@cryptotaxi247 / infra-1 / commits / 8b58adaf

ofborg: merge ofborg-infrastructure into this repo

The ofborg machines were maintained in a separate NixOS/ofborg-infrastructure repo that already consumed this one as a flake input for shared modules and ssh-keys. Keeping both repos in lockstep was a bit of a pain, so instead I moved the nixos code for the machines into this repo.

Jörg Thalheim committed Apr 13, 2026 at 09:25 UTC 8b58adaf8f770383b7dae74d83c836b523937732
88 files changed +4060 -2
.github/workflows/ci.yml
+54
@@ -75,6 +75,60 @@ jobs:
75 name: nixos-infra-dev
76 authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
77 - run: nix run --inputs-from . nixpkgs#nix-fast-build -- --skip-cached --no-nom --flake '.#nixosConfigurations."${{ matrix.machine }}".config.system.build.toplevel'
78 + # ofborg machines share most of their closure, so build all of one arch in a
79 + # single job to reuse the store between them.
80 + nixos-ofborg-x86_64:
81 + name: NixOS ofborg (x86_64)
82 + runs-on: ubuntu-latest
83 + steps:
84 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
85 + with:
86 + persist-credentials: false
87 + - uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # v31
88 + - uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
89 + with:
90 + name: nixos-infra-dev
91 + authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
92 + - run: nix run --inputs-from . nixpkgs#nix-fast-build -- --skip-cached --no-nom --flake '.#ciSystems.ofborg-x86_64-linux'
93 + nixos-ofborg-aarch64:
94 + name: NixOS ofborg (aarch64)
95 + runs-on: ubuntu-22.04-arm
96 + steps:
97 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
98 + with:
99 + persist-credentials: false
100 + - uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # v31
101 + - uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
102 + with:
103 + name: nixos-infra-dev
104 + authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
105 + - run: nix run --inputs-from . nixpkgs#nix-fast-build -- --skip-cached --no-nom --flake '.#ciSystems.ofborg-aarch64-linux'
106 + nix-darwin-ofborg:
107 + name: nix-darwin ofborg (aarch64)
108 + runs-on: macos-latest
109 + steps:
110 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
111 + with:
112 + persist-credentials: false
113 + - uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # v31
114 + - uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
115 + with:
116 + name: nixos-infra-dev
117 + authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
118 + - run: nix run --inputs-from . nixpkgs#nix-fast-build -- --skip-cached --no-nom --flake '.#ciSystems.ofborg-aarch64-darwin'
119 + nix-darwin-ofborg-x86_64:
120 + name: nix-darwin ofborg (x86_64)
121 + runs-on: macos-15-intel
122 + steps:
123 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
124 + with:
125 + persist-credentials: false
126 + - uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # v31
127 + - uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
128 + with:
129 + name: nixos-infra-dev
130 + authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
131 + - run: nix run --inputs-from . nixpkgs#nix-fast-build -- --skip-cached --no-nom --flake '.#ciSystems.ofborg-x86_64-darwin'
132 nix-darwin:
133 runs-on: macos-latest
134 strategy:
checks/flake-module.nix
+36 -1
@@ -1,5 +1,40 @@
1 -{ ... }:
1 +{ self, lib, ... }:
2 {
3 + # Group machine toplevels by architecture so CI can build all hosts of one
4 + # arch in a single nix-fast-build invocation (the ofborg fleet in particular
5 + # shares almost its entire closure). Hosts are listed explicitly to avoid
6 + # forcing evaluation of every configuration just to learn its system.
7 + flake.ciSystems =
8 + let
9 + nixos = names: lib.genAttrs names (n: self.nixosConfigurations.${n}.config.system.build.toplevel);
10 + darwin = names: lib.genAttrs names (n: self.darwinConfigurations.${n}.config.system.build.toplevel);
11 + in
12 + {
13 + ofborg-x86_64-linux = nixos [
14 + "core01.ofborg.org"
15 + "build01.ofborg.org"
16 + "build02.ofborg.org"
17 + "build03.ofborg.org"
18 + "build04.ofborg.org"
19 + ];
20 + ofborg-aarch64-linux = nixos [
21 + "eval01.ofborg.org"
22 + "eval02.ofborg.org"
23 + "eval03.ofborg.org"
24 + "eval04.ofborg.org"
25 + "build05.ofborg.org"
26 + ];
27 + ofborg-aarch64-darwin = darwin [
28 + "nixos-foundation-macstadium-44911207"
29 + "nixos-foundation-macstadium-44911104"
30 + ];
31 + ofborg-x86_64-darwin = darwin [
32 + "nixos-foundation-macstadium-44911305"
33 + "nixos-foundation-macstadium-44911362"
34 + "nixos-foundation-macstadium-44911507"
35 + ];
36 + };
37 +
38 perSystem =
39 { self', lib, ... }:
40 {
flake.lock
+38
@@ -524,6 +524,42 @@
524 "type": "github"
525 }
526 },
527 + "ofborg": {
528 + "inputs": {
529 + "nixpkgs": [
530 + "nixpkgs"
531 + ]
532 + },
533 + "locked": {
534 + "lastModified": 1775142351,
535 + "narHash": "sha256-HdnxJRJnPvlE4jqkivzd+zKVlsew4prfOz4cAkpkwyc=",
536 + "owner": "NixOS",
537 + "repo": "ofborg",
538 + "rev": "f5c1e00707d3ebd232d114b2732783d36a9dc17f",
539 + "type": "github"
540 + },
541 + "original": {
542 + "owner": "NixOS",
543 + "repo": "ofborg",
544 + "type": "github"
545 + }
546 + },
547 + "ofborg-viewer": {
548 + "flake": false,
549 + "locked": {
550 + "lastModified": 1736528671,
551 + "narHash": "sha256-g4BK1MP8LPBEesMdRavl6eqJcKPIQg6FWs4XSbzObq4=",
552 + "owner": "NixOS",
553 + "repo": "ofborg-viewer",
554 + "rev": "bb4ad97f2bd431e113698fce3a4a988f5d713019",
555 + "type": "github"
556 + },
557 + "original": {
558 + "owner": "NixOS",
559 + "repo": "ofborg-viewer",
560 + "type": "github"
561 + }
562 + },
563 "rfc39": {
564 "inputs": {
565 "nixpkgs": [
@@ -561,6 +597,8 @@
597 "nixpkgs": "nixpkgs",
598 "nixpkgs-swh": "nixpkgs-swh",
599 "nixpkgs-unstable": "nixpkgs-unstable",
600 + "ofborg": "ofborg",
601 + "ofborg-viewer": "ofborg-viewer",
602 "rfc39": "rfc39",
603 "simple-nixos-mailserver": "simple-nixos-mailserver",
604 "sops-nix": "sops-nix",
flake.nix
+11
@@ -106,6 +106,17 @@
106 url = "github:nix-community/nixpkgs-swh";
107 inputs.nixpkgs.follows = "nixpkgs";
108 };
109 +
110 + ofborg = {
111 + url = "github:NixOS/ofborg";
112 + inputs.nixpkgs.follows = "nixpkgs";
113 + };
114 +
115 + ofborg-viewer = {
116 + url = "github:NixOS/ofborg-viewer";
117 + flake = false;
118 + };
119 +
120 };
121 outputs =
122 inputs@{ flake-parts, ... }:
macs/.sops.yaml new
+58
@@ -0,0 +1,58 @@
1 +keys:
2 + - &hexa age1j3mkgedmeru63vwww6m44zfw09tg8yw6xdzstaq7ejfkvgcau40qwakm8x
3 + - &simon age17ez23w2kpxl0gcdx4ehcglkcfcfnv4qz0gq2n8ylxwx4yrtjpvjqxfasua
4 + - &dasJ age1lz3mvem0rgfxj7uavth8du4xsw23wp5ts77m5vvclxyj5mjxfujs0jgtcz
5 + - &mic92 age17n64ahe3wesh8l8lj0zylf4nljdmqn28hvqns2g7hgm9mdkhlsvsjuvkxz
6 + - &mic92-mac age1nnm255ah9wa4gpsaq0v023a75lnmlcxszt9lc6az3mtwzxgrucfq45rp7h
7 + - &nixos-foundation-macstadium-44911305-ofborg-org age1x608lllmu7gdfjnn6c8mvmmguft5f22fu7g38wv3ckmzqy2usq0q5u2ekx
8 + - &nixos-foundation-macstadium-44911362-ofborg-org age1d0u5ukkwsf47x4jv6uklcc4j3ljnmyz879syya2qneagz0t42cqqyf09dt
9 + - &nixos-foundation-macstadium-44911507-ofborg-org age1s0m24l3s29jr345uxk5j8zq7kd4sln3rvf0pdtd6afum3smtxsyqtjra0z
10 + - &nixos-foundation-macstadium-44911207-ofborg-org age1f6u77gvh94fk5fdh53lp04nk87cvjmwy2q3hjdlhd83mhlp0jg0s7rupux
11 + - &nixos-foundation-macstadium-44911104-ofborg-org age14gkxeqaehj2m38sesnc6fyd4c3hqjt7tqjz6q7lrult3uaahxcysdxt67n
12 +
13 +creation_rules:
14 + - path_regex: secrets/nixos-foundation-macstadium-44911305.yml
15 + key_groups:
16 + - age:
17 + - *nixos-foundation-macstadium-44911305-ofborg-org
18 + - *hexa
19 + - *simon
20 + - *dasJ
21 + - *mic92
22 + - *mic92-mac
23 + - path_regex: secrets/nixos-foundation-macstadium-44911362.yml
24 + key_groups:
25 + - age:
26 + - *nixos-foundation-macstadium-44911362-ofborg-org
27 + - *hexa
28 + - *simon
29 + - *dasJ
30 + - *mic92
31 + - *mic92-mac
32 + - path_regex: secrets/nixos-foundation-macstadium-44911507.yml
33 + key_groups:
34 + - age:
35 + - *nixos-foundation-macstadium-44911507-ofborg-org
36 + - *hexa
37 + - *simon
38 + - *dasJ
39 + - *mic92
40 + - *mic92-mac
41 + - path_regex: secrets/nixos-foundation-macstadium-44911207.yml
42 + key_groups:
43 + - age:
44 + - *nixos-foundation-macstadium-44911207-ofborg-org
45 + - *hexa
46 + - *simon
47 + - *dasJ
48 + - *mic92
49 + - *mic92-mac
50 + - path_regex: secrets/nixos-foundation-macstadium-44911104.yml
51 + key_groups:
52 + - age:
53 + - *nixos-foundation-macstadium-44911104-ofborg-org
54 + - *hexa
55 + - *simon
56 + - *dasJ
57 + - *mic92
58 + - *mic92-mac
macs/flake-module.nix
+56 -1
@@ -42,5 +42,60 @@
42 # M2 8C, 24G, 1TB (Oakhost)
43 eager-heisenberg = mkNixDarwin "eager-heisenberg" ./profiles/m2.large.nix;
44 kind-lumiere = mkNixDarwin "kind-lumiere" ./profiles/m2.large.nix;
45 - };
45 + }
46 + // inputs.nixpkgs.lib.listToAttrs (
47 + map
48 + (cfg: {
49 + name = cfg.hostname;
50 + value = inputs.darwin.lib.darwinSystem {
51 + system = "${cfg.system}-darwin";
52 +
53 + specialArgs = {
54 + inherit inputs;
55 + };
56 +
57 + modules = [
58 + ./ofborg-common.nix
59 + ./profiles/${cfg.profile or "ofborg-${cfg.system}"}.nix
60 + "${inputs.sops-nix}/modules/nix-darwin"
61 + { networking.hostName = cfg.hostname; }
62 + ];
63 + };
64 + })
65 + [
66 + # MacStadium ofborg builders
67 + {
68 + hostname = "nixos-foundation-macstadium-44911305";
69 + system = "x86_64";
70 + ip = "208.83.1.173";
71 + # 12 CPU cores, 32 GB RAM, 500 GB disk
72 + }
73 + {
74 + hostname = "nixos-foundation-macstadium-44911362";
75 + system = "x86_64";
76 + ip = "208.83.1.175";
77 + # 12 CPU cores, 32 GB RAM, 500 GB disk
78 + }
79 + {
80 + hostname = "nixos-foundation-macstadium-44911507";
81 + system = "x86_64";
82 + ip = "208.83.1.186";
83 + # 12 CPU cores, 32 GB RAM, 500 GB disk
84 + }
85 + {
86 + hostname = "nixos-foundation-macstadium-44911207";
87 + system = "aarch64";
88 + profile = "ofborg-m1";
89 + ip = "208.83.1.145";
90 + # 8 CPU cores, 16 GB RAM, 256 GB disk
91 + }
92 + {
93 + hostname = "nixos-foundation-macstadium-44911104";
94 + system = "aarch64";
95 + profile = "ofborg-m1";
96 + ip = "208.83.1.181";
97 + # 8 CPU cores, 16 GB RAM, 256 GB disk
98 + }
99 + ]
100 + );
101 }
macs/mac-exec
+6
@@ -9,6 +9,12 @@ HOSTS=(
9 "customer@eager-heisenberg.mac.nixos.org"
10 "customer@kind-lumiere.mac.nixos.org"
11 "root@norwegian-blue.mac.nixos.org"
12 + # ofborg (MacStadium)
13 + "root@mac01.ofborg.org"
14 + "root@mac02.ofborg.org"
15 + "root@mac03.ofborg.org"
16 + "root@mac04.ofborg.org"
17 + "root@mac05.ofborg.org"
18 )
19 PIDS=()
20
macs/mac-update
+6
@@ -17,5 +17,11 @@ update hetzner@sweeping-filly.mac.nixos.org
17 update customer@eager-heisenberg.mac.nixos.org
18 update customer@kind-lumiere.mac.nixos.org
19 update root@norwegian-blue.mac.nixos.org
20 +# ofborg (MacStadium)
21 +update root@mac01.ofborg.org
22 +update root@mac02.ofborg.org
23 +update root@mac03.ofborg.org
24 +update root@mac04.ofborg.org
25 +update root@mac05.ofborg.org
26
27 wait "${PIDS[@]}"
macs/ofborg-ca/client-nixos-foundation-macstadium-44911104.crt new
+12
@@ -0,0 +1,12 @@
1 +-----BEGIN CERTIFICATE-----
2 +MIIBrzCCAWGgAwIBAgIUW+L+r4Nl4TaYFRdwkVjhMNk2K7kwBQYDK2VwMEMxCzAJ
3 +BgNVBAYTAkRFMRQwEgYDVQQKDAtOaXhPUyBJbmZyYTEeMBwGA1UEAwwVaHlkcmEt
4 +cXVldWUtcnVubmVyLWNhMCAXDTI1MDgzMTE0MTA0OVoYDzIwNzUwODE5MTQxMDQ5
5 +WjBmMQswCQYDVQQGEwJERTEUMBIGA1UECgwLTml4T1MgSW5mcmExQTA/BgNVBAMM
6 +OGh5ZHJhLXF1ZXVlLWJ1aWxkZXItbml4b3MtZm91bmRhdGlvbi1tYWNzdGFkaXVt
7 +LTQ0OTExMTA0MCowBQYDK2VwAyEAwg81We0emvtttglMSqZALqqHPQGkpM3j21+z
8 +ikmyM/6jQjBAMB0GA1UdDgQWBBS5ahdd+XKK/AI8jN7fdXWo6oYn0zAfBgNVHSME
9 +GDAWgBTTBAboHFMq1jCXLC7IPRpWv/WviDAFBgMrZXADQQAG5KMpDZ9Od7v42Qcx
10 +jpmEu9sSUB0XMzN0XYkIwIgRDK7jEmG1CbX19Vco1eBiA+MW+JFCmJP7JBM1lHx3
11 ++BwO
12 +-----END CERTIFICATE-----
macs/ofborg-ca/client-nixos-foundation-macstadium-44911207.crt new
+12
@@ -0,0 +1,12 @@
1 +-----BEGIN CERTIFICATE-----
2 +MIIBrzCCAWGgAwIBAgIUW+L+r4Nl4TaYFRdwkVjhMNk2K7gwBQYDK2VwMEMxCzAJ
3 +BgNVBAYTAkRFMRQwEgYDVQQKDAtOaXhPUyBJbmZyYTEeMBwGA1UEAwwVaHlkcmEt
4 +cXVldWUtcnVubmVyLWNhMCAXDTI1MDgzMTE0MTA0OVoYDzIwNzUwODE5MTQxMDQ5
5 +WjBmMQswCQYDVQQGEwJERTEUMBIGA1UECgwLTml4T1MgSW5mcmExQTA/BgNVBAMM
6 +OGh5ZHJhLXF1ZXVlLWJ1aWxkZXItbml4b3MtZm91bmRhdGlvbi1tYWNzdGFkaXVt
7 +LTQ0OTExMjA3MCowBQYDK2VwAyEAeyeFq3u3hksc07IGBITcq0/go+iD4+DriPSb
8 +yAq+/nyjQjBAMB0GA1UdDgQWBBS/UHOeRtG8+xozoDTcYxcMpVYjzzAfBgNVHSME
9 +GDAWgBTTBAboHFMq1jCXLC7IPRpWv/WviDAFBgMrZXADQQCFQNs1ZiKpnY60MdFn
10 +H7NaQ7Jis0n665CjKWFKIEFdr2C+UZovnzSZYfl9UqxGjb3udfUK/6Z4Rqbf6cGH
11 +SRAP
12 +-----END CERTIFICATE-----
macs/ofborg-ca/client-nixos-foundation-macstadium-44911305.crt new
+12
@@ -0,0 +1,12 @@
1 +-----BEGIN CERTIFICATE-----
2 +MIIBrzCCAWGgAwIBAgIUW+L+r4Nl4TaYFRdwkVjhMNk2K7UwBQYDK2VwMEMxCzAJ
3 +BgNVBAYTAkRFMRQwEgYDVQQKDAtOaXhPUyBJbmZyYTEeMBwGA1UEAwwVaHlkcmEt
4 +cXVldWUtcnVubmVyLWNhMCAXDTI1MDgzMTE0MTA0OVoYDzIwNzUwODE5MTQxMDQ5
5 +WjBmMQswCQYDVQQGEwJERTEUMBIGA1UECgwLTml4T1MgSW5mcmExQTA/BgNVBAMM
6 +OGh5ZHJhLXF1ZXVlLWJ1aWxkZXItbml4b3MtZm91bmRhdGlvbi1tYWNzdGFkaXVt
7 +LTQ0OTExMzA1MCowBQYDK2VwAyEAQ6HvVxrDKl8JIAli/QNz8Ot4zcR9biiQOcQI
8 +mZLgekGjQjBAMB0GA1UdDgQWBBTTHQ/eJCYE8KTgVfhRq0RQThpONDAfBgNVHSME
9 +GDAWgBTTBAboHFMq1jCXLC7IPRpWv/WviDAFBgMrZXADQQDuIgw6XDf2Bpg2dFGz
10 +0GvVRlIDbv6paOdZDKhPqKuZIvXgYK6xtXJyYkODtPgkLjTkIufyX79o7zwtJATP
11 +oAwH
12 +-----END CERTIFICATE-----
macs/ofborg-ca/client-nixos-foundation-macstadium-44911362.crt new
+12
@@ -0,0 +1,12 @@
1 +-----BEGIN CERTIFICATE-----
2 +MIIBrzCCAWGgAwIBAgIUW+L+r4Nl4TaYFRdwkVjhMNk2K7YwBQYDK2VwMEMxCzAJ
3 +BgNVBAYTAkRFMRQwEgYDVQQKDAtOaXhPUyBJbmZyYTEeMBwGA1UEAwwVaHlkcmEt
4 +cXVldWUtcnVubmVyLWNhMCAXDTI1MDgzMTE0MTA0OVoYDzIwNzUwODE5MTQxMDQ5
5 +WjBmMQswCQYDVQQGEwJERTEUMBIGA1UECgwLTml4T1MgSW5mcmExQTA/BgNVBAMM
6 +OGh5ZHJhLXF1ZXVlLWJ1aWxkZXItbml4b3MtZm91bmRhdGlvbi1tYWNzdGFkaXVt
7 +LTQ0OTExMzYyMCowBQYDK2VwAyEA70JtJD1NetW22ggjqF6LY8plCNn4jpMJm1Aa
8 +I0JoImOjQjBAMB0GA1UdDgQWBBQEVVeckjstcg3RWqa7G884FbpnvzAfBgNVHSME
9 +GDAWgBTTBAboHFMq1jCXLC7IPRpWv/WviDAFBgMrZXADQQBcdGmZ0e69HfUN8E/1
10 +sQfFeaqwzX5jc3RhHnjViLP4OUcqWnYeqAT+ELwaucOdkMp47SgJIaUn12FEG+i/
11 +oC4C
12 +-----END CERTIFICATE-----
macs/ofborg-ca/client-nixos-foundation-macstadium-44911507.crt new
+12
@@ -0,0 +1,12 @@
1 +-----BEGIN CERTIFICATE-----
2 +MIIBrzCCAWGgAwIBAgIUW+L+r4Nl4TaYFRdwkVjhMNk2K7cwBQYDK2VwMEMxCzAJ
3 +BgNVBAYTAkRFMRQwEgYDVQQKDAtOaXhPUyBJbmZyYTEeMBwGA1UEAwwVaHlkcmEt
4 +cXVldWUtcnVubmVyLWNhMCAXDTI1MDgzMTE0MTA0OVoYDzIwNzUwODE5MTQxMDQ5
5 +WjBmMQswCQYDVQQGEwJERTEUMBIGA1UECgwLTml4T1MgSW5mcmExQTA/BgNVBAMM
6 +OGh5ZHJhLXF1ZXVlLWJ1aWxkZXItbml4b3MtZm91bmRhdGlvbi1tYWNzdGFkaXVt
7 +LTQ0OTExNTA3MCowBQYDK2VwAyEAy7uGuWSpwuj249gR5+4Z0U9fFcQNQYXB8cGM
8 +SaNAK7mjQjBAMB0GA1UdDgQWBBQQPGitG4ehKYgnAVlV3yO7DlglZjAfBgNVHSME
9 +GDAWgBTTBAboHFMq1jCXLC7IPRpWv/WviDAFBgMrZXADQQAitINnRMRBXE/eAl5Y
10 +04zfMZKBo1Q81v7j4KtrylRfo/qWyotdm/9erqqoIqwyRjoGn2Sr7eKNvs7oo8Hx
11 +3t0M
12 +-----END CERTIFICATE-----
macs/ofborg-common.nix new
+79
@@ -0,0 +1,79 @@
1 +{
2 + config,
3 + pkgs,
4 + lib,
5 + ...
