Expost postgres cluster

Expose the postgres cluster outside of the Kubernetes cluster
Give myself the option of connecting to postgres from my own machines,
so that I can hopefully leverage the improved performance
Update some file linting issues in Nix
Add necessary gitlab keys so it can be updated properly the next time I
deploy to it
Add DNS entries for postgres
Update the configuraiton of Traefik to expose the appropriate ports

hosts/genesis/net/hosts

@@ -32,7 +32,7 @@
 100.88.91.27 genesis.home smart.home zwave.home nixcache.home gitcache.home dashy.home uptime.home speed.home
 100.91.131.66 gitlab.home gitlab.shire-zebra.ts.net gitlab.thehellings.lan registry.thehellings.lan git.thehellings.lan
 100.68.203.1 hosea.home hosea.shire-zebra.ts.net
-100.84.183.79 isaiah.home isaiah.shire-zebra.ts.net pgadmin.kubernetes
+100.84.183.79 isaiah.home isaiah.shire-zebra.ts.net pgadmin.kubernetes postgres.kubernetes
 100.102.186.39 jeremiah.home jeremiah.shire-zebra.ts.net matrix.kubernetes
 100.90.74.19 jude.home
 100.115.57.8 linode.home

hosts/proxmoxtemplate/default.nix

@@ -2,13 +2,13 @@
 # your system.  Help is available in the configuration.nix(5) man page
 # and in the NixOS manual (accessible by running ‘nixos-help’).
 
-{ config, pkgs, ... }:
+{ pkgs, ... }:
 
 {
-  imports =
+  imports = [
-    [ # Include the results of the hardware scan.
+    # Include the results of the hardware scan.
-      ./hardware-configuration.nix
+    ./hardware-configuration.nix
-    ];
+  ];
 
   # Bootloader.
   boot.loader = {
@@ -16,8 +16,10 @@
     efi.canTouchEfiVariables = true;
   };
 
-  environment.systemPackages = with pkgs; [
+  environment.systemPackages =
-  ];
+    with pkgs;
+    [
+    ];
 
   greg = {
     home = true;
@@ -43,6 +45,8 @@
     nameservers = [ "10.42.1.5" ];
   };
 
+  services.qemuGuest.enable = true;
+
   system.stateVersion = "24.11"; # Did you read the comment?
 
   # Define a user account. Don't forget to set a password with ‘passwd’.
@@ -50,6 +54,6 @@
     isNormalUser = true;
     description = "Greg Hellings";
     extraGroups = [ "wheel" ];
-    packages = with pkgs; [];
+    packages = with pkgs; [ ];
   };
 }

hosts/proxmoxtemplate/hardware-configuration.nix

@@ -1,28 +1,43 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{
+  lib,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
+  imports = [
-    [ (modulesPath + "/profiles/qemu-guest.nix")
+    (modulesPath + "/profiles/qemu-guest.nix")
-    ];
+  ];
 
-  boot.initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "ahci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
+  boot.initrd.availableKernelModules = [
+    "uhci_hcd"
+    "ehci_pci"
+    "ahci"
+    "virtio_pci"
+    "virtio_scsi"
+    "sd_mod"
+    "sr_mod"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" =
+  fileSystems."/" = {
-    { device = "/dev/disk/by-uuid/507251f1-efe7-448d-8de8-91ee582a9afb";
+    device = "/dev/disk/by-uuid/507251f1-efe7-448d-8de8-91ee582a9afb";
-      fsType = "ext4";
+    fsType = "ext4";
-    };
+  };
 
