTljjsbFB7T93xrRJcFGwo +lGyd6FuQ3Y68pVn/aZCCtxVEoc9gn5Nc42peuFy68dk +-> ssh-ed25519 onmXpg asPPNt+wiRFWgaBaie0voK4Yw5R8t8r5I3t6qujAsx0 +oa8Em8djkwbKYUQkPvZ3YMvvM2x9NEtm/f6Y7PoWmmo +-> ssh-ed25519 CnhD0g lfXt1ZIhVWv84cvAykGjO44OvVny+U1Rju+17gx6qR0 +7StUFJgr+8zVr9OAmtgQk+UoBaQ8LqIUmttqlXdpX+s +-> ssh-ed25519 4ep2UA ued9/iPni10UpRf/RM0wesnRfp+lpoO99831MoShxnk +k5t8fmGnoCkHskZdvw1fYyCdns7BZsPUaLlJ6WzQgHc +--- HaCc7eAoVLgJf982a8aRJPadwoZ9WAQ2jH1+j5Z2w8Y +W!MCuX?l=?˳[(MNqh^"`#A4&qhE \ No newline at end of file diff --git a/secrets/gitlab/salt.age b/secrets/gitlab/salt.age new file mode 100644 index 0000000..19af78c --- /dev/null +++ b/secrets/gitlab/salt.age @@ -0,0 +1,39 @@ +age-encryption.org/v1 +-> ssh-ed25519 64uajw RdFMAWftlhzUEqoxui6a0IBxI7KxrU6C5uQeJwhUAzg +UO611nUdfsLfG+LRhPVkX+BaVM2NoTB571nDdy7nn6E +-> ssh-ed25519 oyEmTw 3zfLtPD8rpTSaVSMQCOSp38S9fywd6e+V0e9v9JGgwU +qjaK+z7HDjmLdViDNjCj6rm3bNjc0xrrUVlwupkXd5w +-> ssh-ed25519 mOmPfg weCYfjyuqqPcEVNM7+rqE/x5ZL8Mifp+obzMULqZgWU +0HTPHd8Hq8qJOfVzP/kczVQYaXKJykT9KCK9Rn6r/nI +-> ssh-ed25519 YJiRbw 0ARXvdUzE670xRni7RRnyVhzFURTyoQ1GTNtfY+MWU8 +jlt7BMNJ/AwOOIkIDAyiFyy8FV5PYlcqwB6MOLSZce4 +-> ssh-ed25519 aY2AXA CyalC9EQJFdNCl+BNLKrt8KKZBPnaPzH3t25F9otkEM +m3mig+c7SvWuxUIorZcVfzIqualwTC+xJBDKvB+zCcU +-> ssh-ed25519 xNtnoA 3n7J6GMt64Z9+0M89QTmZaeJ2/A7JdMl7TfC2nUt+xQ +wk6G2SZL9VTzFlyIzc/EulzzG5P9EG9M1652aapvT+Q +-> ssh-ed25519 AQhf1g ksxGPi6mYEhc1X2waHMXkTFgnB6lpKWKUeyMxFOnMkM +Jj6fEbw52O3I9wUyk9of+NSJmNZC1U4+7UF98ChEbQI +-> ssh-ed25519 B8wa7Q yMYUdu6A9dEmiAgYveyxSKoUL5XkmMdnyOIwherXzyc +4n87yY0czhQib32cxQ8XH6tepRIzjmE7ewWCRaY0Dpg +-> ssh-ed25519 8UnW5Q PLN3cqCd4t1m4bNbRjFNAs5k2hwTUxRV02DPgpZ75Uk +tRwglJ5sPoJzp9Je5xEXlYM2kbUUd+xwawZIBYKZKZk +-> ssh-ed25519 0/WsKg V0GKvQ3KdATmhVHlXyL95Lb1bZ7uTBMHH+1DloQwaWA +UDb0UWGNzjY7K7qNqhU88+ViGoP7msG73sxmiTwaKgQ +-> ssh-ed25519 Nl/5yA eyZT6r909dv5ClBxUhCflv1676VV1uQALhsrHJycRQY +0AkXJLRwKURIXPhnM8VnUVkBl9Oq4LUHTs4n7Ai0X0w +-> ssh-ed25519 GdLgCQ bIMe/3XDR7HCZOzxG+n8ud5bzMMDrZSPCDoPnbX7clg +XGRkbM1xkZzhaCa2frDhWAZkJ0RAlbBx7IcJrCzhXWc +-> ssh-ed25519 tOH/HQ 42VvN/DyV1VjbK0sI3/AWGCByXw+W/atfLUjlEIkyCs +f2DijeqBQss3f44fFIDC5M3SXRRpm3Cl0iaLLOyAD68 +-> ssh-ed25519 FpzvfQ iRQ1JgNvo6mpRIn4HiF3dOul/ZhzQbjP8MCID8sFY2k +SL9kRpWY1SigL2MVhy99hB3ACCHIPTK/IMIH98epch0 +-> ssh-ed25519 kdPvzQ gleTd+wfxQgl4IcQDqw5SmdRQvOV5MRHtSh1XeXz3wY +5fGWJak3xivrRJS+dfiUWc15KaVTIXe8xlLhr+lgIR4 +-> ssh-ed25519 onmXpg SU/B3Y0ddUAUNDPwSeAqaG1ICihEQRglorF1143KC1s +Qm6GGzluTIvEVnXTbl3z0LcrzxXpdN5hOksc03giazY +-> ssh-ed25519 CnhD0g GVlnY0nuxGqWn3y7CPIk3p5P/bJ2ovt/DCpsemTwnRw +vleILr9u6erKyzgofdIZuVShrilviX0New95Xw3+0pM +-> ssh-ed25519 4ep2UA xSlFMYDkUBAzs+xaJJr29rbaC4L88ARUG6zq8v82cng +C/i6coQ1Eg1Kka6sDXFnV7bMTekcKJOf6Q0gc6scFJA +--- sx1TUDKIOIimdMTVBePkZzcfpJnvHddO1itsV7adTSo +8Z4bɑLe @B'ƠjOiZەpI[!o8ɛc<Г眗P޽ \ No newline at end of file diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 2d8392a..4e09c95 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -92,6 +92,9 @@ in # Then pipe the resulting files to agenix -e "gitlab/key.age".publicKeys = everyone; "gitlab/cert.age".publicKeys = everyone; + "gitlab/salt.age".publicKeys = everyone; + "gitlab/primary-key.age".publicKeys = everyone; + "gitlab/deterministic-key.age".publicKeys = everyone; "gitlab/nixos-qemu-shell.age".publicKeys = everyone; "gitlab/nixos-vbox-shell.age".publicKeys = everyone; "gitlab/kubernetes-k3s-local.age".publicKeys = everyone;