6 +}:
7 +{
8 + imports = [
9 + ./ofborg.nix
10 + ./ofborg-queue-builder.nix
11 + ];
12 +
13 + environment.systemPackages = [
14 + config.nix.package
15 + pkgs.nix-top
16 + ];
17 +
18 + system.stateVersion = 5;
19 + ids.gids.nixbld = 30000;
20 +
21 + programs = {
22 + zsh = {
23 + enable = true;
24 + enableCompletion = false;
25 + };
26 + bash = {
27 + enable = true;
28 + completion.enable = true;
29 + };
30 + };
31 +
32 + nix = {
33 + settings = {
34 + extra-experimental-features = [
35 + "nix-command"
36 + "flakes"
37 + ];
38 + max-silent-time = 7200; # 2h
39 + timeout = 43200; # 12h
40 + };
41 + gc = {
42 + automatic = true;
43 + interval = {
44 + # hourly at the 15th minute
45 + Minute = 15;
46 + };
47 + # ensure up to 125G free space every hour
48 + options = "--max-freed $(df -k /nix/store | awk 'NR==2 {available=$4; required=125*1024*1024; to_free=required-available; printf \"%.0d\", to_free*1024}')";
49 + };
50 + };
51 +
52 + # Manage user for ofborg, this enables creating/deleting users
53 + # depending on what modules are enabled.
54 + users = {
55 + users.ofborg.home = "/private/var/lib/ofborg";
56 + users.root = {
57 + # bash doesn't export /run/current-system/sw/bin to $PATH,
58 + # which we need for nix-store
59 + shell = "/bin/zsh";
60 + # Not part of the infra team
61 + openssh.authorizedKeys.keys = (import ../keys.nix).ssh.groups.infra ++ [
62 + # Not part of the infra team
63 + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM35Bq87SBWrEcoDqrZFOXyAmV/PJrSSu3hl3TdVvo4C janne"
64 + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPK/3rYhlIzoPCsPK38PMdK1ivqPaJgUqWwRtmxdKZrO ✏️"
65 + ];
66 + };
67 + };
68 +
69 + system.activationScripts.postActivation.text = ''
70 + printf "disabling spotlight indexing... "
71 + mdutil -i off -d / &> /dev/null
72 + mdutil -E / &> /dev/null
73 + echo "ok"
74 + '';
75 +
76 + services.prometheus.exporters.node.enable = true;
77 + # https://github.com/LnL7/nix-darwin/issues/1256
78 + users.users._prometheus-node-exporter.home = lib.mkForce "/private/var/lib/prometheus-node-exporter";
79 +}
macs/ofborg-queue-builder.nix new
+28
@@ -0,0 +1,28 @@
1 +{
2 + config,
3 + inputs,
4 + ...
5 +}:
6 +
7 +{
8 + imports = [
9 + inputs.hydra-staging.darwinModules.builder
10 + ];
11 +
12 + services.hydra-queue-builder-dev = {
13 + enable = true;
14 + queueRunnerAddr = "https://queue-runner.staging-hydra.nixos.org";
15 + maxJobs = 2;
16 + mtls = {
17 + serverRootCaCertPath = ../non-critical-infra/hosts/staging-hydra/ca.crt;
18 + clientCertPath = "${./ofborg-ca/client-${config.networking.hostName}.crt}";
19 + clientKeyPath = config.sops.secrets."queue-runner-client.key".path;
20 + domainName = "queue-runner.staging-hydra.nixos.org";
21 + };
22 + };
23 +
24 + sops.secrets."queue-runner-client.key" = {
25 + owner = "hydra-queue-builder";
26 + sopsFile = ./secrets/${config.networking.hostName}.yml;
27 + };
28 +}
macs/ofborg.nix new
+29
@@ -0,0 +1,29 @@
1 +{
2 + config,
3 + inputs,
4 + pkgs,
5 + ...
6 +}:
7 +
8 +{
9 + imports = [
10 + ../non-critical-infra/modules/ofborg/ofborg-config.nix
11 + ];
12 +
13 + services.ofborg = {
14 + enable = true;
15 + package = pkgs.ofborg;
16 + configFile = "/etc/ofborg.json";
17 + };
18 +
19 + nixpkgs.overlays = [
20 + (_self: super: {
21 + ofborg = inputs.ofborg.packages.${super.stdenv.hostPlatform.system}.pkg;
22 + })
23 + ];
24 +
25 + sops.secrets."ofborg/builder-rabbitmq-password" = {
26 + owner = "ofborg";
27 + sopsFile = ./secrets/${config.networking.hostName}.yml;
28 + };
29 +}
macs/profiles/ofborg-m1.nix new
+8
@@ -0,0 +1,8 @@
1 +{
2 + # 8 Cores, 16 GB RAM, 256 GB Disk
3 + # split into 4 jobs with 2C/4G
4 + nix.settings = {
5 + cores = 2;
6 + max-jobs = 4;
7 + };
8 +}
macs/profiles/ofborg-x86_64.nix new
+8
@@ -0,0 +1,8 @@
1 +{
2 + # 12 Cores, 32GB RAM, 1 TB Disk
3 + # split into 4 jobs with 3C/8G
4 + nix.settings = {
5 + cores = 3;
6 + max-jobs = 4;
7 + };
8 +}
macs/secrets/nixos-foundation-macstadium-44911104.yml new
+63
@@ -0,0 +1,63 @@
1 +ofborg:
2 + builder-rabbitmq-password: ENC[AES256_GCM,data:TNzUCf83Bu6FxoXLbjWjcKGvPPJePRY6IGcPNfRKMPGcyShRyZC3Tw+fGfPXZCZjK08=,iv:mII0yPL75KlZ+t8+pCCE70pKVufXYO8C7ExGNLd0qfY=,tag:x0NLpX6KNBEjZzxumTs2QQ==,type:str]
3 +queue-runner-client.key: ENC[AES256_GCM,data:gpDEcEtSZARUHnv1cuH8NrmWOAMuxN/oTS5gxXBNUg4Y5RRttGnpu7SxTQtim5aD/yYDiw7W9gdQujSWNMTbqRPv4iwWwDjMecObPGbkRRd1vhSG3or2VItvahzvU3H7pl8B9UfOz8rYNz/4psV7OXD6yRksD/E=,iv:aWQG160Du+YMSstFibT1LlR/ttP4xZznDYhjNKGPnqY=,tag:OSvpvrXz3np8SuNmSWTIrw==,type:str]
4 +sops:
5 + age:
6 + - recipient: age14gkxeqaehj2m38sesnc6fyd4c3hqjt7tqjz6q7lrult3uaahxcysdxt67n
7 + enc: |
8 + -----BEGIN AGE ENCRYPTED FILE-----
9 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFT1FRa1p1WkxRQ1VwWCti
10 + MS9qZHdSMTdKajNwQmhGWlhxTVFTZDNxS1RrCkl3KytxTnBzYWtCeWtCSmZ3TG1o
11 + dThaNTRFUjNLWTFzelQ3L3R2Q29VNzQKLS0tIDM4dEZOZmxuSmVBNlVEenkzNTNh
12 + bU5JZkNoaEY4TjE1bFhxZTB0b1NkODQKp/7Pq3nHqqywVc6KyRaNgRJYS+kvCQ+2
13 + g7CjJxnRrAsf9zamKbJIBFPRjqwXX48GigVnly5s/lW2+nT3Gu4m5A==
14 + -----END AGE ENCRYPTED FILE-----
15 + - recipient: age1j3mkgedmeru63vwww6m44zfw09tg8yw6xdzstaq7ejfkvgcau40qwakm8x
16 + enc: |
17 + -----BEGIN AGE ENCRYPTED FILE-----
18 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4a3VpbmZiRnR5U3FSU0dO
19 + c1VaWWNVa3VRWXBFb28zaCtrb2MxMm04N0Z3CjdYSGRGa0RHWUlhVWZXcDBvRGVn
20 + K3Zaak43Z2tGR0FFVi9nN3BqMXpVQUEKLS0tIHBHTDdzTVRoU1VRdi9BUW1tWnRL
21 + ZjdvNFJVTlI0VmNXK3AwMlhIc2V3a1EKdTneIVCqt0b5wfGIar+A32pqezcn+J3r
22 + +rqhD7k5oW1gus7Fi9JI/fkLjJW1ak9S/kmOpwSNoYmC+EJrPepg8A==
23 + -----END AGE ENCRYPTED FILE-----
24 + - recipient: age17ez23w2kpxl0gcdx4ehcglkcfcfnv4qz0gq2n8ylxwx4yrtjpvjqxfasua
25 + enc: |
26 + -----BEGIN AGE ENCRYPTED FILE-----
27 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpaU5EakpaaGVCTitucDhz
28 + enowMUhyc1EzQ0dCcUtIRU1Bclk2T25ZbkJJCjlJQS81MlEyVnM3Q0xNWlczVXRB
29 + K05iOFdqNEc0dFdDblliRHVCbWtXZ28KLS0tIEhPR0lkeUtOMlNiMVZpcDlzcS91
30 + QXhGZmFPQzVrSlNwamJQUXNEWk1DOUEKpt/RBqQ/WJYtPM7/7hS0RdHtWFaCcrEP
31 + YWkaqPePY+jK85d/+0kW3CTGSefOJ119qKgG77l/kcQGtP6OsJKm6Q==
32 + -----END AGE ENCRYPTED FILE-----
33 + - recipient: age1lz3mvem0rgfxj7uavth8du4xsw23wp5ts77m5vvclxyj5mjxfujs0jgtcz
34 + enc: |
35 + -----BEGIN AGE ENCRYPTED FILE-----
36 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFeU1KNVF3VUtiYWNwQWt4
37 + ZHFzUi9PcFRpa1dOTjllZUczaGNUaXBDdGlBCkVkUDhvTTBnSDAyWmdmUndTVlla
38 + N0cwckwwVWE3Yys0amNCTTJUMmtBR0EKLS0tIFFUV0R3T2RDaENtalFpYWFDYm5O
39 + cEdZbjFYUXlrWmxXcSsyRVlrcmR2d1kKYld95q8VvDPDbtAFT6d58HT/q0nSYA0Q
40 + PRylkunDAXS+5HjPxECZNVcX85eHyr+mFI/ju6enMVLkXqH87R3WkQ==
41 + -----END AGE ENCRYPTED FILE-----
42 + - recipient: age1m68dw9dltvtsg8e9lf5ts2vwnn4ykraguhjr8v65s0xessk3xqeqyz5jwt
43 + enc: |
44 + -----BEGIN AGE ENCRYPTED FILE-----
45 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3WjQ1NzZEdU52OXBkK3kw
46 + TTI4am9OS1l4SC9meWpKYmZ6RTlzQkd4Tm1VCkYvUXFDOVJzazFsejNlZ3diTXZG
47 + ZE9VMnFkVm5SMWw0L3RSQVhjdG51Nk0KLS0tIHdRci9MS0dRcS9zTCtxSEVBdThk
48 + UFZlcGFaVm9ITE9NQSt2RGRsN0gwdWsKZMYNlfUgZUfYxxzUkPptVM25zbGRMT/7
49 + SVpwY5X1oZBfD4DjnTtTt99Ld8ayje7hfBH+H20AIRbCKTh/qmj7/g==
50 + -----END AGE ENCRYPTED FILE-----
51 + - recipient: age1nc9sh92wf62nt89k4vgyvqws2pt49cq6xqxx46jqpz4vqxsh5a4q8ltzp8
52 + enc: |
53 + -----BEGIN AGE ENCRYPTED FILE-----
54 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNM1FaQTVMKzRhVm5yaUlP
55 + cFhpa05vLy93dTZpakhiMGw0WWtYbjV5T2pnCjZ1NGJGd0FxQlhKOTF1bVkxMmE2
56 + MHlDRlpkeWdUZ0p2YXVVS1owbGdFYjQKLS0tIG5vV08rQ0xUbzVob3pibzdOOWFH
57 + UHh5aTJxejFIand6aVZwdHVxL2R6KzgKUO9lByaF3qwAK5V9gVEFOiTfTS14dYVt
58 + VqE2s5GjDI9hRCDeeDdzjdL3y4AYKlobk9JQmL5cD4IngtL0DkoAVg==
59 + -----END AGE ENCRYPTED FILE-----
60 + lastmodified: "2025-08-31T15:04:36Z"
61 + mac: ENC[AES256_GCM,data:TjaB9/dPyn475bNxqLjm0UBNYPG7/iIJOWK1UUJF/jQun1jSw5faMSiaLhlfexHF1gal+WCUGcFUyslXX90kAB+GD4G0YWdze7tmjTZCtMers+Xw/WWQ7OKzFsZIj3Z8HCvVOlYCqlGRZ7/cZkjC2N7vT1M6CXuH2S7U8MDhBn4=,iv:u+VjOO4ketXDMku6HCVW2VphWRF4XsHoTRfaHVmt6F0=,tag:N95UaNh7a88aU5cnl1tdDQ==,type:str]
62 + unencrypted_suffix: _unencrypted
63 + version: 3.10.2
macs/secrets/nixos-foundation-macstadium-44911207.yml new
+63
@@ -0,0 +1,63 @@
1 +ofborg:
2 + builder-rabbitmq-password: ENC[AES256_GCM,data:tK1jDNt1X3f/o9bJ0iFHLtxQa5z6V77ohmhnd82BDlpRZva2Y65vHuvSL9bRmVnGUvI=,iv:rHvNCmujJd3WK6mwx1heRBFgnLlokCvtOPD/BESUxkA=,tag:AWjfYJcLBiT5v8T7C2edPg==,type:str]
3 +queue-runner-client.key: ENC[AES256_GCM,data:B17aFR6BGeJaZXhmZr8WhKeu6VEbWTiKs+ZprwlJZkH2w9y6Ve5c4liLwpe9E0J1ELyhL0o3AnnTIo/42d9KpD9Cb+k4y6XAzj8UyPvQlMxN5+3ZKjpdkhEj/jFH3z/OXBgh7fEvrbjeNsAR67MCr7U8j02cPIo=,iv:fKx1Y4H/SCZQIW0bLP3gwHVx/ae1kPgZgUXtfMgNdT0=,tag:0Zlc1qHr7aUECHp9lK/vEw==,type:str]
4 +sops:
5 + age:
6 + - recipient: age1f6u77gvh94fk5fdh53lp04nk87cvjmwy2q3hjdlhd83mhlp0jg0s7rupux
7 + enc: |
8 + -----BEGIN AGE ENCRYPTED FILE-----
9 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCRW9XMXZxZlZPbW8ya0Ix
10 + Umt1RjFsTHdrQUx3M1YyUG1zb2pmeVRRcTFrClFNNEFVS1lrL0luUjZNaFp3VmJs
11 + cGxyMmN1N2gyMVRwU0VmbDVqLzNNS28KLS0tIGUxeE1RQmlSMTVKY2hVUVFsbnhV
12 + YytLL1hVTFJZZWlKaCs0a2J4RXE0N1EK5u7iNulm1XDEdbwtbtIQz71/DYiE4f1A
13 + 0KteNJQvG61ko07U/Zoxap4Vgxrvxos3pbWy2VcAbL3r35KgBzzO3A==
14 + -----END AGE ENCRYPTED FILE-----
15 + - recipient: age1j3mkgedmeru63vwww6m44zfw09tg8yw6xdzstaq7ejfkvgcau40qwakm8x
16 + enc: |
17 + -----BEGIN AGE ENCRYPTED FILE-----
18 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2aE92MXZjb3A0b0VtSG9o
19 + WUNwcEpFYzJCdE1BQU9xSzh6Q1o2TEF1L1RVCmg0enVlOUsydGh2dXdmbkQrblZo
20 + M1JQOFpEbGNoTXRuQ2pWaHAyQ2twUkEKLS0tIHhERUdwdUEvQXBIS2V0YThnU0di
21 + L2lrVDBwTjhHSFljZys4cXJLMks1ZmsK7PvI+nD3dvzFzj2WdUVZWRWeaBS5nKRE
22 + scE2HzwrvRPyfYxLgTnm0gQB24akX6B75YP1MpIZpJ+Mhao83iJpSw==
23 + -----END AGE ENCRYPTED FILE-----
24 + - recipient: age17ez23w2kpxl0gcdx4ehcglkcfcfnv4qz0gq2n8ylxwx4yrtjpvjqxfasua
25 + enc: |
26 + -----BEGIN AGE ENCRYPTED FILE-----
27 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtd3o3S01DWllwQVpJRTBV
28 + VnFvUHc5eEdEcjlvbHZFK29PdndqaVRqb1VRCklyMWpCc0RXelNiUU9aeStqbWZj
29 + YktienMyL2x1ZFJ1WGhGZWwvVmpTTkkKLS0tIHVrK3RkQUxPaHdNanh5Sy9XMWhO
30 + SGxsb1RrakR1WFlZM2tXUHJwK1FVeWcKbm1qMcVGjCzVWPtoo0WUy7cfjxGK8JQm
31 + ckNGQQVgXjaWKO15qRgcqWnmCLDckv/dwsBIuBrwwN+B0uFOaWsnKg==
32 + -----END AGE ENCRYPTED FILE-----
33 + - recipient: age1lz3mvem0rgfxj7uavth8du4xsw23wp5ts77m5vvclxyj5mjxfujs0jgtcz
34 + enc: |
35 + -----BEGIN AGE ENCRYPTED FILE-----
36 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTQlhUZ1lIRkQrTXU4Umxq
37 + Wi9pZmdZV1NzaXFNZGhuT08vY3dBUE1CTFNvCnloZllOZ3ViMjNOQTQvTGY0emU2
38 + MWpQZ1ZoZTJwZUhsSHF1TDQvSHV0R2MKLS0tIGFUMXNRMnprRmlqYm1qSVhLSExn
39 + WDJLRzRGMHJhYUIzRGptVnlRVTJxT28KOXZoTt5hAplGcQVXcOii6kgqf6iHMrPi
40 + wURFQPnTHZRrnqENltVG0cQufzToYyHd4rlm9ewgzES2/nBq96oB+A==
41 + -----END AGE ENCRYPTED FILE-----
42 + - recipient: age1m68dw9dltvtsg8e9lf5ts2vwnn4ykraguhjr8v65s0xessk3xqeqyz5jwt
43 + enc: |
44 + -----BEGIN AGE ENCRYPTED FILE-----
45 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2S0p6RE53UTdmVTdLbjBT
46 + TzVicXovdmlHUFJhczFQMkFGdE1VSWpFMVJVCmx4SkJPOFNLZjFycFZWYlB5WXpy
47 + RmhtajhJMkJidVFabGRMakl4bkEvOFkKLS0tIFRLOCtzRnRQM1FEelAyZ0xCbVN2
48 + SkdYT3NycktzWDU0R2xLeGVtaEhqUnMKiWA/CPYZrhrgKMtOYWS38+cBmgoPQ8o/
49 + 7qvXqciFPr3TCxTidPG42VViQT6SzD2ursZx02h167Z0GA6+0p0Elg==
50 + -----END AGE ENCRYPTED FILE-----
51 + - recipient: age1nc9sh92wf62nt89k4vgyvqws2pt49cq6xqxx46jqpz4vqxsh5a4q8ltzp8
52 + enc: |
53 + -----BEGIN AGE ENCRYPTED FILE-----
54 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxNUZKUnNWWjZva1dRR21h
55 + TTZPVyt6cjdsbkFQbVhhNFlveHp6WTFhWHhNCkZLeXkzeFhMZWFhVFNiSm13Z0hJ
56 + WTIwRDdWV1JnSVlQNTl3TENsZktld00KLS0tIERrTXpsTXZyQWtVam1FMUdDYWJK
57 + VnRRT1ZHeHVZOCtBb0p4MkNXQjhzbWMK+WLYiDuhpOHTpHFjmdMGipmxtiTh/6ls
58 + lzC8CEN2682xNxYkAVnyqLHKFR5lEDHpDoDwvNk0jTn8Fj3d4odCZw==
59 + -----END AGE ENCRYPTED FILE-----
60 + lastmodified: "2025-08-31T15:04:59Z"
61 + mac: ENC[AES256_GCM,data:yE2/xv0LltDZBaD2gI3I+L09cG8/czVgXGDdDZt12dAzzsMsY3CKlss/3K4zD/G1p2Afdp85ZNzxbbUvcpShT35L/XWAviLrP6PqV1YYAromFb03G4nBpOyOlpXWmjPP7JBo2oGK1yg5hjMwomLd7vb2OaBtXQ0EZ2X+i4vmC68=,iv:YTiZDnLON9nS63vGYj3w+Dsw4CCsd/C31B9A/EhQeTc=,tag:zGZ997oabhCg0PqRa+J9WA==,type:str]
62 + unencrypted_suffix: _unencrypted
63 + version: 3.10.2
macs/secrets/nixos-foundation-macstadium-44911305.yml new
+63
@@ -0,0 +1,63 @@
1 +ofborg:
2 + builder-rabbitmq-password: ENC[AES256_GCM,data:LopQz4a7gvobT1l6DvWmyCK1oOzBeYUbZobS5akNAwCsR+TtpkyskNwXUHryyPB92ag=,iv:dFxyhuDgQg7JWtpIIAc0PthhCzEfgY/D3HAzS0l9euA=,tag:mJOAr44Ax1TdA3t/gTzyhQ==,type:str]