-  fileSystems."/boot" =
+  fileSystems."/boot" = {
-    { device = "/dev/disk/by-uuid/7115-EFA6";
+    device = "/dev/disk/by-uuid/7115-EFA6";
-      fsType = "vfat";
+    fsType = "vfat";
-      options = [ "fmask=0077" "dmask=0077" ];
+    options = [
-    };
+      "fmask=0077"
+      "dmask=0077"
+    ];
+  };
 
   swapDevices = [ ];
 

hosts/vm-gitlab/default.nix

@@ -15,10 +15,10 @@ let
   containerIp = "192.168.200.2";
 in
 {
-  imports =
+  imports = [
-    [ # Include the results of the hardware scan.
+    # Include the results of the hardware scan.
-      ./hardware-configuration.nix
+    ./hardware-configuration.nix
-    ];
+  ];
 
   age.secrets =
     let
@@ -36,6 +36,9 @@ in
       gitlab-jws = cfg "jws";
       gitlab-key = cfg "key";
       gitlab-cert = cfg "cert";
+      gitlab-salt = cfg "salt";
+      gitlab-primary-key = cfg "primary-key";
+      gitlab-deterministic-key = cfg "deterministic-key";
 
       minio_access_key_id = {
         file = ../../secrets/minio_access_key_id.age;
@@ -79,7 +82,6 @@ in
     tailscale.enable = true;
   };
 
-
   networking = {
     hostName = "vm-gitlab"; # Define your hostname.
     firewall.allowedTCPPorts = [
@@ -134,10 +136,13 @@ in
         externalPort = 443;
       };
       secrets = {
-        secretFile = config.age.secrets.gitlab-secret.path;
+        activeRecordDeterministicKeyFile = config.age.secrets.gitlab-deterministic-key.path;
-        otpFile = config.age.secrets.gitlab-otp.path;
+        activeRecordPrimaryKeyFile = config.age.secrets.gitlab-primary-key.path;
+        activeRecordSaltFile = config.age.secrets.gitlab-salt.path;
         dbFile = config.age.secrets.gitlab-db.path;
         jwsFile = config.age.secrets.gitlab-jws.path;
+        otpFile = config.age.secrets.gitlab-otp.path;
+        secretFile = config.age.secrets.gitlab-secret.path;
       };
 
       extraConfig = {

hosts/vm-gitlab/hardware-configuration.nix

@@ -1,18 +1,30 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{
+  lib,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
+  imports = [
-    [ (modulesPath + "/profiles/qemu-guest.nix")
+    (modulesPath + "/profiles/qemu-guest.nix")
-    ];
+  ];
 
   # Bootloader.
   boot = {
     extraModulePackages = [ ];
     initrd = {
-      availableKernelModules = [ "uhci_hcd" "ehci_pci" "ahci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
+      availableKernelModules = [
+        "uhci_hcd"
+        "ehci_pci"
+        "ahci"
+        "virtio_pci"
+        "virtio_scsi"
+        "sd_mod"
+        "sr_mod"
+      ];
       kernelModules = [ ];
     };
     loader = {
@@ -21,16 +33,19 @@
     };
   };
 
-  fileSystems."/" =
+  fileSystems."/" = {
-    { device = "/dev/disk/by-uuid/507251f1-efe7-448d-8de8-91ee582a9afb";
+    device = "/dev/disk/by-uuid/507251f1-efe7-448d-8de8-91ee582a9afb";
-      fsType = "ext4";
+    fsType = "ext4";
-    };
+  };
 
-  fileSystems."/boot" =
+  fileSystems."/boot" = {
-    { device = "/dev/disk/by-uuid/7115-EFA6";
+    device = "/dev/disk/by-uuid/7115-EFA6";
-      fsType = "vfat";
+    fsType = "vfat";
-      options = [ "fmask=0077" "dmask=0077" ];
+    options = [
-    };
+      "fmask=0077"
+      "dmask=0077"
+    ];
+  };
 
   swapDevices = [ ];
 

hosts/vm-jellyfin/hardware-configuration.nix

@@ -1,28 +1,43 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{
+  lib,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
+  imports = [
-    [ (modulesPath + "/profiles/qemu-guest.nix")
+    (modulesPath + "/profiles/qemu-guest.nix")
-    ];
+  ];
 
