infrastructure

commit eea37255394d9ecc6697557e81cdb0c03e1cb867
parent 0a1cd0d01763fdcbb2d2b84aec20f4387a3ca98e
Author: Silas Brack <silasbrack@gmail.com>
Date:   Thu,  3 Oct 2024 15:35:18 +0200

Add secrets.yaml

Diffstat:
M
infrastructure/.sops.yaml
 | 
2
+-
M
infrastructure/hive.nix
 | 
6
+-----
A
infrastructure/secrets.yaml
 | 
49
+++++++++++++++++++++++++++++++++++++++++++++++++

3 files changed, 51 insertions(+), 6 deletions(-)
diff --git a/infrastructure/.sops.yaml b/infrastructure/.sops.yaml
@@ -5,7 +5,7 @@ keys:
   - &hosts:
     - &server age1e52v0cr69sycuh59hksx9nk5327vgkemkxqwngd25gtztxhkpups87yd5g
 creation_rules:
-  - path_regex: secrets/sops/secrets.yaml
+  - path_regex: secrets.yaml
     key_groups:
       - age:
           - *desktop
diff --git a/infrastructure/hive.nix b/infrastructure/hive.nix
@@ -35,9 +35,6 @@ in {
     deployment = {
       targetHost = "188.166.127.72";
       targetUser = "root";
-      keys."sops.txt" = {
-        keyFile = ./secrets/server_age_private_key.txt;
-      };
     };
     networking.hostName = name;
     time.timeZone = "Europe/Amsterdam";
@@ -47,10 +44,9 @@ in {
       sops_nix
       # ../apps/my-app
     ];
-    # networking.firewall.allowedTCPPorts = [ 8000 ];
     security.pki.certificateFiles = [ ./secrets/ca-certificate.crt ];
 