3 +queue-runner-client.key: ENC[AES256_GCM,data:SzIMMeauP8SjTXYob9WL+ARUMZh89luhlt5vQoyrQwqoCPUV7Nw+9t7uRxBuDmGAPWxCw/rt0faYRc+6GdqKDIuK+hiiGcjGTWFiakxCSS0jcewtDv+iaxr7ZqJVtmiz788yZvg+3DQ1jPZUTBmxd+Hl2scfb8k=,iv:tFRD6oP4x54WqDazJTC7TeG87MDXwvJtutqoj4IE9LM=,tag:k2ICj2TdWbZ6gT93vAjOTA==,type:str]
4 +sops:
5 + age:
6 + - recipient: age1x608lllmu7gdfjnn6c8mvmmguft5f22fu7g38wv3ckmzqy2usq0q5u2ekx
7 + enc: |
8 + -----BEGIN AGE ENCRYPTED FILE-----
9 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkT01WTjNVM2RZQ2hCdm5B
10 + djMzaTRwZjFYbUJnVnhCRTBKbXJlblM3ZkdRCnVnbXREZVExakdaZk1TaitLcU9Z
11 + V05wcjZJRGdDSlA1WDdPbGY2RXBFY1EKLS0tIE1kbmQ3OXFZdHp0bjlEUldYTE1s
12 + VFdQK1hoTXZDRU1TV1dkMi9mUXVqZncKe9iTJkHCmfzGen+hm8F0FHIq0OW3UyAX
13 + eGz9UAwPDH7Y6N/gCpB0ZzMvDljQxYdM7sVtrumq7lAXEoirsqAZMQ==
14 + -----END AGE ENCRYPTED FILE-----
15 + - recipient: age1j3mkgedmeru63vwww6m44zfw09tg8yw6xdzstaq7ejfkvgcau40qwakm8x
16 + enc: |
17 + -----BEGIN AGE ENCRYPTED FILE-----
18 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGZHVMcDV0MnlyaE9VSzBk
19 + WTBIeWZKNFpTTWltRjFYZU9KWVBUOHVRamcwCllMdWpRYVZFKzY4TUI4cWRaNW8r
20 + TTJLai9rbUhFR3d0cEFNVHEvM3c2eEUKLS0tIExaT1NOVDhBTHlRendUNnBhU2dn
21 + dkpzbjB3MGh1bk9qNnEwc0hhYTNKa00KQdxuzlXDnfUyw1ipjNz0rNVJ5kIbO/ya
22 + oGebUaxTphLG4QFq3vw5N4AeXBcbUcfX3hjUKYiM7HYSBz7CyxckVw==
23 + -----END AGE ENCRYPTED FILE-----
24 + - recipient: age17ez23w2kpxl0gcdx4ehcglkcfcfnv4qz0gq2n8ylxwx4yrtjpvjqxfasua
25 + enc: |
26 + -----BEGIN AGE ENCRYPTED FILE-----
27 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvYVVpNFNIbjZ4L0MwQUc0
28 + NHIxS3NvYTJLTUU4K0lxenRkaUZ0VWk1NkFBCm9wWDdOTjVMYk54dnRrbHdzUUFN
29 + VFFZYmM1YW1CcVpwbm1uNnNYaEk4YUEKLS0tIEZQYU9iSlhLZWl1Rk80aEtCVEpR
30 + UjRIR2ZPOGxKMzZoOVp5TXdHNExWZ3cKY6CWwoeEBLT8H7b0TVhQtxW0H9P/pKAn
31 + OKqS4U2g+bTwQRCJ8h7b/eTdJM3lAXqxkLz/A6kBcFCKj0oZqIeiPw==
32 + -----END AGE ENCRYPTED FILE-----
33 + - recipient: age1lz3mvem0rgfxj7uavth8du4xsw23wp5ts77m5vvclxyj5mjxfujs0jgtcz
34 + enc: |
35 + -----BEGIN AGE ENCRYPTED FILE-----
36 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRSlJKMUtaTFRqNFhkbnVD
37 + Y3hURnJwTU5zb3cwTW5yUUdqbk1NSGlkN0M4Cml3aWFGNSt0Z01MZU9DT2RKaU04
38 + Ukx0MXQ1cXMyL29EaUNHZTVhRDdKM2MKLS0tIE9DRG5ZRWNXNHRCRmUwUDRVMnc0
39 + VFRVODRGTzRCWkl0cHgyTFArU3h3ZkkKpRRtPMl3VDgEBUDYrm9pShCEF99kPdQh
40 + 6dS32a/FK/OP0qXaQyCLZ6JlBwutu2fy/ohyfQ6TVaskLfwidQxvyg==
41 + -----END AGE ENCRYPTED FILE-----
42 + - recipient: age1m68dw9dltvtsg8e9lf5ts2vwnn4ykraguhjr8v65s0xessk3xqeqyz5jwt
43 + enc: |
44 + -----BEGIN AGE ENCRYPTED FILE-----
45 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3dnZOK2hsZDg1RGlwRkYy
46 + ZUNKb2p0YW8ySzJ1cjBrbmVGR3ZueEdlYVZRCkhrQmxHSVBMRzdpUkZjYk14bURl
47 + V0U3bzBsRUFiSmUwU0NFaFRBakZTR2sKLS0tIHNwVzRnZXN6VVdnMXg1Zm5jM0hU
48 + Q0hDbmlEM1pheHNyYTlLOTNHM3A0cmMKvMQrYkuHbaZkRNuN0gJKojFn112yOWlV
49 + ZsC7+A6jcYFJBPtO3k3Y+XeUa5WD/TuBt7Pa+oiGZ2gx1/igVPzH8A==
50 + -----END AGE ENCRYPTED FILE-----
51 + - recipient: age1nc9sh92wf62nt89k4vgyvqws2pt49cq6xqxx46jqpz4vqxsh5a4q8ltzp8
52 + enc: |
53 + -----BEGIN AGE ENCRYPTED FILE-----
54 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOem9jZCtSVnYweVNoWklj
55 + dzF3RzQ1UFpXcmJYUEtwbHJEeGJsVm1kNEdBCkZaUHhqTnRnR0UwMjVCWW5WWlY4
56 + VzZTUjhhUlpuZUdXUGZJd1NVb3FZRzAKLS0tIFhoRkpta1hnQ0xFR1NMU1hFdmR2
57 + c0gwRXk0Yk5zZUk2aDNaVjJQaXZXYlEKB/82tEb40KykfgZ58gux0CMtxRbz4hst
58 + Av6Jx/hjpl7HLKrlz7x9M868iZMWvIYBb/O0CecS3X/P4p+l8rzyow==
59 + -----END AGE ENCRYPTED FILE-----
60 + lastmodified: "2025-08-31T15:05:41Z"
61 + mac: ENC[AES256_GCM,data:NfkyYoZXDQKrPLKEn9cD3wydkoW7DA4i9QE+9/SaUuiR2hHYip9pS1LXxgpzIr2EL3WPR61NdcEMc4+p1IDykbsmh+MqkwuOf4bgwboJJKtlk7R+/bH5OTLVrM8jUcgwW94z/63whRKvqZV4lf6tSWEouzt8YB3ukWAMKUx9DqQ=,iv:g8iPucegVJ2aYOZkYHDvh7OExJ8Vwdveq7v1TNUf4tk=,tag:t1qy7CvUAPkfF3ZOXpRs7Q==,type:str]
62 + unencrypted_suffix: _unencrypted
63 + version: 3.10.2
macs/secrets/nixos-foundation-macstadium-44911362.yml new
+63
@@ -0,0 +1,63 @@
1 +ofborg:
2 + builder-rabbitmq-password: ENC[AES256_GCM,data:YvpvZfSJcVx1iPBi6am3QXAeW70D4DSkHO/kf+eOpK9o+9dSjUg/FGcxc36Z7uV4AFo=,iv:tgFmPSvnB7Z4l1Mllef1G8Fiy02FacvtWLdh5CmTyfY=,tag:Llvp+9x2l+G/PT15AE/WWA==,type:str]
3 +queue-runner-client.key: ENC[AES256_GCM,data:nlR533Docz60HEU0ooGtK3pwcEevnhDUmsRR5TJvd8lMPvCS733B++UptjsFOD3qWXt1HRJJBzscJHwIfwfXDmXPv3XCY3QG83g6dfKMhMF1QyqBYuKKmMBUkhua53GJqYRcogdhj5Uc4cbC2L3qSyXBG3NAuqE=,iv:K+SgPkL1QiFvmB4eMR01x/zjM6U5zyDncntdZbhAJnI=,tag:3XDV6eYkl8GOPaIIXeyG9Q==,type:str]
4 +sops:
5 + age:
6 + - recipient: age1d0u5ukkwsf47x4jv6uklcc4j3ljnmyz879syya2qneagz0t42cqqyf09dt
7 + enc: |
8 + -----BEGIN AGE ENCRYPTED FILE-----
9 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwWGRHeFVGYUZ2YWxiYW9Z
10 + OGpSQ2VteExwZm4wMXVvMVdMc3N6VVpUNzJRCmNNUmVqcTJhbUFrU1h4WnNOSUQ4
11 + dWFDRzg3NG55c0xXQk93bVlRUjdJclkKLS0tIGdvWUFTSkxCZTlJTnI0YzJEeXRF
12 + ZUNIYXQvUGlqRWpGMHVtN0hxTHJwbEUKsXuzBa7u15cM/DrIeQ2gfXwUktovxGjB
13 + 6V6yPZbeA5v7yA+0GG89UH67tmArh/mF0l2z/UJRZDgw7Z+Gh0RGHQ==
14 + -----END AGE ENCRYPTED FILE-----
15 + - recipient: age1j3mkgedmeru63vwww6m44zfw09tg8yw6xdzstaq7ejfkvgcau40qwakm8x
16 + enc: |
17 + -----BEGIN AGE ENCRYPTED FILE-----
18 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYUWs4VFFIM05XM0txd0cv
19 + YTV4RHZ3Tjl4TXptdVpyUVkvaHFjU1V5TTAwClVWclZEKytaSTJrcUhoaXBUekd1
20 + V2xaYUZUcmFseHNPb1ZJYXM0Q0ZkM1UKLS0tIE9tcVJkRmJLUnlybTlhK243NXB6
21 + Sk5QcVVaejB6TDFtV0pDVUpkRGNkMUUKF8sEATa7mRbeti4WJFXVYiiAryPSO3Gw
22 + ViIhsYVg7M4t8/11AJZ2edJayTWaSrPwMxPWLrc3A2w7pRDtK1LoAw==
23 + -----END AGE ENCRYPTED FILE-----
24 + - recipient: age17ez23w2kpxl0gcdx4ehcglkcfcfnv4qz0gq2n8ylxwx4yrtjpvjqxfasua
25 + enc: |
26 + -----BEGIN AGE ENCRYPTED FILE-----
27 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNaHJqcmtzSEQvQTdzZFNG
28 + b2pLSXBwa2UrRU9NZnlySmkyc0crRnVFRlRBCnl4VFNLRnIwTnJjZ2NoZkJvdXJ1
29 + ZGJEbitra0o4WmJaeG9aaFkzdTZIUUEKLS0tIHhMOE0vaS9IWFBvcFpKYytrVkpj
30 + TU1LcWJIZGhKOHhjVmczTEZiREhaT28KPFIui3jqceI8SNqSGhvC4XFmsq3vbiPp
31 + fr44yKqTaWdHBgX4wXHuyp1FYCpunCfDDw2aYfN3rSlhey3+5ky0ng==
32 + -----END AGE ENCRYPTED FILE-----
33 + - recipient: age1lz3mvem0rgfxj7uavth8du4xsw23wp5ts77m5vvclxyj5mjxfujs0jgtcz
34 + enc: |
35 + -----BEGIN AGE ENCRYPTED FILE-----
36 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1N1piTmhrbWVTR3RvbnZa
37 + Q2FlRUtzM1FWZ203a2QzTk8zSEYxc05BWEE0CllQbEZTeDRnVXh3cmpPRUpIVTRM
38 + YW9lTTV1YzFVdjg5anBxTWVObC9wbHMKLS0tIFZ3ZGhpV0ZPNG9GTDJadEpLY3Jw
39 + b0V1NFo2ZUR5SmJyOTRHUGVON2M3dWcKa1BUdWY9/Xtvk56ZonN7X6jfZHzYwTE/
40 + xgtcuRPJF05vuN/n/uCKu9OtU/Lb0A5m9OaN9JQE3kdzeyHoe9Ic8A==
41 + -----END AGE ENCRYPTED FILE-----
42 + - recipient: age1m68dw9dltvtsg8e9lf5ts2vwnn4ykraguhjr8v65s0xessk3xqeqyz5jwt
43 + enc: |
44 + -----BEGIN AGE ENCRYPTED FILE-----
45 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDRjJSM3lWNGJXdmM3a1Ew
46 + K004cjNocFlwQUpmTU96aWpnMDJjMEowS0RFCm1Wc0gzZVo0alJxcU9DNW5BOXdO
47 + eFZZSzRjNHRtUGV5YytwZUVuNlVZN2cKLS0tIFhWRjk0Z0N6MG1KaVp5ZjF2a21i
48 + V2dNWUwvYTJzcUZWMEkxZkRGMHcrZFUKCwMWyULhYFDBstatQh4CSZrZ0/4gwthW
49 + iYOML3bf12sZf1wFfM+199XXkkFZHHYzazhVX+3578w6cz/wAt65Lg==
50 + -----END AGE ENCRYPTED FILE-----
51 + - recipient: age1nc9sh92wf62nt89k4vgyvqws2pt49cq6xqxx46jqpz4vqxsh5a4q8ltzp8
52 + enc: |
53 + -----BEGIN AGE ENCRYPTED FILE-----
54 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2NTh1WEZXZmtBMTdRRmxO
55 + T0NGb3VMZHRubm5BSDNUSmY5cVA5cHRrS25rCjV5NXJ2TnZIcld2ME1lV29wMnZI
56 + ZWlydVNZZ2t5M2VqZE1xYTlsVDQzSmcKLS0tIEJGYlFFY2F1OGc2SU55VStpVG1S
57 + ZHNtUVovMzZMdTFHeXphUnhCME56VHMKIfn3CmtPWcawLneAxooUXPfvFe8M6avH
58 + 93pyl50ghHLZrbipjLAu7G2wtUTlFuiMY0vG8+jRQJHgq7FkHtdalQ==
59 + -----END AGE ENCRYPTED FILE-----
60 + lastmodified: "2025-08-31T15:06:03Z"
61 + mac: ENC[AES256_GCM,data:G/a4GqIpj4zKdH/zDik4hr3LIDtJwJTK8HafONRItAZoETo0gy7bqBymOKn3eaWaJW2PP81dQnv6liDQh5GUuo51Th2K3dWrfORwL3IldLebZO4MNhDufnld3uFJyvSm/JOvV2shfH7SAN0Z4BNeoerwAndsvatcHLY2ce1C9js=,iv:pSJhRWllJCqx7nOBpDbMKut8XEnwYWo1l8yUFUvbI54=,tag:/fq1krHM2ip0LFvfHG4v0A==,type:str]
62 + unencrypted_suffix: _unencrypted
63 + version: 3.10.2
macs/secrets/nixos-foundation-macstadium-44911507.yml new
+63
@@ -0,0 +1,63 @@
1 +ofborg:
2 + builder-rabbitmq-password: ENC[AES256_GCM,data:YmvZ+UwoKtY81wrzr0oSoRGFVDcWqp8WkSApWd5n5/mQr7vGLQA0ZvpGsf1G+nNzE+g=,iv:ebCwaYy120OPQ5zXLxVLk4vD5+wiSfB0G7TT24822YY=,tag:ACldOsS2mterk/5a7ThuoQ==,type:str]
3 +queue-runner-client.key: ENC[AES256_GCM,data:EhZa2bSybMbMCPGGoFeBSvVREyMQTE8odlHgjl0lxxjYgFBmLjhlsmYfv2/q68Mv+oxww5Cv2czL78B7OIX9fJShJwCuGvSnOzMYeSrr0P/8Afh/whUP44IdeXgMasHrD9v2KDSgeUTMQ1oo9663GkLTkblMJ5o=,iv:lSSCNiY7hc2Dh+LUxaGQTWOkxXIvPBAMV3k95lXvCjo=,tag:/7Zp5Bw6Ld2CB7jvUlUixg==,type:str]
4 +sops:
5 + age:
6 + - recipient: age1s0m24l3s29jr345uxk5j8zq7kd4sln3rvf0pdtd6afum3smtxsyqtjra0z
7 + enc: |
8 + -----BEGIN AGE ENCRYPTED FILE-----
9 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3TTBaN2w0TDVhUHBCL1Yy
10 + cjF3L0NTYjE0VXJGTTBVcWlMSm9mOU1wNEJRCmhNaERJL2FXZ3d6dmtpSFB5YVJu
11 + T3A2MGd4N1B3SVE1Wmc1MHQ1cHhPZWMKLS0tIHJFNkE5U0Z3ZHJTNTZLVUtWVGpW
12 + OUZRTlhKYzN5OGxFYWRJS29RQUdxTk0Ky8T3HuBXIYDqb4PnU3wxil2tT3a9R8zt
13 + HEyPA/BU9ujZrvSWf9NLylCqtID5ZADvycJfm6dsJUUAs1Fq6XSy9w==
14 + -----END AGE ENCRYPTED FILE-----
15 + - recipient: age1j3mkgedmeru63vwww6m44zfw09tg8yw6xdzstaq7ejfkvgcau40qwakm8x
16 + enc: |
17 + -----BEGIN AGE ENCRYPTED FILE-----
18 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwZVdJSnlGZkNtV0hMYXkx
19 + Qjc1dzVHNGRudXdmYVc2VEwvTG5SZUdncEg4ClBTWEhrNXBmbGVGMHk0T2toTHQr
20 + UnBSUlJBei9yTGVLR1VHK2xzSVptNWcKLS0tIEFoU3JzR0I2a1ozdFRIQjYwUzVm
21 + c1hLaTZSMGs5ZjE5L1RCdjhoNDNCUjQKG2mt7WyXwngUmA7SN9DBgJjAsOOyB4+M
22 + OV60D/bjcYrSMRjNI0T8cZopD2N5/Mste0VtvfOk78doZICfTM0p2g==
23 + -----END AGE ENCRYPTED FILE-----
24 + - recipient: age17ez23w2kpxl0gcdx4ehcglkcfcfnv4qz0gq2n8ylxwx4yrtjpvjqxfasua
25 + enc: |
26 + -----BEGIN AGE ENCRYPTED FILE-----
27 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGcUNIOVdwa2VCTHhGeUpy
28 + eXg0a2craDRLazB2b2VPZUFVeDhrYTZYWnlrClpUUHd4UE8rU3dEdlBRaHFrdWRi
29 + NGszWmhOYms1Znk1bnZoNlAvMGVwMzAKLS0tIHM3RDhUS0JjaHRmNEZhaFJhM1lt
30 + NzZJaDh0WUpJV29JZm42Q3liZzAwWTgKKKAIunuTHChBMcg76Eu2XHDOQawIVgsq
31 + T98joVBVz2CAFMjbyYmE4uMvvA47KmUnhnlUzvaVfB28YzzuSH2elg==
32 + -----END AGE ENCRYPTED FILE-----
33 + - recipient: age1lz3mvem0rgfxj7uavth8du4xsw23wp5ts77m5vvclxyj5mjxfujs0jgtcz
34 + enc: |
35 + -----BEGIN AGE ENCRYPTED FILE-----
36 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKbXBXMkxmaU1ISWRWamZu
37 + d0FEaVFQc1c0NTQ3REhnMnVIeHhLK1lZSlJjCjRpeVA4Qk1qM0Zha1pMblN1NVQr
38 + VnNKeXcrVnlENmdNTGU5bTZ4Sk1CQkEKLS0tIDdCck5jS0FaYUEreDhCaHBFenJ2
39 + WUxmdEZ0czlHTk1IS0ZrQ05MdjE4N2cKmVsm5M1zp7VaKAih4keKhredjAraHmYw
40 + yjcYrr3+bLxvQhaY4JLtw39SWrpKVEouAlVl6moQyGIr6l3KPkTDdw==
41 + -----END AGE ENCRYPTED FILE-----
42 + - recipient: age1m68dw9dltvtsg8e9lf5ts2vwnn4ykraguhjr8v65s0xessk3xqeqyz5jwt
43 + enc: |
44 + -----BEGIN AGE ENCRYPTED FILE-----
45 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5M01ibnk0SzdLWjUvQUFn
46 + aERQRnJYeENrSmFVY2JCUFJqQUZIOHUwazF3Ck5aSXB4aFpna3haUUY1UGgrQzRT
47 + b0V1Y2JPb05EblBlcDZiVHlJNDJlN2MKLS0tICtmNHlVRXdmUmIxTmMvdHIzLys0
48 + dzV1SzJBUkwzbVFuU0lWNHQ4ZmVRaDAK0gMG0Uz7+9QHXIestCAK/z+AQFnXGzzM
49 + FZz4o62gWsI/DsB0c67DAQn3ghsZ1rDJa3Vge86BSgCoG61jGbEw2w==
50 + -----END AGE ENCRYPTED FILE-----
51 + - recipient: age1nc9sh92wf62nt89k4vgyvqws2pt49cq6xqxx46jqpz4vqxsh5a4q8ltzp8
52 + enc: |
53 + -----BEGIN AGE ENCRYPTED FILE-----
54 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFMEczci9RUXNOWHUrQUVV
55 + aXkxSW5aaHhHZzQzbWlkTE82bGRKQ0ZrdVhJCk9Xa3kraGNsM1hCeHFOcEgyVU9Z
56 + cHk5K0FDWnhURHVLZDdSREhTZ3J3L2sKLS0tIFNwVFRneDhQNUdKNjlCRzZpV2Ey
57 + WmJIL21zMU1qazVPc09OREN3b2JRU1EK6ioB1V81JncWBbO+pkqWSKYMJTxn8ykV
58 + 7mAX6NxFxlxrbQmlp4wz8HESNvkUIKGKuU3Dd8FegP4VUze9IoPVfw==
59 + -----END AGE ENCRYPTED FILE-----
60 + lastmodified: "2025-08-31T15:06:26Z"
61 + mac: ENC[AES256_GCM,data:Ed4lAjLxiAx8Qqoy4XfXJdtl8ypjCucipaDYgdnwaAd7dZEh3n8ba6Nktgqkkk8N++rO72K3zGZlFCKtc/oHK/oiUMnTG47KEJ47XcbrEspijGB0uu4n1YgRbiKGhgOTqgHzwcGym8Reg3/jYk83Wq3KTTDJWjiW7rJf2TzYmr8=,iv:FB43RPLaNhi6f8gk6amlKbsVe9S1NUoVy1j53lidQEE=,tag:9NVRbzFeqpA5sOpWr+0foA==,type:str]
62 + unencrypted_suffix: _unencrypted
63 + version: 3.10.2
non-critical-infra/.sops.yaml
+118
@@ -9,6 +9,19 @@ keys:
9 - &mic92 age17n64ahe3wesh8l8lj0zylf4nljdmqn28hvqns2g7hgm9mdkhlsvsjuvkxz
10 - &mic92-mac age1nnm255ah9wa4gpsaq0v023a75lnmlcxszt9lc6az3mtwzxgrucfq45rp7h