-  boot.initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "ahci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
+  boot.initrd.availableKernelModules = [
+    "uhci_hcd"
+    "ehci_pci"
+    "ahci"
+    "virtio_pci"
+    "virtio_scsi"
+    "sd_mod"
+    "sr_mod"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" =
+  fileSystems."/" = {
-    { device = "/dev/disk/by-uuid/507251f1-efe7-448d-8de8-91ee582a9afb";
+    device = "/dev/disk/by-uuid/507251f1-efe7-448d-8de8-91ee582a9afb";
-      fsType = "ext4";
+    fsType = "ext4";
-    };
+  };
 
-  fileSystems."/boot" =
+  fileSystems."/boot" = {
-    { device = "/dev/disk/by-uuid/7115-EFA6";
+    device = "/dev/disk/by-uuid/7115-EFA6";
-      fsType = "vfat";
+    fsType = "vfat";
-      options = [ "fmask=0077" "dmask=0077" ];
+    options = [
-    };
+      "fmask=0077"
+      "dmask=0077"
+    ];
+  };
 
   swapDevices = [ ];
 

manifests/databases/ingress.yaml

@@ -0,0 +1,39 @@
+apiVersion: traefik.io/v1alpha1
+kind: MiddlewareTCP
+metadata:
+  name: local-hosts-only
+  namespace: db
+spec:
+  ipAllowList:
+    sourceRange:
+      - 127.0.0.1/32 # Localhost, obviously
+      - 10.42.0.0/16 # My internal net
+      - 10.211.0.0/16 # Kubernetes IPs
+      # Tailscale hosts
+      - 100.119.228.115 # chronicles
+      - 100.88.91.27 # dns?
+      - 100.80.99.48 # exodus
+      - 100.88.91.27 # genesis
+      - 100.91.131.66 # gitlab
+      - 100.68.203.1 # hosea
+      - 100.84.183.79 # isaiah
+      - 100.102.186.39 # jeremiah
+      - 100.90.74.19 # jude
+      - 100.115.57.8 # linode
+      - 100.65.5.38 # matrix
+      - 100.127.55.22 # jellyfin
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRouteTCP
+metadata:
+  name: ingress-route-postgres
+  namespace: db
+spec:
+  entryPoints:
+    - postgres
+  routes:
+    - match: HostSNI(`*`)
+      priority: 10
+      services:
+        - name: postgres-rw
+          port: 5432

manifests/databases/kustomization.yaml

@@ -5,3 +5,4 @@ resources:
   - postgres-gitlab.yaml
   - postgres-pgadmin.yaml
   - postgres-matrix.yaml
+  - ingress.yaml

manifests/helm/kustomization.yaml

@@ -1,4 +1,5 @@
 resources:
   - flux.yaml
+  - traefik.yaml
   - external-secrets.yaml
   - cloudnative-pg.yaml

manifests/helm/traefik.yaml

@@ -0,0 +1,22 @@
+apiVersion: "helm.cattle.io/v1"
+kind: "HelmChartConfig"
+metadata:
+  name: "traefik"
+  namespace: "kube-system"
+spec:
+  valuesContent: |-
+    additionalArguments:
+      - "--entryPoints.postgres.address=:5432/tcp"
+      - "--api.dashboard=true"
+      - "--api.insecure=true"
+      - "--log.level=DEBUG"
+    ports:
+      postgres:
+        expose:
+          default: true
+        port: 5432
+        exposedPort: 5432
+        protocol: TCP
+      traefik:
+        expose:
+          default: true

modules/nixos/kubernetes.nix

@@ -37,6 +37,9 @@ in
     networking.firewall = {
       allowedTCPPorts =
         [
+          80
+          443
+          5432
           6443
         ]
         ++ (