-    sops.defaultSopsFile = ./secrets/sops/secrets.yaml;
+    sops.defaultSopsFile = ./secrets.yaml;
     sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
     sops.secrets.server_wireguard_key = {
       restartUnits = [ "wg-quick-wg0.service" ];
diff --git a/infrastructure/secrets.yaml b/infrastructure/secrets.yaml
@@ -0,0 +1,49 @@
+hello: ENC[AES256_GCM,data:p3TGNPrk8jD3Zp7Isz+hcTeJfhO9Y8yqbMfkjCKNM2+AqSxEHp5fFN+5F6h/Mg==,iv:nxHP8dSBd3WbgMAUtgkKrJ2cnua3tBIItxEPsN66gEE=,tag:9L1TILuxnRlLecC2dG04Jw==,type:str]
+example_key: ENC[AES256_GCM,data:Wb4ExC7CINl2Rah1Ow==,iv:5X2nkERMxxcut6v+9kUI5WqhdSY1gmKAHJcKAe3RTd8=,tag:tiNFZUD6sbS7yEqNWEmgNA==,type:str]
+#ENC[AES256_GCM,data:jTbqOMZ1/Ft4IoJMTnSqUg==,iv:jnh6qd+y5iALVWJddqWTTDolizAsf1QXH554qC0iG2w=,tag:dM4VaxkQsabvCBJZVoq76Q==,type:comment]
+server_wireguard_key: ENC[AES256_GCM,data:21uPlSLnedqeXxIjS+HhJ0lAD6T/diIkjAAhbrB/a6jSVST9u8YTXWNgZ8w=,iv:pOGONrRuUNS8obDdw6GvEkCO7a+Ym5kOgLH6u+P9QQ0=,tag:cAcDTQ5pU8fV5hDzx+d+5A==,type:str]
+example_array:
+    - ENC[AES256_GCM,data:emBtNM4Z+eKUc4fgoy4=,iv:QZGLgegm37t2rJz7cadXuhysv2x4KUZ/Vz41WVk49g0=,tag:0GoDPZIuOJKo+ilvplxPpQ==,type:str]
+    - ENC[AES256_GCM,data:d13nqbhM7eiZHrgHCEg=,iv:MeM5zOcGiaXB6kuctZ8uOkei3aH5RusoWDhj8hp9a6E=,tag:y0S4sDbM18OC9rPylE64Cg==,type:str]
+example_number: ENC[AES256_GCM,data:XthxMNyNsYcvBA==,iv:wP9J1RLbHqr/s6fCKn08pCkkazte7YbiM8i/lRLpCBI=,tag:Lw3Z4pw3GI7OHaTYYiaXPw==,type:float]
+example_booleans:
+    - ENC[AES256_GCM,data:voC8aQ==,iv:GJo2uL2/QgfaXEgX5jaoeRL3MGDYVsfR4R4g24Bj+L4=,tag:9bSOFsLQ+s2RGBCT8mR+hg==,type:bool]
+    - ENC[AES256_GCM,data:TjfdAX8=,iv:n7a0ygblw4nl0fonIWR9bUevTvCBz51Aib8iaiP/YMo=,tag:fXxyhQiAbwLxP+bzRFhCxA==,type:bool]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1s29qgfupgx7mqn9dk2rndp6xh63f5qan8vqa77ve603wd5m9a9rqkpq7re
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyTXRaUkNqVWpVY2NEdGo4
+            QUNxbW41VWN3Mkx3NDRqbld0NlMyME5SRjJzCmEyZnVrWnRCcnoxbWE2bXFPQ1pk
+            ME81VTIxMlluTW0rYmlHS0tlK1NONk0KLS0tIEhZN1BIdnk4dHRkY3JyTmthZjR6
+            aDFtMXJPbzhxYU1RaGVyUjYvc3Z2YUUKHh8Y5iuPB8D0VOxZvXQX61Uoae525ajZ
+            vc21qI0li9fBTmKNy0VYHDLvboP83jLNsAMd2To+xHmJimkhiivkew==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age10h669gfc0yfdrfj4gtnsrpdfvrsh55tn0cj8kuk5t3x5e079dpgs30cuxw
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBNzNQMkorTkdISUJScUdr
+            SW9qUjJNU2hvbmhJRTQ3MG1sY1QxUWNVZ0YwCnpTS0FRKzZpbWpyOEpPMlFCQlhw
+            NmVVazNhZHBYdEFnMS9JT0Y2WUo1OTgKLS0tIEJ0Y3huYXJzY3poRkhTeXlOTXRv
+            MTFtYnh5Y0ZXMzdhV3ZqUjVLQjAzN0UKEFfu1TlRUHkyGDg2PLWQdm0VfXUiGZDZ
+            u5UsCR6bmvAMblGg4bXLmXhH61H97n6aJMS92j+G8uE4BDE1q/y4Tw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1e52v0cr69sycuh59hksx9nk5327vgkemkxqwngd25gtztxhkpups87yd5g
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5Um1lQ0tVcGh0ZUQ2TGUv
+            OG1Qck9iZ0JodkVPNGUwNCt5ZzI2NGxhQ1VvCmF1SmpNL2o5WlQrdTRYSTV0WUY2
+            Um5hVUp4ODFLUWx4ckl4WlMxUEhYWEkKLS0tIFBBRWlDWlEvR3g3alY5emNaRVI4
+            VTVIMjJSaGVRY3hYbmhzUmFiaCtxVUEKmGFgyEVxF0s8UqrbV9vpVonzEqMdx/9z
+            yeAc9I9fdMiakISPvkh9Jkexc4duFS1noGTIAXPfCEriIupol2MVvw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-10-02T18:09:09Z"
+    mac: ENC[AES256_GCM,data:AP3fnmoVRzNC/fmzrsn4triUB12/09VUzVO2hVtLsmBo6U1BaE86PMj49o9GvaGZ11zHAo9RC/f9egZYtgrXSfVHlMy8dVndONRF3UvAXaEyIyWqGpy98+iaSRavYRHCyYGKg1t1Z24Kjj9Yh3Dk4V5eNSnhobcPR5wlEkjCXGQ=,iv:iD2bg9e0yhyxdFaeL4nZK0mJjaAFGkyOmxT8/VsEPUI=,tag:DYB5E1Tfp9w6NP6I6DAt0Q==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.0