11 - &Ericson2314 age1fgzf77gyah4efemnrqg4e7j0vk8fpq0uzrucepmdpsd5z7l4lgpsfq54df
12 + # ofborg admins
13 + - &dasJ age1lz3mvem0rgfxj7uavth8du4xsw23wp5ts77m5vvclxyj5mjxfujs0jgtcz
14 + # ofborg hosts
15 + - &core01-ofborg-org age1rrrj8tgcyp9xfxvy6zmk9487x62cgx0z68l7jretz2th6ey9nf4qh7nq7h
16 + - &eval01-ofborg-org age16d0phf8c5wy3rfsd4pgc42mqa3aw2llfukdhgu7pzklnzjr2rvxsusz842
17 + - &eval02-ofborg-org age1qn3q3y04pxumygmq96x0gk9qtrdcgdw4y5nl6xd780u4avk0qgsqy8tuu0
18 + - &eval03-ofborg-org age1yssfznyq8rljcpfthpulnvfls0l5t36fpqxkk5taxcwpkqhv9gcqrvvwh7
19 + - &eval04-ofborg-org age1vunut833rrdfulgnsjqtuke4yjtzexn2xqjqavwzxlgrg7n4y45qhurzwc
20 + - &build01-ofborg-org age1ulnex45wt7fpj92jy9c5del3ccz6mmnqptrsva24k8m7qsez9pcsdu3eae
21 + - &build02-ofborg-org age1wrp04f5c0d4jx3hwjsn8cyxdjzpzx6fl202zftqfvfdt7hx8efgskf6s86
22 + - &build03-ofborg-org age1n0yrvl2v397kztuhf00cdvrhf26c9uegwz6day8z9pyqj3zff4sq6ha0lm
23 + - &build04-ofborg-org age1l7xmxkh6y6d5svj06txknamlwdpfwac8855p3edgpu6jcqea7pvslw4r9a
24 + - &build05-ofborg-org age1mduqldqpqp33u2wwh685cwwkpj2ak36z67dtrq2tcskgqkultvps7w9q7u
25
26 creation_rules:
27 - path_regex: secrets/[^/]+.caliban
@@ -45,3 +58,108 @@ creation_rules:
58 - *hexa
59 - *simon
60 - *Ericson2314
61 +
62 + # ofborg
63 + - path_regex: secrets/[^/]+.core01.ofborg.org.yml
64 + key_groups:
65 + - age:
66 + - *core01-ofborg-org
67 + - *hexa
68 + - *simon
69 + - *dasJ
70 + - *mic92
71 + - *mic92-mac
72 + - path_regex: secrets/github-tokens.ofborg.org.yml
73 + key_groups:
74 + - age:
75 + - *core01-ofborg-org
76 + - *eval01-ofborg-org
77 + - *eval02-ofborg-org
78 + - *eval03-ofborg-org
79 + - *eval04-ofborg-org
80 + - *hexa
81 + - *simon
82 + - *dasJ
83 + - *mic92
84 + - *mic92-mac
85 + - path_regex: secrets/[^/]+.eval01.ofborg.org.yml
86 + key_groups:
87 + - age:
88 + - *eval01-ofborg-org
89 + - *hexa
90 + - *simon
91 + - *dasJ
92 + - *mic92
93 + - *mic92-mac
94 + - path_regex: secrets/[^/]+.eval02.ofborg.org.yml
95 + key_groups:
96 + - age:
97 + - *eval02-ofborg-org
98 + - *hexa
99 + - *simon
100 + - *dasJ
101 + - *mic92
102 + - *mic92-mac
103 + - path_regex: secrets/[^/]+.eval03.ofborg.org.yml
104 + key_groups:
105 + - age:
106 + - *eval03-ofborg-org
107 + - *hexa
108 + - *simon
109 + - *dasJ
110 + - *mic92
111 + - *mic92-mac
112 + - path_regex: secrets/[^/]+.eval04.ofborg.org.yml
113 + key_groups:
114 + - age:
115 + - *eval04-ofborg-org
116 + - *hexa
117 + - *simon
118 + - *dasJ
119 + - *mic92
120 + - *mic92-mac
121 + - path_regex: secrets/[^/]+.build01.ofborg.org.yml
122 + key_groups:
123 + - age:
124 + - *build01-ofborg-org
125 + - *hexa
126 + - *simon
127 + - *dasJ
128 + - *mic92
129 + - *mic92-mac
130 + - path_regex: secrets/[^/]+.build02.ofborg.org.yml
131 + key_groups:
132 + - age:
133 + - *build02-ofborg-org
134 + - *hexa
135 + - *simon
136 + - *dasJ
137 + - *mic92
138 + - *mic92-mac
139 + - path_regex: secrets/[^/]+.build03.ofborg.org.yml
140 + key_groups:
141 + - age:
142 + - *build03-ofborg-org
143 + - *hexa
144 + - *simon
145 + - *dasJ
146 + - *mic92
147 + - *mic92-mac
148 + - path_regex: secrets/[^/]+.build04.ofborg.org.yml
149 + key_groups:
150 + - age:
151 + - *build04-ofborg-org
152 + - *hexa
153 + - *simon
154 + - *dasJ
155 + - *mic92
156 + - *mic92-mac
157 + - path_regex: secrets/[^/]+.build05.ofborg.org.yml
158 + key_groups:
159 + - age:
160 + - *build05-ofborg-org
161 + - *hexa
162 + - *simon
163 + - *dasJ
164 + - *mic92
165 + - *mic92-mac
non-critical-infra/flake-module.nix
+12
@@ -8,6 +8,18 @@
8 caliban = { };
9 umbriel = { };
10 staging-hydra = { };
11 +
12 + # ofborg
13 + "core01.ofborg.org".targetHost = "138.199.148.47";
14 + "eval01.ofborg.org".targetHost = "95.217.15.9";
15 + "eval02.ofborg.org".targetHost = "95.216.209.162";
16 + "eval03.ofborg.org".targetHost = "37.27.189.4";
17 + "eval04.ofborg.org".targetHost = "95.217.18.12";
18 + "build01.ofborg.org".targetHost = "185.119.168.10";
19 + "build02.ofborg.org".targetHost = "185.119.168.11";
20 + "build03.ofborg.org".targetHost = "185.119.168.12";
21 + "build04.ofborg.org".targetHost = "185.119.168.13";
22 + "build05.ofborg.org".targetHost = "142.132.171.106";
23 };
24 flake =
25 let
non-critical-infra/hosts/build01.ofborg.org/client.crt new
+11
@@ -0,0 +1,11 @@
1 +-----BEGIN CERTIFICATE-----
2 +MIIBmTCCAUugAwIBAgIUfUYjDOaJML1lIMkAMvLjnSTscZAwBQYDK2VwMEMxCzAJ
3 +BgNVBAYTAkRFMRQwEgYDVQQKDAtOaXhPUyBJbmZyYTEeMBwGA1UEAwwVaHlkcmEt
4 +cXVldWUtcnVubmVyLWNhMCAXDTI1MDczMTEyMDQxN1oYDzIwNzUwNzE5MTIwNDE3
5 +WjBQMQswCQYDVQQGEwJERTEUMBIGA1UECgwLTml4T1MgSW5mcmExKzApBgNVBAMM
6 +Imh5ZHJhLXF1ZXVlLWJ1aWxkZXItb2Zib3JnLWJ1aWxkMDEwKjAFBgMrZXADIQCj
7 +6blZljlur8EmgUA9yNjQrGkg647jacmiy+kn1znGT6NCMEAwHQYDVR0OBBYEFH6t
8 +LjEVdWyQWzR49xirHn9QoNUlMB8GA1UdIwQYMBaAFNMEBugcUyrWMJcsLsg9Gla/
9 +9a+IMAUGAytlcANBAJy33gi4Azqa0Y3hEdvkg+bHn+SsEWOSlls/cy0Lfl6l+qGn
10 +Jd9+vtequq1aXWqzXE3g0r4vjqzQDg8GJE1j5wo=
11 +-----END CERTIFICATE-----
non-critical-infra/hosts/build01.ofborg.org/default.nix new
+54
@@ -0,0 +1,54 @@
1 +{
2 + imports = [
3 + ../../modules/ofborg/builder.nix
4 + ../../modules/hydra/builder.nix
5 + ./hardware.nix
6 + ];
7 +
8 + # Bootloader.
9 + boot.loader.systemd-boot.enable = true;
10 +
11 + networking = {
12 + hostName = "ofborg-build01";
13 + domain = "ofborg.org";
14 + hostId = "007f0301";
15 + };
16 +
17 + disko.devices = import ./disko.nix;
18 +
19 + systemd.network.networks."10-uplink" = {
20 + matchConfig.MACAddress = "00:23:09:4f:49:36";
21 + address = [ "185.119.168.10/32" ];
22 + routes = [
23 + {
24 + Gateway = "91.224.148.0";
25 + GatewayOnLink = true;
26 + }
27 + ];
28 + linkConfig.RequiredForOnline = "routable";
29 + };
30 +
31 + users.users.root.openssh.authorizedKeys.keys = [
32 + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGQ5hBVVKK72ZX+n+BVnPocx+AG5u6ht8bM++G1lhufp liberodark@gmail.com"
33 + ];
34 +
35 + zramSwap = {
36 + enable = true;
37 + memoryPercent = 25;
38 + };
39 +
40 + system.stateVersion = "24.11"; # Did you read the comment?
41 +
42 + sops.secrets = {
43 + "ofborg/builder-rabbitmq-password" = {
44 + owner = "ofborg-builder";
45 + restartUnits = [ "ofborg-builder.service" ];
46 + sopsFile = ../../secrets/ofborg.build01.ofborg.org.yml;
47 + };
48 + "harmonia/secret" = {
49 + owner = "harmonia";
50 + restartUnits = [ "harmonia.service" ];
51 + sopsFile = ../../secrets/ofborg.build01.ofborg.org.yml;
52 + };
53 + };
54 +}
non-critical-infra/hosts/build01.ofborg.org/disko.nix new
+64
@@ -0,0 +1,64 @@
1 +{
2 + disk = {
3 + main = {
4 + type = "disk";
5 + device = "/dev/nvme0n1";
6 + content = {
7 + type = "gpt";
8 + partitions = {
9 + boot = {
10 + size = "1G";
11 + type = "EF00";
12 + content = {
13 + type = "filesystem";
14 + format = "vfat";
15 + mountpoint = "/boot";
16 + mountOptions = [ "umask=0077" ];
17 + };
18 + };
19 + root = {
20 + size = "100%";
21 + content = {
22 + type = "zfs";
23 + pool = "zroot";
24 + };
25 + };
26 + };
27 + };
28 + };
29 + };
30 +
31 + zpool = {
32 + zroot = {
33 + type = "zpool";
34 + options = {
35 + # smartctl --all /dev/nvme0n1
36 + # Logical block size: 512 bytes
37 + ashift = "9";
38 + };
39 + rootFsOptions = {
40 + acltype = "posixacl";
41 + compression = "zstd";
42 + mountpoint = "none";
43 + xattr = "sa";
44 + };
45 + datasets = {
46 + "root" = {
47 + type = "zfs_fs";
48 + mountpoint = "/";
49 + };
50 + "nix" = {
51 + type = "zfs_fs";
52 + mountpoint = "/nix";
53 + };
54 + "reserved" = {
55 + type = "zfs_fs";
56 + options = {
57 + canmount = "off";
58 + refreservation = "1G";
59 + };
60 + };
61 + };
62 + };
63 + };
64 +}
non-critical-infra/hosts/build01.ofborg.org/hardware.nix new
+9
@@ -0,0 +1,9 @@
1 +{
2 +
3 + boot.initrd.availableKernelModules = [
4 + "ehci_pci"
5 + "ahci"
6 + ];
7 + boot.initrd.kernelModules = [ "nvme" ];
8 + boot.kernelModules = [ "kvm-intel" ];
9 +}
non-critical-infra/hosts/build02.ofborg.org/client.crt new
+11
@@ -0,0 +1,11 @@
1 +-----BEGIN CERTIFICATE-----
2 +MIIBmTCCAUugAwIBAgIUfUYjDOaJML1lIMkAMvLjnSTscZEwBQYDK2VwMEMxCzAJ
3 +BgNVBAYTAkRFMRQwEgYDVQQKDAtOaXhPUyBJbmZyYTEeMBwGA1UEAwwVaHlkcmEt
4 +cXVldWUtcnVubmVyLWNhMCAXDTI1MDczMTEyMDQxN1oYDzIwNzUwNzE5MTIwNDE3
5 +WjBQMQswCQYDVQQGEwJERTEUMBIGA1UECgwLTml4T1MgSW5mcmExKzApBgNVBAMM
6 +Imh5ZHJhLXF1ZXVlLWJ1aWxkZXItb2Zib3JnLWJ1aWxkMDIwKjAFBgMrZXADIQAL
7 +Cdl+ZbvuX8OUBj5MIMfL7120fT1NxFk6C4DydQ7Qt6NCMEAwHQYDVR0OBBYEFGAH
8 +xmXkYN9IDgVaHjA/oEj2921hMB8GA1UdIwQYMBaAFNMEBugcUyrWMJcsLsg9Gla/
9 +9a+IMAUGAytlcANBACmGjy4gHWTiahHy2P/hPQ661vfob9nkBQ+CEG1FSaK3ImpQ
10 +yPVG+BJiu2oT50EO3EzdsV2tUk9VAhcYNA2YXAg=
11 +-----END CERTIFICATE-----
non-critical-infra/hosts/build02.ofborg.org/default.nix new
+54
@@ -0,0 +1,54 @@
1 +{
2 + imports = [
3 + ../../modules/ofborg/builder.nix
4 + ../../modules/hydra/builder.nix
5 + ./hardware.nix
6 + ];
7 +
8 + # Bootloader.
9 + boot.loader.systemd-boot.enable = true;
10 +
11 + networking = {
12 + hostName = "ofborg-build02";
13 + domain = "ofborg.org";
14 + hostId = "007f0302";
15 + };
16 +
17 + disko.devices = import ./disko.nix;
18 +
19 + systemd.network.networks."10-uplink" = {
20 + matchConfig.MACAddress = "22:33:4d:07:51:b4";
21 + address = [ "185.119.168.11/32" ];
22 + routes = [
23 + {
24 + Gateway = "91.224.148.0";
25 + GatewayOnLink = true;
26 + }
27 + ];
28 + linkConfig.RequiredForOnline = "routable";
29 + };
30 +
31 + users.users.root.openssh.authorizedKeys.keys = [
32 + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGQ5hBVVKK72ZX+n+BVnPocx+AG5u6ht8bM++G1lhufp liberodark@gmail.com"
33 + ];
34 +
35 + zramSwap = {
36 + enable = true;
37 + memoryPercent = 25;
38 + };
39 +
40 + system.stateVersion = "24.11"; # Did you read the comment?
41 +
42 + sops.secrets = {
43 + "ofborg/builder-rabbitmq-password" = {
44 + owner = "ofborg-builder";
45 + restartUnits = [ "ofborg-builder.service" ];
46 + sopsFile = ../../secrets/ofborg.build02.ofborg.org.yml;
47 + };
48 + "harmonia/secret" = {
49 + owner = "harmonia";
50 + restartUnits = [ "harmonia.service" ];
51 + sopsFile = ../../secrets/ofborg.build02.ofborg.org.yml;
52 + };
53 + };
54 +}
non-critical-infra/hosts/build02.ofborg.org/disko.nix new
+64
@@ -0,0 +1,64 @@
1 +{
2 + disk = {
3 + main = {
4 + type = "disk";
5 + device = "/dev/nvme0n1";
6 + content = {
7 + type = "gpt";
8 + partitions = {
9 + boot = {
10 + size = "1G";
11 + type = "EF00";
12 + content = {
13 + type = "filesystem";
14 + format = "vfat";
15 + mountpoint = "/boot";
16 + mountOptions = [ "umask=0077" ];
17 + };
18 + };
19 + root = {
20 + size = "100%";
21 + content = {
22 + type = "zfs";
23 + pool = "zroot";
24 + };
25 + };
26 + };
27 + };
28 + };
29 + };
30 +
31 + zpool = {
32 + zroot = {
33 + type = "zpool";
34 + options = {
35 + # smartctl --all /dev/nvme0n1
36 + # Logical block size: 512 bytes
37 + ashift = "9";
38 + };
39 + rootFsOptions = {
40 + acltype = "posixacl";
41 + compression = "zstd";
42 + mountpoint = "none";
43 + xattr = "sa";
44 + };
45 + datasets = {
46 + "root" = {
47 + type = "zfs_fs";
48 + mountpoint = "/";
49 + };
50 + "nix" = {
51 + type = "zfs_fs";
52 + mountpoint = "/nix";
53 + };
54 + "reserved" = {
55 + type = "zfs_fs";
56 + options = {
57 + canmount = "off";
58 + refreservation = "1G";
59 + };
60 + };
61 + };
62 + };
63 + };
64 +}
non-critical-infra/hosts/build02.ofborg.org/hardware.nix new
+9
@@ -0,0 +1,9 @@
1 +{
2 +
3 + boot.initrd.availableKernelModules = [
4 + "ehci_pci"
5 + "ahci"
6 + ];
7 + boot.initrd.kernelModules = [ "nvme" ];
8 + boot.kernelModules = [ "kvm-intel" ];
9 +}
non-critical-infra/hosts/build03.ofborg.org/client.crt new
+11
@@ -0,0 +1,11 @@
1 +-----BEGIN CERTIFICATE-----
2 +MIIBmTCCAUugAwIBAgIUfUYjDOaJML1lIMkAMvLjnSTscZIwBQYDK2VwMEMxCzAJ
3 +BgNVBAYTAkRFMRQwEgYDVQQKDAtOaXhPUyBJbmZyYTEeMBwGA1UEAwwVaHlkcmEt
4 +cXVldWUtcnVubmVyLWNhMCAXDTI1MDczMTEyMDQxN1oYDzIwNzUwNzE5MTIwNDE3
5 +WjBQMQswCQYDVQQGEwJERTEUMBIGA1UECgwLTml4T1MgSW5mcmExKzApBgNVBAMM
6 +Imh5ZHJhLXF1ZXVlLWJ1aWxkZXItb2Zib3JnLWJ1aWxkMDMwKjAFBgMrZXADIQC8
7 +UiCK9YGsTI+144EzVlCjuwz0wBUyOwjg1b2lnQCdZ6NCMEAwHQYDVR0OBBYEFEDA
8 +dN0ht/zFU5Y7KER4xxTAeZdrMB8GA1UdIwQYMBaAFNMEBugcUyrWMJcsLsg9Gla/
9 +9a+IMAUGAytlcANBAHDszlrrBBg8Q5tHeynkDLY+Cvh0gOAaUmyoMkfhlPNxKNLH
10 ++8NVKKkDoVLreYcLrKxEg+36KIBU/Z3uxfIAew0=
11 +-----END CERTIFICATE-----
non-critical-infra/hosts/build03.ofborg.org/default.nix new
+54
@@ -0,0 +1,54 @@
1 +{
2 + imports = [
3 + ../../modules/ofborg/builder.nix
4 + ../../modules/hydra/builder.nix
5 + ./hardware.nix
6 + ];
7 +
8 + # Bootloader.