secrets/gitlab/deterministic-key.age

@@ -0,0 +1,39 @@
+age-encryption.org/v1
+-> ssh-ed25519 64uajw pGArtr7GB1lyaooKK46PBygPCtdQmFfEpk1rA0molCA
+8ssJyIFriGAp9BQCYMyTf+S2HmMeOC1UH2QXqbqBFLQ
+-> ssh-ed25519 oyEmTw AZbFjT/AjhDQOVHQYiZAKwZyUZar5uMiM2r2B3IpN3A
+FQ3cu6l6KZbHB6vSatiLWV/ntDoc1zVT4/QUinPVZCc
+-> ssh-ed25519 mOmPfg Ru0AM8rjvVpn3PjWp7KPf/wtdBAphHfpNJ9bbZZVdmM
+sphzkfNpy3GiLSXo5U9ct8t55tLGE+Lt2MVglsMCu/E
+-> ssh-ed25519 YJiRbw UuAcR0LT/TWfWI1Ba8cm6iv/aYY+eADglTwPBAyjP1Q
+NxxO5o0G+PQZBRTC1pdAFNr28+ijKUEXAZJDsbF2sLg
+-> ssh-ed25519 aY2AXA 4Y8xviHTR9/fjycJHzcHLzN1txHl1+bGHG099CNnDm4
+Y9IQVYf5KQ1qDdFwPKpWxsCwdy46OYRlYCncvEMHXO0
+-> ssh-ed25519 xNtnoA CWVPYtuxcHQLtSd9cWLs7yuPgAuaY1hRGMesA+HhGCE
+5LFGLF5uRxHkbSp0WenWH5pBpEDNr269GmTOrSA5F90
+-> ssh-ed25519 AQhf1g bjCjRVRxIWGPIbXg6QvNwXjiXajyuwMXbLu/3EDxp3Y
+zHlX3WzfAccjVyksrzsdWfVsx2ia2oXBdTWLGroP1BA
+-> ssh-ed25519 B8wa7Q zr+NOkU1OAJPvpN/MXECQAowUKWIbnNLJJsGeGUydww
++we1cguTwDROfIAJJYrExz9Towmr18JXVY3oRkpv14w
+-> ssh-ed25519 8UnW5Q QjneH4f6Oly7tnAMLiLMwUIjAsaSi5ZFoC8TQG6GkmY
+kspnipzqALYSiT1jJRhF1yZecxbkXv70vlBKMUxBPZw
+-> ssh-ed25519 0/WsKg Ep9gDq0DtcGbdQh/PrYe+iBv6OSeLPWxICjXbKjFJnE
+2g526leouu0mRQBJSebsQ2h/3UF2fqQe6P8PnSLEhWA
+-> ssh-ed25519 Nl/5yA ki1Df4IbjbBJsBuu0i7mlCDkIcp/238uCzTq2xxo3SU
+0KPSkglgV55rtv0cJ0ZHxXXrrd/kFWPieM1RSSz+KKU
+-> ssh-ed25519 GdLgCQ L+YIJXArLcYoRNBOEgSrpM0fNQHWTZn3AKmuue9s1Hs
+Y7dOqUW2+/6DTVHfitXWPRQTn8dAXFaO848XhiarYYI
+-> ssh-ed25519 tOH/HQ rohrw+mCT7L76YNfHG2kZ//3+0BvLE5adIv4iDCYPXo
+7VsJeUR655/7Rl5+aT3OUK1iUHL2xaz88VblWxyzDbk
+-> ssh-ed25519 FpzvfQ v8DOcm6/7afe7hqJLs4yS9QsoaKrtmft1nUbVMIQbiY
+zPtH/T7vUG0TYAImLK4a4i8ta/n4Iu5qUIHNzj4AExk
+-> ssh-ed25519 kdPvzQ TVIyKHig7iMyCx25roaLgF+wbm8r/FdDmYzsn47mQFY
+7FGAj3og7JONhSZFjywwoc41lGSaUvJb2BaFjc7Ymlw
+-> ssh-ed25519 onmXpg yr5rUSP7BVin9iRa8dbhsqkhzMNBgk03kSj0ne+9cxw
+5fYMGMVh4lxXuZzNIOUhXj9B43RIEzI2mCy9urSSEng
+-> ssh-ed25519 CnhD0g 7hvSFju7gEZ3z/wh7vYErWG545rqx2Vw+uoOk/QplEs
+UOPP23HMYyJ5w/3qbtEmHZU36F8kwiCVBsaZHTeOJgk
+-> ssh-ed25519 4ep2UA SSi6Na4Zkz15jv9AIQV9UW0xr2YFmoT5s96Fz0X0nmk
+BoSwO6G8pMUt/N8RRLdVxzmQsn6RK655j27shIV5xq8
+--- FsKrB9/IGIe8BxDxJDSnAnm84SoJAPZFawQjoAUTbUE
+…¤ú¦\86IrwN[]¬å$é`uù8BÞ„�HŽûÖƒ.§ñÓa‚#Â|³b¡�Ëi—Ò®*é›>KpÈØÏq

