delft: switch from nixops deployment.secrets -> age.secrets
Pierre Bourdon committed
Jan 28, 2024 at 15:09 UTC
4732e2a7de49dccfb44afb646798b6bd9debd6b2
4 files changed
+21
-32
delft/eris.nix
+6
-8
@@ -677,9 +677,9 @@ in
677
};
678
};
679
680
- deployment.keys."packet-sd-env" = {
681
- keyFile = /home/deploy/src/nixos-org-configurations/prometheus-packet-service-discovery;
682
- user = "packet-sd";
680
+ age.secrets.packet-sd-env = {
681
+ file = ./secrets/packet-sd-env.age;
682
+ owner = "packet-sd";
683
};
684
685
users.users.packet-sd = {
@@ -706,15 +706,13 @@ in
706
User = "packet-sd";
707
Group = "keys";
708
ExecStart = "${sd}/bin/prometheus-packet-sd --output.file=/var/lib/packet-sd/packet-sd.json";
709
- EnvironmentFile = "/run/keys/packet-sd-env";
709
+ EnvironmentFile = config.age.secrets.packet-sd-env.path;
710
Restart = "always";
711
RestartSec = "60s";
712
};
713
};
714
715
- deployment.keys."fastly-read-only-api-token" = {
716
- keyFile = /home/deploy/src/nixos-org-configurations/fastly-read-only-api-token;
717
- };
715
+ age.secrets.fastly-read-only-api-token.file = ./secrets/fastly-read-only-api-token.age;
716
717
systemd.services.prometheus-fastly-exporter =
718
let
@@ -725,7 +723,7 @@ in
723
after = [ "network.target" ];
724
725
script = ''
728
- export FASTLY_API_TOKEN=$(cat /run/keys/fastly-read-only-api-token)
726
+ export FASTLY_API_TOKEN=$(cat ${config.age.secrets.fastly-read-only-api-token.path})
727
${fastly}/bin/fastly-exporter \
728
-endpoint http://127.0.0.1:9118/metrics
729
'';
delft/eris/alertmanager-matrix-forwarder.nix
+4
-4
@@ -1,8 +1,8 @@
1
{ config, pkgs, ... }:
2
{
3
- deployment.keys."alertmanager-matrix-forwarder" = {
4
- keyFile = /home/deploy/src/nixos-org-configurations/keys/alertmanager-matrix-forwarder;
5
- user = config.systemd.services.go-neb.serviceConfig.User;
3
+ age.secrets.alertmanager-matrix-forwarder = {
4
+ file = ../secrets/alertmanager-matrix-forwarder.age;
5
+ owner = config.systemd.services.go-neb.serviceConfig.User;
6
};
7
8
# Create user so that we can set the ownership of the key to
@@ -18,7 +18,7 @@
18
services.go-neb = {
19
enable = true;
20
baseUrl = "http://localhost";
21
- secretFile = "/run/keys/alertmanager-matrix-forwarder";
21
+ secretFile = config.age.secrets.alertmanager-matrix-forwarder.path;
22
config = {
23
clients = [
24
{
delft/eris/packet-spot-market-prices.nix
+4
-4
@@ -7,9 +7,9 @@ let
7
sha256 = "sha256-I2WolAAM+siE8JfZbEZ3Mmk7/XqVio/PzUKqZUYCBfE=";
8
};
9
in {
10
- deployment.keys.prometheus-packet-spot-market-price-exporter = {
11
- keyFile = /home/deploy/src/nixos-org-configurations/keys/prometheus-packet-spot-market-price-exporter-config.json;
12
- user = "spot-price-exporter";
10
+ age.secrets.prometheus-packet-spot-market-price-exporter = {
11
+ file = ../secrets/prometheus-packet-spot-market-price-exporter.age;
12
+ owner = "spot-price-exporter";
13
};
14
15
users.users.spot-price-exporter = {
@@ -34,6 +34,6 @@ in {
34
(pkgs.python3.withPackages (p: [ p.prometheus_client p.requests ]))
35
];
36
37
- script = "exec python3 ${exporter}/scrape.py /run/keys/prometheus-packet-spot-market-price-exporter";
37
+ script = "exec python3 ${exporter}/scrape.py ${config.age.secrets.prometheus-packet-spot-market-price-exporter.path}";
38
};
39
}
modules/rfc39.nix
+7
-16
@@ -2,21 +2,12 @@
2
{ config, pkgs, ... }:
3
let
4
rfc39 = import /home/deploy/src/rfc39 { inherit pkgs; };
5
-in {
6
- deployment.keys."rfc39-credentials.nix" = {
7
- keyFile = /home/deploy/src/nixos-org-configurations/keys/rfc39-credentials.nix;
8
- user = "rfc39";
9
- };
10
-
11
- deployment.keys."rfc39-github.der" = {
12
- keyFile = /home/deploy/src/nixos-org-configurations/keys/rfc39-github.der;
13
- user = "rfc39";
14
- };
5
16
- deployment.keys."rfc39-record-push.key" = {
17
- keyFile = /home/deploy/src/nixos-org-configurations/keys/rfc39-record-push.key;
18
- user = "rfc39";
19
- };
6
+ rfc39Secret = f: { file = f; owner = "rfc39"; };
7
+in {
8
+ age.secrets.rfc39-credentials = rfc39Secret ../delft/secrets/rfc39-credentials.age;
9
+ age.secrets.rfc39-github = rfc39Secret ../delft/secrets/rfc39-github.age;
10
+ age.secrets.rfc39-record-push = rfc39Secret ../delft/secrets/rfc39-record-push.age;
11
12
users.users.rfc39 = {
13
description = "RFC39 Maintainer Team Sync";
@@ -43,7 +34,7 @@ in {
34
''
35
set -eux
36
46
- export GIT_SSH_COMMAND='ssh -i /run/keys/rfc39-record-push.key'
37
+ export GIT_SSH_COMMAND='ssh -i ${config.age.secrets.rfc39-record-push.path}'
38
export GIT_AUTHOR_NAME="rfc39"
39
export GIT_AUTHOR_EMAIL="rfc39@eris"
40
export GIT_COMMITTER_NAME="rfc39"
@@ -70,7 +61,7 @@ in {
61
62
rfc39 \
63
--dump-metrics --metrics-delay=240 --metrics-addr=0.0.0.0:9190 \
73
- --credentials /run/keys/rfc39-credentials.nix \
64
+ --credentials ${config.age.secrets.rfc39-credentials.path} \
65
--maintainers ./maintainers/maintainer-list.nix \
66
sync-team NixOS 3345117 --limit 50 \
67
--invited-list "$recordsdir/invitations"