9 + boot.loader.systemd-boot.enable = true;
10 +
11 + networking = {
12 + hostName = "ofborg-build03";
13 + domain = "ofborg.org";
14 + hostId = "007f0303";
15 + };
16 +
17 + disko.devices = import ./disko.nix;
18 +
19 + systemd.network.networks."10-uplink" = {
20 + matchConfig.MACAddress = "22:33:4d:07:51:b9";
21 + address = [ "185.119.168.12/32" ];
22 + routes = [
23 + {
24 + Gateway = "91.224.148.0";
25 + GatewayOnLink = true;
26 + }
27 + ];
28 + linkConfig.RequiredForOnline = "routable";
29 + };
30 +
31 + users.users.root.openssh.authorizedKeys.keys = [
32 + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGQ5hBVVKK72ZX+n+BVnPocx+AG5u6ht8bM++G1lhufp liberodark@gmail.com"
33 + ];
34 +
35 + zramSwap = {
36 + enable = true;
37 + memoryPercent = 25;
38 + };
39 +
40 + system.stateVersion = "24.11"; # Did you read the comment?
41 +
42 + sops.secrets = {
43 + "ofborg/builder-rabbitmq-password" = {
44 + owner = "ofborg-builder";
45 + restartUnits = [ "ofborg-builder.service" ];
46 + sopsFile = ../../secrets/ofborg.build03.ofborg.org.yml;
47 + };
48 + "harmonia/secret" = {
49 + owner = "harmonia";
50 + restartUnits = [ "harmonia.service" ];
51 + sopsFile = ../../secrets/ofborg.build03.ofborg.org.yml;
52 + };
53 + };
54 +}
non-critical-infra/hosts/build03.ofborg.org/disko.nix new
+64
@@ -0,0 +1,64 @@
1 +{
2 + disk = {
3 + main = {
4 + type = "disk";
5 + device = "/dev/nvme0n1";
6 + content = {
7 + type = "gpt";
8 + partitions = {
9 + boot = {
10 + size = "1G";
11 + type = "EF00";
12 + content = {
13 + type = "filesystem";
14 + format = "vfat";
15 + mountpoint = "/boot";
16 + mountOptions = [ "umask=0077" ];
17 + };
18 + };
19 + root = {
20 + size = "100%";
21 + content = {
22 + type = "zfs";
23 + pool = "zroot";
24 + };
25 + };
26 + };
27 + };
28 + };
29 + };
30 +
31 + zpool = {
32 + zroot = {
33 + type = "zpool";
34 + options = {
35 + # smartctl --all /dev/nvme0n1
36 + # Logical block size: 512 bytes
37 + ashift = "9";
38 + };
39 + rootFsOptions = {
40 + acltype = "posixacl";
41 + compression = "zstd";
42 + mountpoint = "none";
43 + xattr = "sa";
44 + };
45 + datasets = {
46 + "root" = {
47 + type = "zfs_fs";
48 + mountpoint = "/";
49 + };
50 + "nix" = {
51 + type = "zfs_fs";
52 + mountpoint = "/nix";
53 + };
54 + "reserved" = {
55 + type = "zfs_fs";
56 + options = {
57 + canmount = "off";
58 + refreservation = "1G";
59 + };
60 + };
61 + };
62 + };
63 + };
64 +}
non-critical-infra/hosts/build03.ofborg.org/hardware.nix new
+9
@@ -0,0 +1,9 @@
1 +{
2 +
3 + boot.initrd.availableKernelModules = [
4 + "ehci_pci"
5 + "ahci"
6 + ];
7 + boot.initrd.kernelModules = [ "nvme" ];
8 + boot.kernelModules = [ "kvm-intel" ];
9 +}
non-critical-infra/hosts/build04.ofborg.org/client.crt new
+11
@@ -0,0 +1,11 @@
1 +-----BEGIN CERTIFICATE-----
2 +MIIBmTCCAUugAwIBAgIUfUYjDOaJML1lIMkAMvLjnSTscZMwBQYDK2VwMEMxCzAJ
3 +BgNVBAYTAkRFMRQwEgYDVQQKDAtOaXhPUyBJbmZyYTEeMBwGA1UEAwwVaHlkcmEt
4 +cXVldWUtcnVubmVyLWNhMCAXDTI1MDczMTEyMDQxN1oYDzIwNzUwNzE5MTIwNDE3
5 +WjBQMQswCQYDVQQGEwJERTEUMBIGA1UECgwLTml4T1MgSW5mcmExKzApBgNVBAMM
6 +Imh5ZHJhLXF1ZXVlLWJ1aWxkZXItb2Zib3JnLWJ1aWxkMDQwKjAFBgMrZXADIQDH
7 +sVDND3YMmQ9ijOxK9b65fhuCF70h8O4d3NAiKUzZp6NCMEAwHQYDVR0OBBYEFBy8
8 +QofH7VDm+VVK3YunEtbxGc/OMB8GA1UdIwQYMBaAFNMEBugcUyrWMJcsLsg9Gla/
9 +9a+IMAUGAytlcANBAOsNsCCH+jV9xUaaQG0t40IG8UMr9b+ThA9hiOnrsTOmUfE7
10 +wsl1639LWXyoWiqjsj7g646M70lPcWCqocxDhQk=
11 +-----END CERTIFICATE-----
non-critical-infra/hosts/build04.ofborg.org/default.nix new
+54
@@ -0,0 +1,54 @@
1 +{
2 + imports = [
3 + ../../modules/ofborg/builder.nix
4 + ../../modules/hydra/builder.nix
5 + ./hardware.nix
6 + ];
7 +
8 + # Bootloader.
9 + boot.loader.systemd-boot.enable = true;
10 +
11 + networking = {
12 + hostName = "ofborg-build04";
13 + domain = "ofborg.org";
14 + hostId = "007f0304";
15 + };
16 +
17 + disko.devices = import ./disko.nix;
18 +
19 + systemd.network.networks."10-uplink" = {
20 + matchConfig.MACAddress = "22:33:4d:06:4a:ad";
21 + address = [ "185.119.168.13/32" ];
22 + routes = [
23 + {
24 + Gateway = "91.224.148.0";
25 + GatewayOnLink = true;
26 + }
27 + ];
28 + linkConfig.RequiredForOnline = "routable";
29 + };
30 +
31 + users.users.root.openssh.authorizedKeys.keys = [
32 + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGQ5hBVVKK72ZX+n+BVnPocx+AG5u6ht8bM++G1lhufp liberodark@gmail.com"
33 + ];
34 +
35 + zramSwap = {
36 + enable = true;
37 + memoryPercent = 25;
38 + };
39 +
40 + system.stateVersion = "24.11"; # Did you read the comment?
41 +
42 + sops.secrets = {
43 + "ofborg/builder-rabbitmq-password" = {
44 + owner = "ofborg-builder";
45 + restartUnits = [ "ofborg-builder.service" ];
46 + sopsFile = ../../secrets/ofborg.build04.ofborg.org.yml;
47 + };
48 + "harmonia/secret" = {
49 + owner = "harmonia";
50 + restartUnits = [ "harmonia.service" ];
51 + sopsFile = ../../secrets/ofborg.build04.ofborg.org.yml;
52 + };
53 + };
54 +}
non-critical-infra/hosts/build04.ofborg.org/disko.nix new
+64
@@ -0,0 +1,64 @@
1 +{
2 + disk = {
3 + main = {
4 + type = "disk";
5 + device = "/dev/nvme0n1";
6 + content = {
7 + type = "gpt";
8 + partitions = {
9 + boot = {
10 + size = "1G";
11 + type = "EF00";
12 + content = {
13 + type = "filesystem";
14 + format = "vfat";
15 + mountpoint = "/boot";
16 + mountOptions = [ "umask=0077" ];
17 + };
18 + };
19 + root = {
20 + size = "100%";
21 + content = {
22 + type = "zfs";
23 + pool = "zroot";
24 + };
25 + };
26 + };
27 + };
28 + };
29 + };
30 +
31 + zpool = {
32 + zroot = {
33 + type = "zpool";
34 + options = {
35 + # smartctl --all /dev/nvme0n1
36 + # Logical block size: 512 bytes
37 + ashift = "9";
38 + };
39 + rootFsOptions = {
40 + acltype = "posixacl";
41 + compression = "zstd";
42 + mountpoint = "none";
43 + xattr = "sa";
44 + };
45 + datasets = {
46 + "root" = {
47 + type = "zfs_fs";
48 + mountpoint = "/";
49 + };
50 + "nix" = {
51 + type = "zfs_fs";
52 + mountpoint = "/nix";
53 + };
54 + "reserved" = {
55 + type = "zfs_fs";
56 + options = {
57 + canmount = "off";
58 + refreservation = "1G";
59 + };
60 + };
61 + };
62 + };
63 + };
64 +}
non-critical-infra/hosts/build04.ofborg.org/hardware.nix new
+9
@@ -0,0 +1,9 @@
1 +{
2 +
3 + boot.initrd.availableKernelModules = [
4 + "ehci_pci"
5 + "ahci"
6 + ];
7 + boot.initrd.kernelModules = [ "nvme" ];
8 + boot.kernelModules = [ "kvm-intel" ];
9 +}
non-critical-infra/hosts/build05.ofborg.org/client.crt new
+11
@@ -0,0 +1,11 @@
1 +-----BEGIN CERTIFICATE-----
2 +MIIBmTCCAUugAwIBAgIUfUYjDOaJML1lIMkAMvLjnSTscZQwBQYDK2VwMEMxCzAJ
3 +BgNVBAYTAkRFMRQwEgYDVQQKDAtOaXhPUyBJbmZyYTEeMBwGA1UEAwwVaHlkcmEt
4 +cXVldWUtcnVubmVyLWNhMCAXDTI1MDczMTEyMDQxN1oYDzIwNzUwNzE5MTIwNDE3
5 +WjBQMQswCQYDVQQGEwJERTEUMBIGA1UECgwLTml4T1MgSW5mcmExKzApBgNVBAMM
6 +Imh5ZHJhLXF1ZXVlLWJ1aWxkZXItb2Zib3JnLWJ1aWxkMDUwKjAFBgMrZXADIQCV
7 +CeAL3FB4rMIDBSife7abqJK2+H7OAskVY+jOXcytEaNCMEAwHQYDVR0OBBYEFPXn
8 +CTIW6uvZnozTKkouPPmtgoOkMB8GA1UdIwQYMBaAFNMEBugcUyrWMJcsLsg9Gla/
9 +9a+IMAUGAytlcANBALq7WRX5hKqnjLTgaoLgwBbH5FPMhf+rC+63lepxl0/kAeoT
10 +IgiSCPV7GonPxeLsqE+uytoQ2CaPYwBRosPTCAw=
11 +-----END CERTIFICATE-----
non-critical-infra/hosts/build05.ofborg.org/default.nix new
+56
@@ -0,0 +1,56 @@
1 +{ inputs, ... }:
2 +{
3 + imports = [
4 + inputs.srvos.nixosModules.hardware-hetzner-cloud-arm
5 + ../../modules/ofborg/builder.nix
6 + ../../modules/hydra/builder.nix
7 + ./hardware.nix
8 + ];
9 +
10 + # Bootloader.
11 + boot.loader.systemd-boot.enable = true;
12 +
13 + networking = {
14 + hostName = "ofborg-build05";
15 + domain = "ofborg.org";
16 + hostId = "007f0305";
17 + };
18 +
19 + disko.devices = import ./disko.nix;
20 +
21 + systemd.network.networks."10-uplink" = {
22 + matchConfig.MACAddress = "96:00:03:fd:32:fd";
23 + address = [
24 + "142.132.171.106/32"
25 + "2a01:4f8:1c1b:6d41::/64"
26 + ];
27 + routes = [
28 + { Gateway = "fe80::1"; }
29 + {
30 + Gateway = "172.31.1.1";
31 + GatewayOnLink = true;
32 + }
33 + ];
34 + linkConfig.RequiredForOnline = "routable";
35 + };
36 +
37 + zramSwap = {
38 + enable = true;
39 + memoryPercent = 100;
40 + };
41 +
42 + system.stateVersion = "24.11"; # Did you read the comment?
43 +
44 + sops.secrets = {
45 + "ofborg/builder-rabbitmq-password" = {
46 + owner = "ofborg-builder";
47 + restartUnits = [ "ofborg-builder.service" ];
48 + sopsFile = ../../secrets/ofborg.build05.ofborg.org.yml;
49 + };
50 + "harmonia/secret" = {
51 + owner = "harmonia";
52 + restartUnits = [ "harmonia.service" ];
53 + sopsFile = ../../secrets/ofborg.build05.ofborg.org.yml;
54 + };
55 + };
56 +}
non-critical-infra/hosts/build05.ofborg.org/disko.nix new
+64
@@ -0,0 +1,64 @@
1 +{
2 + disk = {
3 + main = {
4 + type = "disk";
5 + device = "/dev/sda";
6 + content = {
7 + type = "gpt";
8 + partitions = {
9 + boot = {
10 + size = "1G";
11 + type = "EF00";
12 + content = {
13 + type = "filesystem";
14 + format = "vfat";
15 + mountpoint = "/boot";
16 + mountOptions = [ "umask=0077" ];
17 + };
18 + };
19 + root = {
20 + size = "100%";
21 + content = {
22 + type = "zfs";
23 + pool = "zroot";
24 + };
25 + };
26 + };
27 + };
28 + };
29 + };
30 +
31 + zpool = {
32 + zroot = {
33 + type = "zpool";
34 + options = {
35 + # smartctl --all /dev/sda
36 + # Logical block size: 512 bytes
37 + ashift = "9";
38 + };
39 + rootFsOptions = {
40 + acltype = "posixacl";
41 + compression = "zstd";
42 + mountpoint = "none";
43 + xattr = "sa";
44 + };
45 + datasets = {
46 + "root" = {
47 + type = "zfs_fs";
48 + mountpoint = "/";
49 + };
50 + "nix" = {
51 + type = "zfs_fs";
52 + mountpoint = "/nix";
53 + };
54 + "reserved" = {
55 + type = "zfs_fs";
56 + options = {
57 + canmount = "off";
58 + refreservation = "1G";
59 + };
60 + };
61 + };
62 + };
63 + };
64 +}
non-critical-infra/hosts/build05.ofborg.org/hardware.nix new
+18
@@ -0,0 +1,18 @@
1 +{ lib, ... }:
2 +
3 +{
4 +
5 + boot.initrd.availableKernelModules = [
6 + "xhci_pci"
7 + "virtio_pci"
8 + "usbhid"
9 + "sr_mod"
10 + ];
11 + boot.initrd.kernelModules = [ "virtio_gpu" ];
12 + boot.kernelModules = [ ];
13 + boot.extraModulePackages = [ ];
14 +
15 + swapDevices = [ ];
16 +
17 + nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
18 +}
non-critical-infra/hosts/core01.ofborg.org/default.nix new
+55
@@ -0,0 +1,55 @@
1 +{ inputs, ... }:
2 +
3 +{
4 + imports = [
5 + inputs.srvos.nixosModules.hardware-hetzner-cloud
6 + ../../modules/ofborg/common.nix
7 + ../../modules/ofborg/github-tokens.nix
8 + ./nginx.nix
9 + ./rabbitmq.nix
10 + # ofborg.org landingpage
11 + # ./website.nix
12 + # Accepts webhooks from GitHub
13 + ./github-webhook-receiver.nix
14 + # Checks wheter a PR event is interesting to us
15 + ./evaluation-filter.nix
16 + # Handles incoming comments
17 + ./github-comment-filter.nix
18 + # Receives logs from builders
19 + ./log-message-collector.nix
20 + # Posts to GitHub
21 + ./github-comment-poster.nix
22 + # LogApi and LogViewer
23 + ./log-viewer.nix
24 + ];
25 + # TODO backups
26 +
27 + # Bootloader.
28 + boot.loader.grub.enable = true;
29 +
30 + networking = {
31 + hostName = "ofborg-core01";
32 + domain = "ofborg.org";
33 + hostId = "007f0101";
34 + };
35 +
36 + disko.devices = import ./disko.nix;
37 +
38 + systemd.network.networks."10-uplink" = {
39 + matchConfig.MACAddress = "96:00:03:ea:fa:62";
40 + address = [
41 + "138.199.148.47/32"
42 + "2a01:4f8:c012:cda4::1/64"
43 + ];
44 + routes = [
45 + { Gateway = "fe80::1"; }
46 + {
47 + Gateway = "172.31.1.1";
48 + GatewayOnLink = true;
49 + }
50 + ];
51 + linkConfig.RequiredForOnline = "routable";
52 + };
53 +
54 + system.stateVersion = "24.11"; # Did you read the comment?
55 +}
non-critical-infra/hosts/core01.ofborg.org/disko.nix new
+68
@@ -0,0 +1,68 @@
1 +{
2 + disk = {
3 + main = {
4 + type = "disk";
5 + device = "/dev/sda";
6 + content = {
7 + type = "gpt";
8 + partitions = {
9 + grub = {
10 + size = "1M";
11 + type = "EF02";
12 + };
13 + boot = {
14 + size = "1G";
15 + type = "EF00";
16 + content = {
17 + type = "filesystem";
18 + format = "vfat";
19 + mountpoint = "/boot";
20 + mountOptions = [ "umask=0077" ];
21 + };
22 + };
23 + root = {
24 + size = "100%";
25 + content = {
26 + type = "zfs";
27 + pool = "zroot";
28 + };
29 + };
30 + };
31 + };
32 + };
33 + };
34 +
35 + zpool = {
36 + zroot = {
37 + type = "zpool";
38 + options = {
39 + # smartctl --all /dev/sda
40 + # Logical block size: 512 bytes
41 + ashift = "9";
42 + };
43 + rootFsOptions = {
44 + acltype = "posixacl";
45 + compression = "zstd";
46 + mountpoint = "none";
47 + xattr = "sa";
48 + };
49 + datasets = {
50 + "root" = {
51 + type = "zfs_fs";
52 + mountpoint = "/";
53 + };
54 + "nix" = {
55 + type = "zfs_fs";
56 + mountpoint = "/nix";
57 + };
58 + "reserved" = {
59 + type = "zfs_fs";
60 + options = {
61 + canmount = "off";
62 + refreservation = "1G";
63 + };
64 + };
65 + };
66 + };
67 + };
68 +}
non-critical-infra/hosts/core01.ofborg.org/evaluation-filter.nix new
+67
@@ -0,0 +1,67 @@
1 +{ config, pkgs, ... }:
2 +
3 +{
4 + systemd.services.ofborg-evaluation-filter = {
5 + description = "ofBorg Evaluation Filter";
6 +
7 + wantedBy = [ "ofborg.target" ];
8 + bindsTo = [ "ofborg.target" ];
9 + restartTriggers = [ config.environment.etc."ofborg.json".source ];
10 +
11 + stopIfChanged = false;
12 + unitConfig.StartLimitIntervalSec = 0;
13 + serviceConfig = {
14 + # Filesystem stuff
15 + ProtectSystem = "strict"; # Prevent writing to most of /
16 + ProtectHome = true; # Prevent accessing /home and /root
17 + PrivateTmp = true; # Give an own directory under /tmp
18 + PrivateDevices = true; # Deny access to most of /dev
19 + ProtectKernelTunables = true; # Protect some parts of /sys
20 + ProtectControlGroups = true; # Remount cgroups read-only
21 + RestrictSUIDSGID = true; # Prevent creating SETUID/SETGID files
22 + PrivateMounts = true; # Give an own mount namespace
23 + RemoveIPC = true;
24 + UMask = "0077";
25 +
26 + Restart = "always";
27 + RestartSec = "5s";
28 + ExecStart = "${pkgs.ofborg}/bin/evaluation-filter /etc/ofborg.json";
29 + User = "ofborg-evaluation-filter";
30 + Group = "ofborg-evaluation-filter";
31 +
32 + # Capabilities
33 + CapabilityBoundingSet = ""; # Allow no capabilities at all
34 + NoNewPrivileges = true; # Disallow getting more capabilities. This is also implied by other options.