secrets/gitlab/primary-key.age

@@ -0,0 +1,39 @@
+age-encryption.org/v1
+-> ssh-ed25519 64uajw 65up4NePHDRo97ryHxOcL/ZulVqH6bE8o0HRwKaS/zI
+c4XtvR4EeZ8G4iT7sEj9prfvAoDDMnp8dUF2JSc/qPU
+-> ssh-ed25519 oyEmTw QiQFAuLBYBQmiJ8TAGagLqfDFktf4mwsOhmJ7ZBIM0s
+fdpvwfAKAWJUrFcGNA5NmH14Weixfp8NUqoPA/mw+4I
+-> ssh-ed25519 mOmPfg dPYBhH6jodNFeTNTMwPuEq46i7DzKq67tMlYWkw3+T8
+Z4Uh0YhUL8KWqUCmr/AFILazC7v9L2poNC7IUbE6Uu8
+-> ssh-ed25519 YJiRbw RvWUVFSFOvz7q5mNBg1FoYLi1jbpMPvImUlJSy5zBTQ
+nNuNQnN/RhtFUOsbezo8LP8ceY/yqFSYDCo7igujiqM
+-> ssh-ed25519 aY2AXA LbCZXvEeHWVtlvecusaJVdRSUjsCONHhD2ADA73FGy8
+4zNv08Z7vvS1c2/BOdL0JxAX/Y+kU4q/WWlfxmA6fVk
+-> ssh-ed25519 xNtnoA fZVGgBdLb47UmapPENDK6nxICXx+KeIEhBQ3UKIi7HM
+dTJO+0qXtgpzjCe6K4+FQa0nynH5qEXebyERRQEBDzE
+-> ssh-ed25519 AQhf1g 8Srs6GErqaEibInARo/dzXwXdNqNTFBk/kgPyXGlEAM
+K0Ol9j/Uxw1up7xEapKwtoTAc2ZgoHuqKiHFcdrM4IY
+-> ssh-ed25519 B8wa7Q PZekZdp5Dj84fnRopshQYTZu7ue8A92PMfMqGMyPIUk
+Y6WvNhXo2nQI/nmI2gGdO9XCjjafpAai+fEGeYSGCHA
+-> ssh-ed25519 8UnW5Q AsNtL1dQUNeKHaatp/85nVUe1jLL5WsviNpKXQEBqkY
+z/9Q/DJQqVGNYHHJ3fU/EFPfTREZSJMxxlm6fhVGpME
+-> ssh-ed25519 0/WsKg 4TV+ryC7wbPQGTnU7TzuwCJz+iZEluBFAlnk23deA0U
+h9JoILNlSPX+dePFjSYM8vvetXINWAJ+DIXcStM+D6M
+-> ssh-ed25519 Nl/5yA uw7SLz+XPRnHb5ux2mp1VEL/cwnMFMhc86UnglcwARI
+k7lt+0yFMqAcepklurzW0MoB+yr3HL9DLTa+1+PPETg
+-> ssh-ed25519 GdLgCQ t5aY2s4XfLnlmAjB5k8UpEy2iMm2K8NFeowDyP9nliY
++x0yKD0pDecGPnU/ijJ7WRUm/UNoQu4EX4/azB9Og6Y
+-> ssh-ed25519 tOH/HQ Cc06HO0i/Yy65bNTREl2r0qd8sM+vhLyVxB7Pm8pemY
+qy1juC+a7BjtMZ2XoFvfCkIEI8ihTCs9ThAkTSvEsVg
+-> ssh-ed25519 FpzvfQ MdxHv8FxO4tRbiup4k6N4JUFtnofB6WJ8xn8KTUSjyM
+Mx+0cPM5bq/qJxKXSmzneL/Pg5CBiO7bjHjyFT05exw
+-> ssh-ed25519 kdPvzQ Tww+Oh8cQV9/qUw+2FWpRJTljjsbFB7T93xrRJcFGwo
+lGyd6FuQ3Y68pVn/aZCCtxVEoc9gn5Nc42peuFy68dk
+-> ssh-ed25519 onmXpg asPPNt+wiRFWgaBaie0voK4Yw5R8t8r5I3t6qujAsx0
+oa8Em8djkwbKYUQkPvZ3YMvvM2x9NEtm/f6Y7PoWmmo
+-> ssh-ed25519 CnhD0g lfXt1ZIhVWv84cvAykGjO44OvVny+U1Rju+17gx6qR0
+7StUFJgr+8zVr9OAmtgQk+UoBaQ8LqIUmttqlXdpX+s
+-> ssh-ed25519 4ep2UA ued9/iPni10UpRf/RM0wesnRfp+lpoO99831MoShxnk
+k5t8fmGnoCkHskZdvw1fYyCdns7BZsPUaLlJ6WzQgHc
+--- HaCc7eAoVLgJf982a8aRJPadwoZ9WAQ2jH1+j5Z2w8Y
+W»Ø÷!Mø¤CuÊ¥õX?„l=?˳êé[ÍÕþ(¹üMªNµÆ�ßqh^"·Ž›…`#A4&qhšßE¢