35 +
36 + # Kernel stuff
37 + ProtectKernelModules = true; # Prevent loading of kernel modules
38 + SystemCallArchitectures = "native"; # Usually no need to disable this
39 + ProtectKernelLogs = true; # Prevent access to kernel logs
40 + ProtectClock = true; # Prevent setting the RTC
41 +
42 + # Misc
43 + LockPersonality = true; # Prevent change of the personality
44 + ProtectHostname = true; # Give an own UTS namespace
45 + RestrictRealtime = true; # Prevent switching to RT scheduling
46 + MemoryDenyWriteExecute = true; # Maybe disable this for interpreters like python
47 + PrivateUsers = true; # If anything randomly breaks, it's mostly because of this
48 + RestrictNamespaces = true;
49 + SystemCallFilter = "@system-service";
50 + };
51 + };
52 +
53 + users.users.ofborg-evaluation-filter = {
54 + isSystemUser = true;
55 + group = "ofborg-evaluation-filter";
56 + description = "ofBorg evaluation filter system user";
57 + };
58 + users.groups.ofborg-evaluation-filter = { };
59 +
60 + sops.secrets = {
61 + "ofborg/evaluation-filter-rabbitmq-password" = {
62 + owner = "ofborg-evaluation-filter";
63 + restartUnits = [ "ofborg-evaluation-filter.service" ];
64 + sopsFile = ../../secrets/ofborg.core01.ofborg.org.yml;
65 + };
66 + };
67 +}
non-critical-infra/hosts/core01.ofborg.org/github-comment-filter.nix new
+69
@@ -0,0 +1,69 @@
1 +{ config, pkgs, ... }:
2 +
3 +{
4 + systemd.services.ofborg-github-comment-filter = {
5 + description = "ofBorg GitHub comment filter";
6 +
7 + wantedBy = [ "ofborg.target" ];
8 + bindsTo = [ "ofborg.target" ];
9 + restartTriggers = [ config.environment.etc."ofborg.json".source ];
10 +
11 + stopIfChanged = false;
12 + unitConfig.StartLimitIntervalSec = 0;
13 + serviceConfig = {
14 + # Filesystem stuff
15 + ProtectSystem = "strict"; # Prevent writing to most of /
16 + ProtectHome = true; # Prevent accessing /home and /root
17 + PrivateTmp = true; # Give an own directory under /tmp
18 + PrivateDevices = true; # Deny access to most of /dev
19 + ProtectKernelTunables = true; # Protect some parts of /sys
20 + ProtectControlGroups = true; # Remount cgroups read-only
21 + RestrictSUIDSGID = true; # Prevent creating SETUID/SETGID files
22 + PrivateMounts = true; # Give an own mount namespace
23 + RemoveIPC = true;
24 + UMask = "0077";
25 +
26 + Restart = "always";
27 + RestartSec = "5s";
28 + ExecStart = "${pkgs.ofborg}/bin/github-comment-filter /etc/ofborg.json";
29 + User = "ofborg-github-comment-filter";
30 + Group = "ofborg-github-comment-filter";
31 + SupplementaryGroups = [ "ofborg-github-oauth-secret" ];
32 +
33 + # Capabilities
34 + CapabilityBoundingSet = ""; # Allow no capabilities at all
35 + NoNewPrivileges = true; # Disallow getting more capabilities. This is also implied by other options.
36 +
37 + # Kernel stuff
38 + ProtectKernelModules = true; # Prevent loading of kernel modules
39 + SystemCallArchitectures = "native"; # Usually no need to disable this
40 + ProtectKernelLogs = true; # Prevent access to kernel logs
41 + ProtectClock = true; # Prevent setting the RTC
42 +
43 + # Misc
44 + LockPersonality = true; # Prevent change of the personality
45 + ProtectHostname = true; # Give an own UTS namespace
46 + RestrictRealtime = true; # Prevent switching to RT scheduling
47 + MemoryDenyWriteExecute = true; # Maybe disable this for interpreters like python
48 + PrivateUsers = true; # If anything randomly breaks, it's mostly because of this
49 + RestrictNamespaces = true;
50 + SystemCallFilter = "@system-service";
51 + };
52 + };
53 +
54 + users.users.ofborg-github-comment-filter = {
55 + isSystemUser = true;
56 + group = "ofborg-github-comment-filter";
57 + description = "ofBorg GitHub comment filter system user";
58 + };
59 + users.groups.ofborg-github-comment-filter = { };
60 +
61 + sops.secrets = {
62 + "ofborg/github-comment-filter-rabbitmq-password" = {
63 + owner = "ofborg-github-comment-filter";
64 + restartUnits = [ "ofborg-github-comment-filter.service" ];
65 + sopsFile = ../../secrets/ofborg.core01.ofborg.org.yml;
66 + };
67 + "ofborg/github-oauth-secret".restartUnits = [ "ofborg-github-comment-filter.service" ];
68 + };
69 +}
non-critical-infra/hosts/core01.ofborg.org/github-comment-poster.nix new
+69
@@ -0,0 +1,69 @@
1 +{ config, pkgs, ... }:
2 +
3 +{
4 + systemd.services.ofborg-github-comment-poster = {
5 + description = "ofBorg GitHub comment poster";
6 +
7 + wantedBy = [ "ofborg.target" ];
8 + bindsTo = [ "ofborg.target" ];
9 + restartTriggers = [ config.environment.etc."ofborg.json".source ];
10 +
11 + stopIfChanged = false;
12 + unitConfig.StartLimitIntervalSec = 0;
13 + serviceConfig = {
14 + # Filesystem stuff
15 + ProtectSystem = "strict"; # Prevent writing to most of /
16 + ProtectHome = true; # Prevent accessing /home and /root
17 + PrivateTmp = true; # Give an own directory under /tmp
18 + PrivateDevices = true; # Deny access to most of /dev
19 + ProtectKernelTunables = true; # Protect some parts of /sys
20 + ProtectControlGroups = true; # Remount cgroups read-only
21 + RestrictSUIDSGID = true; # Prevent creating SETUID/SETGID files
22 + PrivateMounts = true; # Give an own mount namespace
23 + RemoveIPC = true;
24 + UMask = "0077";
25 +
26 + Restart = "always";
27 + RestartSec = "5s";
28 + ExecStart = "${pkgs.ofborg}/bin/github-comment-poster /etc/ofborg.json";
29 + User = "ofborg-github-comment-poster";
30 + Group = "ofborg-github-comment-poster";
31 + SupplementaryGroups = [ "ofborg-github-app-key" ];
32 +
33 + # Capabilities
34 + CapabilityBoundingSet = ""; # Allow no capabilities at all
35 + NoNewPrivileges = true; # Disallow getting more capabilities. This is also implied by other options.
36 +
37 + # Kernel stuff
38 + ProtectKernelModules = true; # Prevent loading of kernel modules
39 + SystemCallArchitectures = "native"; # Usually no need to disable this
40 + ProtectKernelLogs = true; # Prevent access to kernel logs
41 + ProtectClock = true; # Prevent setting the RTC
42 +
43 + # Misc
44 + LockPersonality = true; # Prevent change of the personality
45 + ProtectHostname = true; # Give an own UTS namespace
46 + RestrictRealtime = true; # Prevent switching to RT scheduling
47 + MemoryDenyWriteExecute = true; # Maybe disable this for interpreters like python
48 + PrivateUsers = true; # If anything randomly breaks, it's mostly because of this
49 + RestrictNamespaces = true;
50 + SystemCallFilter = "@system-service";
51 + };
52 + };
53 +
54 + users.users.ofborg-github-comment-poster = {
55 + isSystemUser = true;
56 + group = "ofborg-github-comment-poster";
57 + description = "ofBorg GitHub comment poster system user";
58 + };
59 + users.groups.ofborg-github-comment-poster = { };
60 +
61 + sops.secrets = {
62 + "ofborg/github-comment-poster-rabbitmq-password" = {
63 + owner = "ofborg-github-comment-poster";
64 + restartUnits = [ "ofborg-github-comment-poster.service" ];
65 + sopsFile = ../../secrets/ofborg.core01.ofborg.org.yml;
66 + };
67 + "ofborg/github-app-key".restartUnits = [ "ofborg-github-comment-poster.service" ];
68 + };
69 +}
non-critical-infra/hosts/core01.ofborg.org/github-webhook-receiver.nix new
+80
@@ -0,0 +1,80 @@
1 +{ config, pkgs, ... }:
2 +
3 +{
4 + systemd.services.ofborg-github-webhook-receiver = {
5 + description = "ofBorg Webhook Receiver";
6 +
7 + wantedBy = [ "ofborg.target" ];
8 + bindsTo = [ "ofborg.target" ];
9 + restartTriggers = [ config.environment.etc."ofborg.json".source ];
10 +
11 + stopIfChanged = false;
12 + unitConfig.StartLimitIntervalSec = 0;
13 + serviceConfig = {
14 + # Filesystem stuff
15 + ProtectSystem = "strict"; # Prevent writing to most of /
16 + ProtectHome = true; # Prevent accessing /home and /root
17 + PrivateTmp = true; # Give an own directory under /tmp
18 + PrivateDevices = true; # Deny access to most of /dev
19 + ProtectKernelTunables = true; # Protect some parts of /sys
20 + ProtectControlGroups = true; # Remount cgroups read-only
21 + RestrictSUIDSGID = true; # Prevent creating SETUID/SETGID files
22 + PrivateMounts = true; # Give an own mount namespace
23 + RemoveIPC = true;
24 + UMask = "0077";
25 +
26 + Restart = "always";
27 + RestartSec = "5s";
28 + ExecStart = "${pkgs.ofborg}/bin/github-webhook-receiver /etc/ofborg.json";
29 + User = "ofborg-github-webhook-receiver";
30 + Group = "ofborg-github-webhook-receiver";
31 +
32 + # Capabilities
33 + CapabilityBoundingSet = ""; # Allow no capabilities at all
34 + NoNewPrivileges = true; # Disallow getting more capabilities. This is also implied by other options.
35 +
36 + # Kernel stuff
37 + ProtectKernelModules = true; # Prevent loading of kernel modules
38 + SystemCallArchitectures = "native"; # Usually no need to disable this
39 + ProtectKernelLogs = true; # Prevent access to kernel logs
40 + ProtectClock = true; # Prevent setting the RTC
41 +
42 + # Misc
43 + LockPersonality = true; # Prevent change of the personality
44 + ProtectHostname = true; # Give an own UTS namespace
45 + RestrictRealtime = true; # Prevent switching to RT scheduling
46 + MemoryDenyWriteExecute = true; # Maybe disable this for interpreters like python
47 + PrivateUsers = true; # If anything randomly breaks, it's mostly because of this
48 + RestrictNamespaces = true;
49 + SystemCallFilter = "@system-service";
50 + };
51 + };
52 +
53 + services.nginx.virtualHosts."gh-webhook.ofborg.org" = {
54 + forceSSL = true;
55 + enableACME = true;
56 +
57 + locations."/".proxyPass = "http://[::1]:9899/";
58 + };
59 +
60 + users.users.ofborg-github-webhook-receiver = {
61 + isSystemUser = true;
62 + group = "ofborg-github-webhook-receiver";
63 + description = "ofBorg Github webhook receiver system user";
64 + };
65 + users.groups.ofborg-github-webhook-receiver = { };
66 +
67 + sops.secrets = {
68 + "ofborg/github-webhook-secret" = {
69 + owner = "ofborg-github-webhook-receiver";
70 + restartUnits = [ "ofborg-github-webhook-receiver.service" ];
71 + sopsFile = ../../secrets/ofborg.core01.ofborg.org.yml;
72 + };
73 +
74 + "ofborg/github-webhook-rabbitmq-password" = {
75 + owner = "ofborg-github-webhook-receiver";
76 + restartUnits = [ "ofborg-github-webhook-receiver.service" ];
77 + sopsFile = ../../secrets/ofborg.core01.ofborg.org.yml;
78 + };
79 + };
80 +}
non-critical-infra/hosts/core01.ofborg.org/log-message-collector.nix new
+69
@@ -0,0 +1,69 @@
1 +{ config, pkgs, ... }:
2 +
3 +{
4 + systemd.services.ofborg-log-message-collector = {
5 + description = "ofBorg log message collector";
6 +
7 + wantedBy = [ "ofborg.target" ];
8 + bindsTo = [ "ofborg.target" ];
9 + restartTriggers = [ config.environment.etc."ofborg.json".source ];
10 +
11 + stopIfChanged = false;
12 + unitConfig.StartLimitIntervalSec = 0;
13 + serviceConfig = {
14 + # Filesystem stuff
15 + ProtectSystem = "strict"; # Prevent writing to most of /
16 + ProtectHome = true; # Prevent accessing /home and /root
17 + PrivateTmp = true; # Give an own directory under /tmp
18 + PrivateDevices = true; # Deny access to most of /dev
19 + ProtectKernelTunables = true; # Protect some parts of /sys
20 + ProtectControlGroups = true; # Remount cgroups read-only
21 + RestrictSUIDSGID = true; # Prevent creating SETUID/SETGID files
22 + PrivateMounts = true; # Give an own mount namespace
23 + RemoveIPC = true;
24 + UMask = "0027";
25 +
26 + Restart = "always";
27 + RestartSec = "5s";
28 + ExecStart = "${pkgs.ofborg}/bin/log-message-collector /etc/ofborg.json";
29 + User = "ofborg-logs";
30 + Group = "ofborg-logs";
31 +
32 + LogsDirectory = "ofborg";
33 +
34 + # Capabilities
35 + CapabilityBoundingSet = ""; # Allow no capabilities at all
36 + NoNewPrivileges = true; # Disallow getting more capabilities. This is also implied by other options.
37 +
38 + # Kernel stuff
39 + ProtectKernelModules = true; # Prevent loading of kernel modules
40 + SystemCallArchitectures = "native"; # Usually no need to disable this
41 + ProtectKernelLogs = true; # Prevent access to kernel logs
42 + ProtectClock = true; # Prevent setting the RTC
43 +
44 + # Misc
45 + LockPersonality = true; # Prevent change of the personality
46 + ProtectHostname = true; # Give an own UTS namespace
47 + RestrictRealtime = true; # Prevent switching to RT scheduling
48 + MemoryDenyWriteExecute = true; # Maybe disable this for interpreters like python
49 + PrivateUsers = true; # If anything randomly breaks, it's mostly because of this
50 + RestrictNamespaces = true;
51 + SystemCallFilter = "@system-service";
52 + };
53 + };
54 +
55 + users.users.ofborg-logs = {
56 + isSystemUser = true;
57 + group = "ofborg-logs";
58 + description = "ofBorg logs user";
59 + };
60 + users.groups.ofborg-logs = { };
61 +
62 + sops.secrets = {
63 + "ofborg/log-message-collector-rabbitmq-password" = {
64 + owner = "ofborg-logs";
65 + restartUnits = [ "ofborg-log-message-collector.service" ];
66 + sopsFile = ../../secrets/ofborg.core01.ofborg.org.yml;
67 + };
68 + };
69 +}
non-critical-infra/hosts/core01.ofborg.org/log-viewer.nix new
+102
@@ -0,0 +1,102 @@
1 +{
2 + config,
3 + pkgs,
4 + inputs,
5 + ...
6 +}:
7 +let
8 + logviewer = import "${inputs.ofborg-viewer}/release.nix" { inherit pkgs; };
9 +in
10 +{
11 + systemd.services.ofborg-logapi = {
12 + description = "ofBorg log api";
13 +
14 + wantedBy = [ "ofborg.target" ];
15 + bindsTo = [ "ofborg.target" ];
16 + restartTriggers = [ config.environment.etc."ofborg.json".source ];
17 +
18 + stopIfChanged = false;
19 + unitConfig.StartLimitIntervalSec = 0;
20 + serviceConfig = {
21 + # Filesystem stuff
22 + ProtectSystem = "strict"; # Prevent writing to most of /
23 + ProtectHome = true; # Prevent accessing /home and /root
24 + PrivateTmp = true; # Give an own directory under /tmp
25 + PrivateDevices = true; # Deny access to most of /dev
26 + ProtectKernelTunables = true; # Protect some parts of /sys
27 + ProtectControlGroups = true; # Remount cgroups read-only
28 + RestrictSUIDSGID = true; # Prevent creating SETUID/SETGID files
29 + PrivateMounts = true; # Give an own mount namespace
30 + RemoveIPC = true;
31 + UMask = "0077";
32 +
33 + Restart = "always";
34 + RestartSec = "5s";
35 + ExecStart = "${pkgs.ofborg}/bin/logapi /etc/ofborg.json";
36 + User = "ofborg-logapi";
37 + Group = "ofborg-logapi";
38 +
39 + # Capabilities
40 + CapabilityBoundingSet = ""; # Allow no capabilities at all
41 + NoNewPrivileges = true; # Disallow getting more capabilities. This is also implied by other options.
42 +
43 + # Kernel stuff
44 + ProtectKernelModules = true; # Prevent loading of kernel modules
45 + SystemCallArchitectures = "native"; # Usually no need to disable this
46 + ProtectKernelLogs = true; # Prevent access to kernel logs
47 + ProtectClock = true; # Prevent setting the RTC
48 +
49 + # Misc
50 + LockPersonality = true; # Prevent change of the personality
51 + ProtectHostname = true; # Give an own UTS namespace
52 + RestrictRealtime = true; # Prevent switching to RT scheduling
53 + MemoryDenyWriteExecute = true; # Maybe disable this for interpreters like python
54 + PrivateUsers = true; # If anything randomly breaks, it's mostly because of this
55 + RestrictNamespaces = true;
56 + SystemCallFilter = "@system-service";
57 + };
58 + };
59 +
60 + users = {
61 + users.ofborg-logapi = {
62 + isSystemUser = true;
63 + group = "ofborg-logapi";
64 + description = "ofBorg Log Api";
65 + extraGroups = [ "ofborg-logs" ];
66 + };
67 + groups.ofborg-logapi = { };
68 + users.nginx.extraGroups = [ "ofborg-logs" ];
69 + };
70 +
71 + services.nginx.virtualHosts."logs.ofborg.org" = {
72 + forceSSL = true;
73 + enableACME = true;
74 + root = "${logviewer}/website";
75 +
76 + locations = {
77 + "/logfile/" = {
78 + alias = "/var/log/ofborg/";
79 + extraConfig = ''
80 + add_header Access-Control-Allow-Origin "*";
81 + add_header Access-Control-Request-Method "GET";
82 + add_header Content-Security-Policy "default-src 'none'; sandbox;";
83 + add_header Content-Type "text/plain; charset=utf-8";
84 + add_header X-Content-Type-Options "nosniff";
85 + add_header X-Frame-Options "deny";
86 + add_header X-XSS-Protection "1; mode=block";
87 + '';
88 + };
89 +
90 + "/logs/" = {
91 + proxyPass = "http://[::1]:9898";
92 + extraConfig = ''
93 + add_header Access-Control-Allow-Origin "*";
94 + add_header Access-Control-Request-Method "GET";
95 + add_header Content-Security-Policy "default-src 'none'; sandbox;";
96 + add_header X-Content-Type-Options "nosniff";
97 + add_header X-XSS-Protection "1; mode=block";
98 + '';
99 + };
100 + };
101 + };
102 +}
non-critical-infra/hosts/core01.ofborg.org/nginx.nix new
+13
@@ -0,0 +1,13 @@
1 +{
2 + imports = [
3 + ../../modules/nginx.nix
4 + ];
5 +
6 + services.nginx.virtualHosts."core01.ofborg.org" = {
7 + forceSSL = true;
8 + enableACME = true;
9 +
10 + locations."= /metrics/node".proxyPass = "http://[::1]:9100/metrics";
11 + locations."= /metrics/rabbitmq".proxyPass = "http://[::1]:15692/metrics";
12 + };
13 +}
non-critical-infra/hosts/core01.ofborg.org/rabbitmq.nix new
+71
@@ -0,0 +1,71 @@
1 +{ config, ... }:
2 +
3 +{
4 + services.rabbitmq = {
5 + enable = true;
6 + plugins = [
7 + "rabbitmq_shovel"
8 + "rabbitmq_shovel_management"
9 + # https://www.rabbitmq.com/docs/prometheus#overview-prometheus
10 + "rabbitmq_prometheus"
11 + # https://www.rabbitmq.com/docs/management
12 + "rabbitmq_management"
13 + # ofborg-viewer, https://www.rabbitmq.com/docs/web-stomp
14 + "rabbitmq_web_stomp"
15 + ];
16 + configItems = {
17 + # Consumer
18 + "consumer_timeout" = "28800000"; # 8h
19 +
20 + # TLS
21 + "listeners.tcp" = "none";
22 + "listeners.ssl.default" = "5671";
23 + "ssl_options.cacertfile" = "${
24 + config.security.acme.certs."messages.ofborg.org".directory
25 + }/chain.pem";
26 + "ssl_options.certfile" = "${config.security.acme.certs."messages.ofborg.org".directory}/cert.pem";
27 + "ssl_options.keyfile" = "${config.security.acme.certs."messages.ofborg.org".directory}/key.pem";
28 + "ssl_options.versions.1" = "tlsv1.3";
29 +
30 + # Auth
31 + "auth_mechanisms.1" = "PLAIN";
32 + "auth_mechanisms.2" = "AMQPLAIN";
33 + "anonymous_login_user" = "none";
34 +
35 + # Web interface
36 + "management.tcp.ip" = "::1";
37 + "management.tcp.port" = "15672";
38 +
39 + # Prometheus
40 + "cluster_name" = "messages.ofborg.org";
41 + "prometheus.tcp.ip" = "::1";
42 +
43 + # STOMP for ofborg-viewer
44 + "web_stomp.ssl.ip" = "::";
45 + "web_stomp.ssl.port" = "15673";
46 + "web_stomp.ssl.cacertfile" = "${
47 + config.security.acme.certs."messages.ofborg.org".directory
48 + }/chain.pem";
49 + "web_stomp.ssl.certfile" = "${config.security.acme.certs."messages.ofborg.org".directory}/cert.pem";
50 + "web_stomp.ssl.keyfile" = "${config.security.acme.certs."messages.ofborg.org".directory}/key.pem";
51 + };
52 + };
53 +
54 + # No need to reload RabbitMQ, this happens automatically every couple minutes
55 + security.acme.certs."messages.ofborg.org" = {
56 + webroot = "/var/lib/acme/acme-challenge";
57 + group = "rabbitmq";
58 + };
59 +
60 + systemd.services.rabbitmq = {
61 + stopIfChanged = false;
62 + requires = [ "acme-messages.ofborg.org.service" ];
63 + # https://github.com/rabbitmq/rabbitmq-server-release/issues/51
64 + serviceConfig.SuccessExitStatus = "69";
65 + };
66 +
67 + networking.firewall.allowedTCPPorts = [
68 + 5671
69 + 15673
70 + ];
71 +}
non-critical-infra/hosts/eval01.ofborg.org/default.nix new
+44
@@ -0,0 +1,44 @@
1 +{ inputs, ... }:
2 +
3 +{
4 + imports = [
5 + inputs.srvos.nixosModules.hardware-hetzner-cloud-arm
6 + ../../modules/ofborg/evaluator.nix
7 + ./hardware.nix
8 + ];
9 +
10 + # Bootloader.
11 + boot.loader.systemd-boot.enable = true;
12 +
13 + networking = {
14 + hostName = "ofborg-eval01";
15 + domain = "ofborg.org";
16 + hostId = "007f0201";
17 + };
18 +
19 + disko.devices = import ./disko.nix;
20 +
21 + systemd.network.networks."10-uplink" = {
22 + matchConfig.MACAddress = "96:00:03:f4:25:ec";
23 + address = [
24 + "95.217.15.9/32"
25 + "2a01:4f9:c012:cf00::1/64"
26 + ];
27 + routes = [
28 + { Gateway = "fe80::1"; }
29 + {
30 + Gateway = "172.31.1.1";
31 + GatewayOnLink = true;
32 + }
33 + ];
34 + linkConfig.RequiredForOnline = "routable";
35 + };
36 +
37 + system.stateVersion = "24.11"; # Did you read the comment?
38 +
39 + sops.secrets."ofborg/mass-rebuilder-rabbitmq-password" = {
40 + owner = "ofborg-mass-rebuilder";
41 + restartUnits = [ "ofborg-mass-rebuilder.service" ];
42 + sopsFile = ../../secrets/ofborg.eval01.ofborg.org.yml;
43 + };
44 +}
non-critical-infra/hosts/eval01.ofborg.org/disko.nix new
+64
@@ -0,0 +1,64 @@
1 +{
2 + disk = {
3 + main = {
4 + type = "disk";
5 + device = "/dev/sda";
6 + content = {
7 + type = "gpt";
8 + partitions = {
9 + boot = {
10 + size = "1G";
11 + type = "EF00";
12 + content = {
13 + type = "filesystem";
14 + format = "vfat";
15 + mountpoint = "/boot";
16 + mountOptions = [ "umask=0077" ];
17 + };
18 + };
19 + root = {
20 + size = "100%";
21 + content = {
22 + type = "zfs";
23 + pool = "zroot";
24 + };
25 + };
26 + };
27 + };
28 + };
29 + };
30 +
31 + zpool = {
32 + zroot = {
33 + type = "zpool";
34 + options = {
35 + # smartctl --all /dev/sda
36 + # Logical block size: 512 bytes
37 + ashift = "9";
38 + };
39 + rootFsOptions = {
40 + acltype = "posixacl";
41 + compression = "zstd";
42 + mountpoint = "none";
43 + xattr = "sa";
44 + };
45 + datasets = {
46 + "root" = {
47 + type = "zfs_fs";
48 + mountpoint = "/";
49 + };
50 + "nix" = {
51 + type = "zfs_fs";
52 + mountpoint = "/nix";
53 + };
54 + "reserved" = {
55 + type = "zfs_fs";
56 + options = {
57 + canmount = "off";
58 + refreservation = "1G";
59 + };
60 + };
61 + };
62 + };
63 + };
64 +}
non-critical-infra/hosts/eval01.ofborg.org/hardware.nix new
+18
@@ -0,0 +1,18 @@
1 +{ lib, ... }:
2 +
3 +{
4 +
5 + boot.initrd.availableKernelModules = [
6 + "xhci_pci"
7 + "virtio_pci"
8 + "usbhid"
9 + "sr_mod"
10 + ];
11 + boot.initrd.kernelModules = [ "virtio_gpu" ];
12 + boot.kernelModules = [ ];
13 + boot.extraModulePackages = [ ];
14 +
15 + swapDevices = [ ];
16 +
17 + nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
18 +}
non-critical-infra/hosts/eval02.ofborg.org/client.crt new
+11
@@ -0,0 +1,11 @@
1 +-----BEGIN CERTIFICATE-----
2 +MIIBmDCCAUqgAwIBAgIUfUYjDOaJML1lIMkAMvLjnSTscY0wBQYDK2VwMEMxCzAJ
3 +BgNVBAYTAkRFMRQwEgYDVQQKDAtOaXhPUyBJbmZyYTEeMBwGA1UEAwwVaHlkcmEt
4 +cXVldWUtcnVubmVyLWNhMCAXDTI1MDczMTEyMDQxN1oYDzIwNzUwNzE5MTIwNDE3
5 +WjBPMQswCQYDVQQGEwJERTEUMBIGA1UECgwLTml4T1MgSW5mcmExKjAoBgNVBAMM
6 +IWh5ZHJhLXF1ZXVlLWJ1aWxkZXItb2Zib3JnLWV2YWwwMjAqMAUGAytlcAMhAFcG
7 +BnePuRCpdx2IRfr+ZzL1OFlqMJGYiKKG0aVz58kyo0IwQDAdBgNVHQ4EFgQU7eLl
8 +cmwgQE5zEb2j/e3/WvQmyh4wHwYDVR0jBBgwFoAU0wQG6BxTKtYwlywuyD0aVr/1
9 +r4gwBQYDK2VwA0EAicmxp8HCEF7bwk8NjpayAEPAFq3SPqrl/Bg3ruZitdKUY/Mf
10 +5rEjjlCP6/GjzAfg8kki/t3dyv0Jn1uKjmaMBA==
11 +-----END CERTIFICATE-----
non-critical-infra/hosts/eval02.ofborg.org/default.nix new
+56
@@ -0,0 +1,56 @@
1 +{ inputs, ... }:
2 +{
3 + imports = [
4 + inputs.srvos.nixosModules.hardware-hetzner-cloud-arm
5 + ../../modules/ofborg/builder.nix
6 + ../../modules/hydra/builder.nix
7 + ./hardware.nix
8 + ];
9 +
10 + # Bootloader.
11 + boot.loader.systemd-boot.enable = true;
12 +
13 + networking = {
14 + hostName = "ofborg-eval02";
15 + domain = "ofborg.org";
16 + hostId = "007f0202";
17 + };
18 +
19 + disko.devices = import ./disko.nix;
20 +
21 + systemd.network.networks."10-uplink" = {
22 + matchConfig.MACAddress = "96:00:03:f4:25:ee";
23 + address = [
24 + "95.216.209.162/32"
25 + "2a01:4f9:c012:17c6::1/64"
26 + ];
27 + routes = [
28 + { Gateway = "fe80::1"; }
29 + {
30 + Gateway = "172.31.1.1";
31 + GatewayOnLink = true;
32 + }
33 + ];
34 + linkConfig.RequiredForOnline = "routable";
35 + };
36 +
37 + zramSwap = {
38 + enable = true;
39 + memoryPercent = 100;
40 + };
41 +
42 + system.stateVersion = "24.11"; # Did you read the comment?
43 +
44 + sops.secrets = {
45 + "ofborg/builder-rabbitmq-password" = {
46 + owner = "ofborg-builder";
47 + restartUnits = [ "ofborg-builder.service" ];
48 + sopsFile = ../../secrets/ofborg.eval02.ofborg.org.yml;
49 + };
50 + "harmonia/secret" = {
51 + owner = "harmonia";
52 + restartUnits = [ "harmonia.service" ];
53 + sopsFile = ../../secrets/ofborg.eval02.ofborg.org.yml;
54 + };
55 + };
56 +}
non-critical-infra/hosts/eval02.ofborg.org/disko.nix new
+64
@@ -0,0 +1,64 @@
1 +{
2 + disk = {
3 + main = {
4 + type = "disk";
5 + device = "/dev/sda";
6 + content = {
7 + type = "gpt";
8 + partitions = {
9 + boot = {
10 + size = "1G";
11 + type = "EF00";
12 + content = {
13 + type = "filesystem";
14 + format = "vfat";
15 + mountpoint = "/boot";
16 + mountOptions = [ "umask=0077" ];
17 + };
18 + };
19 + root = {
20 + size = "100%";
21 + content = {
22 + type = "zfs";
23 + pool = "zroot";
24 + };
25 + };
26 + };
27 + };
28 + };
29 + };
30 +
31 + zpool = {
32 + zroot = {
33 + type = "zpool";
34 + options = {
35 + # smartctl --all /dev/sda
36 + # Logical block size: 512 bytes
37 + ashift = "9";
38 + };
39 + rootFsOptions = {
40 + acltype = "posixacl";
41 + compression = "zstd";
42 + mountpoint = "none";
43 + xattr = "sa";
44 + };
45 + datasets = {
46 + "root" = {
47 + type = "zfs_fs";
48 + mountpoint = "/";
49 + };
50 + "nix" = {
51 + type = "zfs_fs";
52 + mountpoint = "/nix";
53 + };
54 + "reserved" = {
55 + type = "zfs_fs";
56 + options = {
57 + canmount = "off";
58 + refreservation = "1G";
59 + };
60 + };
61 + };
62 + };
63 + };
64 +}
non-critical-infra/hosts/eval02.ofborg.org/hardware.nix new
+18
@@ -0,0 +1,18 @@
1 +{ lib, ... }:
2 +
3 +{
4 +
5 + boot.initrd.availableKernelModules = [
6 + "xhci_pci"
7 + "virtio_pci"
8 + "usbhid"
9 + "sr_mod"
10 + ];
11 + boot.initrd.kernelModules = [ "virtio_gpu" ];
12 + boot.kernelModules = [ ];
13 + boot.extraModulePackages = [ ];
14 +
15 + swapDevices = [ ];
16 +
17 + nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
18 +}
non-critical-infra/hosts/eval03.ofborg.org/client.crt new
+11
@@ -0,0 +1,11 @@
1 +-----BEGIN CERTIFICATE-----
2 +MIIBmDCCAUqgAwIBAgIUfUYjDOaJML1lIMkAMvLjnSTscY4wBQYDK2VwMEMxCzAJ
3 +BgNVBAYTAkRFMRQwEgYDVQQKDAtOaXhPUyBJbmZyYTEeMBwGA1UEAwwVaHlkcmEt
4 +cXVldWUtcnVubmVyLWNhMCAXDTI1MDczMTEyMDQxN1oYDzIwNzUwNzE5MTIwNDE3
5 +WjBPMQswCQYDVQQGEwJERTEUMBIGA1UECgwLTml4T1MgSW5mcmExKjAoBgNVBAMM
6 +IWh5ZHJhLXF1ZXVlLWJ1aWxkZXItb2Zib3JnLWV2YWwwMzAqMAUGAytlcAMhAB0a
7 +xge5pV7G50sB0vcIUlSMLQH09Wtu1lpVMkyZJhwYo0IwQDAdBgNVHQ4EFgQU8fyD
8 +i3r+cVJo4Yg6O6jyKzhKVucwHwYDVR0jBBgwFoAU0wQG6BxTKtYwlywuyD0aVr/1
9 +r4gwBQYDK2VwA0EARtdZCQID1oUjAZojQLw+pquY9QUrePC8LIBUPzMsqyunJYSC
10 +jths2dINWC4p2x6rhkAAfsi+AaCLRXwZHdWcBA==
11 +-----END CERTIFICATE-----
non-critical-infra/hosts/eval03.ofborg.org/default.nix new
+56
@@ -0,0 +1,56 @@
1 +{ inputs, ... }:
2 +{
3 + imports = [
4 + inputs.srvos.nixosModules.hardware-hetzner-cloud-arm
5 + ../../modules/ofborg/builder.nix
6 + ../../modules/hydra/builder.nix
7 + ./hardware.nix
8 + ];
9 +
10 + # Bootloader.
11 + boot.loader.systemd-boot.enable = true;
12 +
13 + networking = {
14 + hostName = "ofborg-eval03";
15 + domain = "ofborg.org";
16 + hostId = "007f0203";
17 + };
18 +
19 + disko.devices = import ./disko.nix;
20 +
21 + systemd.network.networks."10-uplink" = {
22 + matchConfig.MACAddress = "96:00:03:f4:25:ed";
23 + address = [
24 + "37.27.189.4/32"
25 + "2a01:4f9:c012:e37b::1/64"
26 + ];
27 + routes = [
28 + { Gateway = "fe80::1"; }
29 + {
30 + Gateway = "172.31.1.1";
31 + GatewayOnLink = true;
32 + }
33 + ];
34 + linkConfig.RequiredForOnline = "routable";
35 + };
36 +
37 + zramSwap = {
38 + enable = true;
39 + memoryPercent = 100;
40 + };
41 +
42 + system.stateVersion = "24.11"; # Did you read the comment?
43 +
44 + sops.secrets = {
45 + "ofborg/builder-rabbitmq-password" = {
46 + owner = "ofborg-builder";
47 + restartUnits = [ "ofborg-builder.service" ];
48 + sopsFile = ../../secrets/ofborg.eval03.ofborg.org.yml;
49 + };
50 + "harmonia/secret" = {
51 + owner = "harmonia";
52 + restartUnits = [ "harmonia.service" ];
53 + sopsFile = ../../secrets/ofborg.eval03.ofborg.org.yml;
54 + };
55 + };
56 +}
non-critical-infra/hosts/eval03.ofborg.org/disko.nix new
+64
@@ -0,0 +1,64 @@
1 +{
2 + disk = {
3 + main = {
4 + type = "disk";
5 + device = "/dev/sda";
6 + content = {
7 + type = "gpt";
8 + partitions = {
9 + boot = {
10 + size = "1G";
11 + type = "EF00";
12 + content = {
13 + type = "filesystem";
14 + format = "vfat";
15 + mountpoint = "/boot";
16 + mountOptions = [ "umask=0077" ];
17 + };
18 + };
19 + root = {
20 + size = "100%";
21 + content = {
22 + type = "zfs";
23 + pool = "zroot";
24 + };
25 + };
26 + };
27 + };
28 + };
29 + };
30 +
31 + zpool = {
32 + zroot = {
33 + type = "zpool";
34 + options = {
35 + # smartctl --all /dev/sda
36 + # Logical block size: 512 bytes
37 + ashift = "9";
38 + };
39 + rootFsOptions = {
40 + acltype = "posixacl";
41 + compression = "zstd";
42 + mountpoint = "none";
43 + xattr = "sa";
44 + };
45 + datasets = {
46 + "root" = {
47 + type = "zfs_fs";
48 + mountpoint = "/";
49 + };
50 + "nix" = {
51 + type = "zfs_fs";
52 + mountpoint = "/nix";
53 + };
54 + "reserved" = {
55 + type = "zfs_fs";
56 + options = {
57 + canmount = "off";
58 + refreservation = "1G";
59 + };
60 + };
61 + };
62 + };
63 + };
64 +}
non-critical-infra/hosts/eval03.ofborg.org/hardware.nix new
+18
@@ -0,0 +1,18 @@
1 +{ lib, ... }:
2 +
3 +{
4 +
5 + boot.initrd.availableKernelModules = [
6 + "xhci_pci"
7 + "virtio_pci"
8 + "usbhid"
9 + "sr_mod"
10 + ];
11 + boot.initrd.kernelModules = [ "virtio_gpu" ];
12 + boot.kernelModules = [ ];
13 + boot.extraModulePackages = [ ];
14 +
15 + swapDevices = [ ];
16 +
17 + nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
18 +}
non-critical-infra/hosts/eval04.ofborg.org/client.crt new
+11
@@ -0,0 +1,11 @@
1 +-----BEGIN CERTIFICATE-----
2 +MIIBmDCCAUqgAwIBAgIUfUYjDOaJML1lIMkAMvLjnSTscY8wBQYDK2VwMEMxCzAJ
3 +BgNVBAYTAkRFMRQwEgYDVQQKDAtOaXhPUyBJbmZyYTEeMBwGA1UEAwwVaHlkcmEt
4 +cXVldWUtcnVubmVyLWNhMCAXDTI1MDczMTEyMDQxN1oYDzIwNzUwNzE5MTIwNDE3
5 +WjBPMQswCQYDVQQGEwJERTEUMBIGA1UECgwLTml4T1MgSW5mcmExKjAoBgNVBAMM
6 +IWh5ZHJhLXF1ZXVlLWJ1aWxkZXItb2Zib3JnLWV2YWwwNDAqMAUGAytlcAMhAFcS
7 +v8kRpmT4XxN9Wpy1eUleEAfaTYjkRDNLvx/wyzmco0IwQDAdBgNVHQ4EFgQUyBE8
8 ++NWvcR45rtQz1Kq2T4rdca0wHwYDVR0jBBgwFoAU0wQG6BxTKtYwlywuyD0aVr/1
9 +r4gwBQYDK2VwA0EAP1fJ6PHx+1Y9HSEn0WEndXVf/BW/rsPAwrxPPUZSX6FbwsPQ
10 +uEIx9gIfy02H7S+qTNsXHH/YG3Vk3ZLcBDVLAg==
11 +-----END CERTIFICATE-----
non-critical-infra/hosts/eval04.ofborg.org/default.nix new
+57
@@ -0,0 +1,57 @@
1 +{ inputs, ... }:
2 +{
3 + imports = [
4 + inputs.srvos.nixosModules.hardware-hetzner-cloud-arm
5 + ../../modules/ofborg/builder.nix
6 + ../../modules/hydra/builder.nix
7 + # ../../modules/ofborg/evaluator.nix
8 + ./hardware.nix
9 + ];
10 +
11 + # Bootloader.
12 + boot.loader.systemd-boot.enable = true;
13 +
14 + networking = {
15 + hostName = "ofborg-eval04";
16 + domain = "ofborg.org";
17 + hostId = "007f0204";
18 + };
19 +
20 + disko.devices = import ./disko.nix;
21 +
22 + systemd.network.networks."10-uplink" = {
23 + matchConfig.MACAddress = "96:00:03:f4:25:eb";
24 + address = [
25 + "95.217.18.12/32"
26 + "2a01:4f9:c012:273b::/64"
27 + ];
28 + routes = [
29 + { Gateway = "fe80::1"; }
30 + {
31 + Gateway = "172.31.1.1";
32 + GatewayOnLink = true;
33 + }
34 + ];
35 + linkConfig.RequiredForOnline = "routable";
36 + };
37 +
38 + zramSwap = {
39 + enable = true;
40 + memoryPercent = 100;
41 + };
42 +
43 + system.stateVersion = "24.11"; # Did you read the comment?