secrets/gitlab/salt.age

@@ -0,0 +1,39 @@
+age-encryption.org/v1
+-> ssh-ed25519 64uajw RdFMAWftlhzUEqoxui6a0IBxI7KxrU6C5uQeJwhUAzg
+UO611nUdfsLfG+LRhPVkX+BaVM2NoTB571nDdy7nn6E
+-> ssh-ed25519 oyEmTw 3zfLtPD8rpTSaVSMQCOSp38S9fywd6e+V0e9v9JGgwU
+qjaK+z7HDjmLdViDNjCj6rm3bNjc0xrrUVlwupkXd5w
+-> ssh-ed25519 mOmPfg weCYfjyuqqPcEVNM7+rqE/x5ZL8Mifp+obzMULqZgWU
+0HTPHd8Hq8qJOfVzP/kczVQYaXKJykT9KCK9Rn6r/nI
+-> ssh-ed25519 YJiRbw 0ARXvdUzE670xRni7RRnyVhzFURTyoQ1GTNtfY+MWU8
+jlt7BMNJ/AwOOIkIDAyiFyy8FV5PYlcqwB6MOLSZce4
+-> ssh-ed25519 aY2AXA CyalC9EQJFdNCl+BNLKrt8KKZBPnaPzH3t25F9otkEM
+m3mig+c7SvWuxUIorZcVfzIqualwTC+xJBDKvB+zCcU
+-> ssh-ed25519 xNtnoA 3n7J6GMt64Z9+0M89QTmZaeJ2/A7JdMl7TfC2nUt+xQ
+wk6G2SZL9VTzFlyIzc/EulzzG5P9EG9M1652aapvT+Q
+-> ssh-ed25519 AQhf1g ksxGPi6mYEhc1X2waHMXkTFgnB6lpKWKUeyMxFOnMkM
+Jj6fEbw52O3I9wUyk9of+NSJmNZC1U4+7UF98ChEbQI
+-> ssh-ed25519 B8wa7Q yMYUdu6A9dEmiAgYveyxSKoUL5XkmMdnyOIwherXzyc
+4n87yY0czhQib32cxQ8XH6tepRIzjmE7ewWCRaY0Dpg
+-> ssh-ed25519 8UnW5Q PLN3cqCd4t1m4bNbRjFNAs5k2hwTUxRV02DPgpZ75Uk
+tRwglJ5sPoJzp9Je5xEXlYM2kbUUd+xwawZIBYKZKZk
+-> ssh-ed25519 0/WsKg V0GKvQ3KdATmhVHlXyL95Lb1bZ7uTBMHH+1DloQwaWA
+UDb0UWGNzjY7K7qNqhU88+ViGoP7msG73sxmiTwaKgQ
+-> ssh-ed25519 Nl/5yA eyZT6r909dv5ClBxUhCflv1676VV1uQALhsrHJycRQY
+0AkXJLRwKURIXPhnM8VnUVkBl9Oq4LUHTs4n7Ai0X0w
+-> ssh-ed25519 GdLgCQ bIMe/3XDR7HCZOzxG+n8ud5bzMMDrZSPCDoPnbX7clg
+XGRkbM1xkZzhaCa2frDhWAZkJ0RAlbBx7IcJrCzhXWc
+-> ssh-ed25519 tOH/HQ 42VvN/DyV1VjbK0sI3/AWGCByXw+W/atfLUjlEIkyCs
+f2DijeqBQss3f44fFIDC5M3SXRRpm3Cl0iaLLOyAD68
+-> ssh-ed25519 FpzvfQ iRQ1JgNvo6mpRIn4HiF3dOul/ZhzQbjP8MCID8sFY2k
+SL9kRpWY1SigL2MVhy99hB3ACCHIPTK/IMIH98epch0
+-> ssh-ed25519 kdPvzQ gleTd+wfxQgl4IcQDqw5SmdRQvOV5MRHtSh1XeXz3wY
+5fGWJak3xivrRJS+dfiUWc15KaVTIXe8xlLhr+lgIR4
+-> ssh-ed25519 onmXpg SU/B3Y0ddUAUNDPwSeAqaG1ICihEQRglorF1143KC1s
+Qm6GGzluTIvEVnXTbl3z0LcrzxXpdN5hOksc03giazY
+-> ssh-ed25519 CnhD0g GVlnY0nuxGqWn3y7CPIk3p5P/bJ2ovt/DCpsemTwnRw
+vleILr9u6erKyzgofdIZuVShrilviX0New95Xw3+0pM
+-> ssh-ed25519 4ep2UA xSlFMYDkUBAzs+xaJJr29rbaC4L88ARUG6zq8v82cng
+C/i6coQ1Eg1Kka6sDXFnV7bMTekcKJOf6Q0gc6scFJA
+--- sx1TUDKIOIimdMTVBePkZzcfpJnvHddO1itsV7adTSo
+¼ñ8¼Z4bÉ‘Le×	@B¹'Æ Œj§O©áÂiþZÛ•’pù
ŽŽI[!o8ÔÉ›ÙÔc<Г�眗®PÞ½

secrets/secrets.nix

@@ -92,6 +92,9 @@ in
   # Then pipe the resulting files to agenix -e <foo>
   "gitlab/key.age".publicKeys = everyone;
   "gitlab/cert.age".publicKeys = everyone;
+  "gitlab/salt.age".publicKeys = everyone;
+  "gitlab/primary-key.age".publicKeys = everyone;
+  "gitlab/deterministic-key.age".publicKeys = everyone;
   "gitlab/nixos-qemu-shell.age".publicKeys = everyone;
   "gitlab/nixos-vbox-shell.age".publicKeys = everyone;
   "gitlab/kubernetes-k3s-local.age".publicKeys = everyone;