44 +
45 + sops.secrets = {
46 + "ofborg/builder-rabbitmq-password" = {
47 + owner = "ofborg-builder";
48 + restartUnits = [ "ofborg-builder.service" ];
49 + sopsFile = ../../secrets/ofborg.eval04.ofborg.org.yml;
50 + };
51 + "harmonia/secret" = {
52 + owner = "harmonia";
53 + restartUnits = [ "harmonia.service" ];
54 + sopsFile = ../../secrets/ofborg.eval04.ofborg.org.yml;
55 + };
56 + };
57 +}
non-critical-infra/hosts/eval04.ofborg.org/disko.nix new
+64
@@ -0,0 +1,64 @@
1 +{
2 + disk = {
3 + main = {
4 + type = "disk";
5 + device = "/dev/sda";
6 + content = {
7 + type = "gpt";
8 + partitions = {
9 + boot = {
10 + size = "1G";
11 + type = "EF00";
12 + content = {
13 + type = "filesystem";
14 + format = "vfat";
15 + mountpoint = "/boot";
16 + mountOptions = [ "umask=0077" ];
17 + };
18 + };
19 + root = {
20 + size = "100%";
21 + content = {
22 + type = "zfs";
23 + pool = "zroot";
24 + };
25 + };
26 + };
27 + };
28 + };
29 + };
30 +
31 + zpool = {
32 + zroot = {
33 + type = "zpool";
34 + options = {
35 + # smartctl --all /dev/sda
36 + # Logical block size: 512 bytes
37 + ashift = "9";
38 + };
39 + rootFsOptions = {
40 + acltype = "posixacl";
41 + compression = "zstd";
42 + mountpoint = "none";
43 + xattr = "sa";
44 + };
45 + datasets = {
46 + "root" = {
47 + type = "zfs_fs";
48 + mountpoint = "/";
49 + };
50 + "nix" = {
51 + type = "zfs_fs";
52 + mountpoint = "/nix";
53 + };
54 + "reserved" = {
55 + type = "zfs_fs";
56 + options = {
57 + canmount = "off";
58 + refreservation = "1G";
59 + };
60 + };
61 + };
62 + };
63 + };
64 +}
non-critical-infra/hosts/eval04.ofborg.org/hardware.nix new
+18
@@ -0,0 +1,18 @@
1 +{ lib, ... }:
2 +
3 +{
4 +
5 + boot.initrd.availableKernelModules = [
6 + "xhci_pci"
7 + "virtio_pci"
8 + "usbhid"
9 + "sr_mod"
10 + ];
11 + boot.initrd.kernelModules = [ "virtio_gpu" ];
12 + boot.kernelModules = [ ];
13 + boot.extraModulePackages = [ ];
14 +
15 + swapDevices = [ ];
16 +
17 + nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
18 +}
non-critical-infra/modules/hydra/builder.nix new
+37
@@ -0,0 +1,37 @@
1 +{ inputs, config, ... }:
2 +let
3 + nodes = {
4 + ofborg-eval02 = "eval02.ofborg.org";
5 + ofborg-eval03 = "eval03.ofborg.org";
6 + ofborg-eval04 = "eval04.ofborg.org";
7 + ofborg-build01 = "build01.ofborg.org";
8 + ofborg-build02 = "build02.ofborg.org";
9 + ofborg-build03 = "build03.ofborg.org";
10 + ofborg-build04 = "build04.ofborg.org";
11 + ofborg-build05 = "build05.ofborg.org";
12 + };
13 + nodePath = nodes."${config.networking.hostName}";
14 +in
15 +{
16 + imports = [
17 + inputs.hydra-staging.nixosModules.builder
18 + ];
19 +
20 + services.hydra-queue-builder-dev = {
21 + enable = true;
22 + queueRunnerAddr = "https://queue-runner.staging-hydra.nixos.org";
23 + maxJobs = 2;
24 + mtls = {
25 + serverRootCaCertPath = ../../hosts/staging-hydra/ca.crt;
26 + clientCertPath = "${../../hosts/${nodePath}/client.crt}";
27 + clientKeyPath = config.sops.secrets."queue-runner-client.key".path;
28 + domainName = "queue-runner.staging-hydra.nixos.org";
29 + };
30 + };
31 +
32 + sops.secrets."queue-runner-client.key" = {
33 + owner = "hydra-queue-builder";
34 + restartUnits = [ "hydra-queue-builder-dev.service" ];
35 + sopsFile = ../../secrets/ofborg.${nodePath}.yml;
36 + };
37 +}
non-critical-infra/modules/ofborg/builder.nix new
+92
@@ -0,0 +1,92 @@
1 +{ config, pkgs, ... }:
2 +
3 +{
4 + imports = [
5 + ./common.nix
6 + ./ofborg-config.nix
7 + ./harmonia.nix
8 + ];
9 +
10 + networking.extraHosts = ''
11 + 95.216.209.162 eval02.ofborg.org
12 + 37.27.189.4 eval03.ofborg.org
13 + 95.217.18.12 eval04.ofborg.org
14 +
15 + 185.119.168.10 build01.ofborg.org
16 + 185.119.168.11 build02.ofborg.org
17 + 185.119.168.12 build03.ofborg.org
18 + 185.119.168.13 build04.ofborg.org
19 + 142.132.171.106 build05.ofborg.org
20 + '';
21 +
22 + deployment.tags = [ "ofborg-builder" ];
23 +
24 + systemd.services.ofborg-builder = {
25 + description = "ofBorg builder";
26 +
27 + wantedBy = [ "ofborg.target" ];
28 + bindsTo = [ "ofborg.target" ];
29 + restartTriggers = [ config.environment.etc."ofborg.json".source ];
30 +
31 + path = [
32 + config.nix.package
33 + config.programs.git.package
34 + ];
35 +
36 + environment = {
37 + GIT_AUTHOR_NAME = "OfBorg";
38 + GIT_COMMITTER_NAME = "OfBorg";
39 + EMAIL = "ofborg@nixos.org";
40 + };
41 +
42 + stopIfChanged = false;
43 + unitConfig.StartLimitIntervalSec = 0;
44 + serviceConfig = {
45 + # Filesystem stuff
46 + ProtectSystem = "strict"; # Prevent writing to most of /
47 + ProtectHome = true; # Prevent accessing /home and /root
48 + PrivateTmp = true; # Give an own directory under /tmp
49 + PrivateDevices = true; # Deny access to most of /dev
50 + ProtectKernelTunables = true; # Protect some parts of /sys
51 + ProtectControlGroups = true; # Remount cgroups read-only
52 + RestrictSUIDSGID = true; # Prevent creating SETUID/SETGID files
53 + PrivateMounts = true; # Give an own mount namespace
54 + RemoveIPC = true;
55 + UMask = "0077";
56 +
57 + Restart = "always";
58 + RestartSec = "5s";
59 + ExecStart = "${pkgs.ofborg}/bin/builder /etc/ofborg.json";
60 + User = "ofborg-builder";
61 + Group = "ofborg-builder";
62 +
63 + StateDirectory = [ "ofborg/checkout" ];
64 +
65 + # Capabilities
66 + CapabilityBoundingSet = ""; # Allow no capabilities at all
67 + NoNewPrivileges = true; # Disallow getting more capabilities. This is also implied by other options.
68 +
69 + # Kernel stuff
70 + ProtectKernelModules = true; # Prevent loading of kernel modules
71 + SystemCallArchitectures = "native"; # Usually no need to disable this
72 + ProtectKernelLogs = true; # Prevent access to kernel logs
73 + ProtectClock = true; # Prevent setting the RTC
74 +
75 + # Misc
76 + LockPersonality = true; # Prevent change of the personality
77 + ProtectHostname = true; # Give an own UTS namespace
78 + RestrictRealtime = true; # Prevent switching to RT scheduling
79 + MemoryDenyWriteExecute = true; # Maybe disable this for interpreters like python
80 + PrivateUsers = true; # If anything randomly breaks, it's mostly because of this
81 + RestrictNamespaces = true;
82 + SystemCallFilter = "@system-service";
83 + };
84 + };
85 +
86 + users.users.ofborg-builder = {
87 + isSystemUser = true;
88 + group = "ofborg-builder";
89 + description = "ofBorg builder system user";
90 + };
91 + users.groups.ofborg-builder = { };
92 +}
non-critical-infra/modules/ofborg/common.nix new
+33
@@ -0,0 +1,33 @@
1 +{ inputs, ... }:
2 +{
3 + imports = [
4 + inputs.srvos.nixosModules.server
5 + ../../../modules/common.nix
6 + ../common.nix
7 + ./ofborg-config.nix
8 + ];
9 +
10 + nix.gc.automatic = true;
11 +
12 + # TODO wire up exporters
13 + # TODO loki
14 +
15 + # Not part of the infra team
16 + users.users.root.openssh.authorizedKeys.keys = [
17 + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM35Bq87SBWrEcoDqrZFOXyAmV/PJrSSu3hl3TdVvo4C janne"
18 + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPK/3rYhlIzoPCsPK38PMdK1ivqPaJgUqWwRtmxdKZrO ✏️"
19 + ];
20 +
21 + nixpkgs.overlays = [
22 + (_self: super: {
23 + ofborg = inputs.ofborg.packages.${super.stdenv.hostPlatform.system}.pkg;
24 + })
25 + ];
26 +
27 + systemd.targets.ofborg = {
28 + description = "ofBorg target";
29 + wantedBy = [ "multi-user.target" ];
30 + };
31 +
32 + deployment.tags = [ "ofborg" ];
33 +}
non-critical-infra/modules/ofborg/evaluator.nix new
+91
@@ -0,0 +1,91 @@
1 +{ config, pkgs, ... }:
2 +
3 +{
4 + imports = [
5 + ./common.nix
6 + ./ofborg-config.nix
7 + ./github-tokens.nix
8 + ];
9 +
10 + deployment.tags = [ "ofborg-evaluator" ];
11 +
12 + systemd.services.ofborg-mass-rebuilder = {
13 + description = "ofBorg mass rebuilder";
14 +
15 + wantedBy = [ "ofborg.target" ];
16 + bindsTo = [ "ofborg.target" ];
17 + restartTriggers = [ config.environment.etc."ofborg.json".source ];
18 +
19 + path = [
20 + config.nix.package
21 + config.programs.git.package
22 + ];
23 +
24 + environment = {
25 + GIT_AUTHOR_NAME = "OfBorg";
26 + GIT_COMMITTER_NAME = "OfBorg";
27 + EMAIL = "ofborg@nixos.org";
28 + };
29 +
30 + stopIfChanged = false;
31 + unitConfig.StartLimitIntervalSec = 0;
32 + serviceConfig = {
33 + # Filesystem stuff
34 + ProtectSystem = "strict"; # Prevent writing to most of /
35 + ProtectHome = true; # Prevent accessing /home and /root
36 + PrivateTmp = true; # Give an own directory under /tmp
37 + PrivateDevices = true; # Deny access to most of /dev
38 + ProtectKernelTunables = true; # Protect some parts of /sys
39 + ProtectControlGroups = true; # Remount cgroups read-only
40 + RestrictSUIDSGID = true; # Prevent creating SETUID/SETGID files
41 + PrivateMounts = true; # Give an own mount namespace
42 + RemoveIPC = true;
43 + UMask = "0077";
44 +
45 + Restart = "always";
46 + RestartSec = "5s";
47 + ExecStart = "${pkgs.ofborg}/bin/mass-rebuilder /etc/ofborg.json";
48 + User = "ofborg-mass-rebuilder";
49 + Group = "ofborg-mass-rebuilder";
50 + SupplementaryGroups = [
51 + "ofborg-github-oauth-secret"
52 + "ofborg-github-app-key"
53 + ];
54 +
55 + StateDirectory = [ "ofborg/checkout" ];
56 +
57 + # Capabilities
58 + CapabilityBoundingSet = ""; # Allow no capabilities at all
59 + NoNewPrivileges = true; # Disallow getting more capabilities. This is also implied by other options.
60 +
61 + # Kernel stuff
62 + ProtectKernelModules = true; # Prevent loading of kernel modules
63 + SystemCallArchitectures = "native"; # Usually no need to disable this
64 + ProtectKernelLogs = true; # Prevent access to kernel logs
65 + ProtectClock = true; # Prevent setting the RTC
66 +
67 + # Misc
68 + LockPersonality = true; # Prevent change of the personality
69 + ProtectHostname = true; # Give an own UTS namespace
70 + RestrictRealtime = true; # Prevent switching to RT scheduling
71 + MemoryDenyWriteExecute = true; # Maybe disable this for interpreters like python
72 + PrivateUsers = true; # If anything randomly breaks, it's mostly because of this
73 + RestrictNamespaces = true;
74 + SystemCallFilter = "@system-service";
75 + };
76 + };
77 +
78 + users.users.ofborg-mass-rebuilder = {
79 + isSystemUser = true;
80 + group = "ofborg-mass-rebuilder";
81 + description = "ofBorg mass rebuilder system user";
82 + };
83 + users.groups.ofborg-mass-rebuilder = { };
84 +
85 + programs.git.enable = true;
86 +
87 + sops.secrets = {
88 + "ofborg/github-oauth-secret".restartUnits = [ "ofborg-github-comment-filter.service" ];
89 + "ofborg/github-app-key".restartUnits = [ "ofborg-github-comment-filter.service" ];
90 + };
91 +}
non-critical-infra/modules/ofborg/github-tokens.nix new
+16
@@ -0,0 +1,16 @@
1 +{
2 + sops.secrets = {
3 + "ofborg/github-oauth-secret" = {
4 + mode = "0440";
5 + group = "ofborg-github-oauth-secret";
6 + sopsFile = ../../secrets/github-tokens.ofborg.org.yml;
7 + };
8 + "ofborg/github-app-key" = {
9 + mode = "0440";
10 + group = "ofborg-github-app-key";
11 + sopsFile = ../../secrets/github-tokens.ofborg.org.yml;
12 + };
13 + };
14 + users.groups."ofborg-github-oauth-secret" = { };
15 + users.groups."ofborg-github-app-key" = { };
16 +}
non-critical-infra/modules/ofborg/harmonia.nix new
+71
@@ -0,0 +1,71 @@
1 +{ config, lib, ... }:
2 +let
3 + nodes = {
4 + ofborg-eval02 = {
5 + substituter = "eval02.ofborg.org";
6 + public-key = "eval02.ofborg.org:85vbhZviIv2eeC3VKK2T/X/zzgIYLYjyGw3Pi+Pqh34=";
7 + };
8 + ofborg-eval03 = {
9 + substituter = "eval03.ofborg.org";
10 + public-key = "eval03.ofborg.org:HATIHUe6QMH83dbDpnUv9VeuaNDBjeWshW2monmRK1c=";
11 + };
12 + ofborg-eval04 = {
13 + substituter = "eval04.ofborg.org";
14 + public-key = "eval04.ofborg.org:k4s/u1JWDew+dwXcuFvAAVFK2DfN6ib+73iCwX5gkBE=";
15 + };
16 + ofborg-build01 = {
17 + substituter = "build01.ofborg.org";
18 + public-key = "build01.ofborg.org:Edgo6+RgHXa8nlxuLAgh18fMhQuXGdXNcYK6yNKQaQ8=";
19 + };
20 + ofborg-build02 = {
21 + substituter = "build02.ofborg.org";
22 + public-key = "build02.ofborg.org:uw5IBpYv129c8+ltrQ288TGvmE5JqNZA+q7GW3tDaUk=";
23 + };
24 + ofborg-build03 = {
25 + substituter = "build03.ofborg.org";
26 + public-key = "build03.ofborg.org:8LFTt2s1cbzniV4MLkT30qEHPY0cK3RP+6fk03GD3lw=";
27 + };
28 + ofborg-build04 = {
29 + substituter = "build04.ofborg.org";
30 + public-key = "build04.ofborg.org:NHEGj8moimu2TiZNIA4DOb4kVhvds6Vlzr2TAwX1mUY=";
31 + };
32 + ofborg-build05 = {
33 + substituter = "build05.ofborg.org";
34 + public-key = "build05.ofborg.org:RPuXIkyo86mCmsfYqyK/STIbPE+DM9Ixcw7HUe64Ss4=";
35 + };
36 + };
37 + ownNode = nodes."${config.networking.hostName}";
38 + allOtherNodes = lib.filterAttrs (n: _: n != config.networking.hostName) nodes;
39 +in
40 +{
41 + services.harmonia = {
42 + enable = true;
43 + signKeyPaths = [ "/run/secrets/harmonia/secret" ];
44 + settings = {
45 + priority = 50;
46 + };
47 + };
48 +
49 + nix.settings = {
50 + fallback = true;
51 + extra-substituters = lib.mapAttrsToList (_: config: "http://${config.substituter}") allOtherNodes;
52 + extra-trusted-public-keys = lib.mapAttrsToList (_: config: config.public-key) allOtherNodes;
53 + };
54 +
55 + networking.firewall.allowedTCPPorts = [ 80 ];
56 + services.nginx = {
57 + enable = true;
58 + recommendedTlsSettings = true;
59 + virtualHosts."${ownNode.substituter}" = {
60 + locations."/".extraConfig = ''
61 + proxy_pass http://127.0.0.1:5000;
62 + proxy_set_header Host $host;
63 + proxy_redirect http:// https://;
64 + proxy_http_version 1.1;
65 + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
66 + proxy_set_header Upgrade $http_upgrade;
67 + proxy_set_header Connection $connection_upgrade;
68 + '';
69 + };
70 + };
71 +}
non-critical-infra/modules/ofborg/ofborg-config.nix new
+94
@@ -0,0 +1,94 @@
1 +let
2 + rabbitmq = {
3 + host = "messages.ofborg.org";
4 + ssl = true;
5 + virtualhost = "ofborg";
6 + # Missing: username and password_file
7 + };
8 +in
9 +{
10 + config,
11 + pkgs,
12 + lib,
13 + ...
14 +}:
15 +{
16 + environment.etc."ofborg.json".text = builtins.toJSON {
17 + github_webhook_receiver = {
18 + listen = "[::1]:9899";
19 + webhook_secret_file = "/run/secrets/ofborg/github-webhook-secret";
20 + rabbitmq = rabbitmq // {
21 + username = "ofborg-github-webhook";
22 + password_file = "/run/secrets/ofborg/github-webhook-rabbitmq-password";
23 + };
24 + };
25 + log_api_config = {
26 + listen = "[::1]:9898";
27 + logs_path = "/var/log/ofborg";
28 + serve_root = "https://logs.ofborg.org/logfile";
29 + };
30 + evaluation_filter = {
31 + rabbitmq = rabbitmq // {
32 + username = "ofborg-evaluation-filter";
33 + password_file = "/run/secrets/ofborg/evaluation-filter-rabbitmq-password";
34 + };
35 + };
36 + github_comment_filter = {
37 + rabbitmq = rabbitmq // {
38 + username = "ofborg-github-comment-filter";
39 + password_file = "/run/secrets/ofborg/github-comment-filter-rabbitmq-password";
40 + };
41 + };
42 + github_comment_poster = {
43 + rabbitmq = rabbitmq // {
44 + username = "ofborg-github-comment-poster";
45 + password_file = "/run/secrets/ofborg/github-comment-poster-rabbitmq-password";
46 + };
47 + };
48 + log_message_collector = {
49 + rabbitmq = rabbitmq // {
50 + username = "ofborg-log-message-collector";
51 + password_file = "/run/secrets/ofborg/log-message-collector-rabbitmq-password";
52 + };
53 + logs_path = "/var/log/ofborg";
54 + };
55 + mass_rebuilder = {
56 + rabbitmq = rabbitmq // {
57 + username = "${config.networking.hostName}";
58 + password_file = "/run/secrets/ofborg/mass-rebuilder-rabbitmq-password";
59 + };
60 + };
61 + runner = {
62 + identity = "ofborg-core"; # TODO what is this
63 + repos = [
64 + "nixos/nixpkgs"
65 + "ofborg/testpkgs"
66 + ];
67 + disable_trusted_users = true;
68 + trusted_users = [ ]; # disabled so everyone can build
69 + };
70 + builder = {
71 + rabbitmq = rabbitmq // {
72 + username = "${config.networking.hostName}";
73 + password_file = "/run/secrets/ofborg/builder-rabbitmq-password";
74 + };
75 + };
76 + github_app = {
77 + app_id = 20500; # Used for submitting statuses
78 + private_key = "/run/secrets/ofborg/github-app-key"; # Used for submitting statuses
79 + oauth_client_id = "Iv1.24d6e782e2ccbbdf"; # For accessing the API
80 + oauth_client_secret_file = "/run/secrets/ofborg/github-oauth-secret"; # For accessing the API
81 + };
82 +
83 + checkout.root = "/var/lib/ofborg/checkout";
84 + nix = {
85 + build_timeout_seconds = 18000;
86 + initial_heap_size = "4g";
87 + remote = "daemon";
88 + inherit (pkgs.stdenv.hostPlatform) system;
89 + };
90 + };
91 +
92 + nix.settings.trusted-users = lib.mkForce [ "*" ];
93 + nix.settings.allowed-users = lib.mkForce [ "*" ];
94 +}
non-critical-infra/secrets/github-tokens.ofborg.org.yml new
+104
@@ -0,0 +1,104 @@
1 +ofborg:
2 + github-oauth-secret: ENC[AES256_GCM,data:ljXwAT9e8Wo/5m2xWC0Ip3JxGVFZNqeVn//TnOtck8NCE0enG3Pv5w==,iv:v/sATS+/psNauwc9dkGA+kNzCyjOE0Lx2uakidmnCmw=,tag:9me+XbM1spGzvJGUYDbbDA==,type:str]
3 + github-app-key: ENC[AES256_GCM,data:+NMlEwfrQgQtYPzmQE6rRTi6OMJRCVONHfgA2MRE32RaLXnpRXVdbVl5pujyD1AihFxb8l8QKjPOZolb7W+GBV4u7nAD5NW/JWKLrnll7AXsL2pDltzSyeXRHC8AM2Sl6vB9xAQJ6XPF/PsAHMm9xWCrGqByoUz0cVUK9jUTwG6Ckzc35oSu6HWuX0wjD46Mjv5pB6ODr0zs0wgLeEku6UBk6OqVwctAOKPzL8ESjxxJz1n+EGCV3XEeQAIkh1EQgfTgzrHntmdGIGPytYpUO50qIZCf/UQepYVDxiCL34f7lypT5FRji7DnaiAMgvuNIvBnBR65o0Su91EjiAFjs/si0a226WVApXg+EVjWdcUgG5O6FYH/No0MxfdjhmFlTlHMS+WhP+nCZilFFTuMnA8/tam2ywCDrEZQybJI8BjnwALlT9nVo8iTLrEPF+p2T2D2JBMENXgOfma5IZFFfOkn7eJt1U0kJQrWRe3zylM/Q6g7Iv3gW0N8jgtx0XUPQlmI3TE7QfjJLzgFky7x0gvF0fdohuGg18tJrzxPudcV9FWGpiOwIw9dYix3cCDpIOT3ohAdYS4XRsweNNZLShQlGwHR4YkFEVMFL07hbEWkn7iO0uyei8e+UBwFrCYnz/hMcTihCE8gmi0ohURe0z5id0G7xp41Z7O3kZTLJCkIAa8PDR9A/n9VLb+ae29c48TfUsiJv3OspfVtbOgSl9FfO/6wNPw7D2TFLILlJnnCFToxzaQPjWWiiE8+G+NA433JGMbs8T07RymMPufoumOs7OVJoz30O72ertNT3IRVFEWTkdOwtqw31ZYJPHxVc/sQHUlOmuUBebfS/tNR3UyLTyJFI5M77otW1zrpaxEd94IPBvn4p5G5Tosc3NNZug5ciN42YVwgKyARzBAZvi7d34l5p0tkxMYv/Ky8jMsocY7B5+9j87FnsivHhku1ha1YP/7NwmctX+P9tQdkLKCrBKLxj7nBUoiG8MCgM7qBP/0bjD5CLh+GTaL2d569nJzqMaCO27cnPzCuKjz5wegBZFBYyRYqWKpShTK4bL6eGWgPK6vSC7fsVtiGAkeTLHarNNo5i4ad9ucyw5a0E4cQtok1SG3hbopbqTDZb6F5pqs+JccYjfURjQSaoUJqa32MG3ifU2V9N1btRxa4zEE5S9kH+EneCfrDGaCM2iL2MWdbuIrgNieybEEUjBvLc1DSG834kFRJFVhz0BiQ1uo0afeqvXvlSzPBEo2x/9SeB1KCWjKV4tdBI4aDGvNNhZq7tbhpzzzdpfBKUgfeoL8UJl9vIv6LeXxSs+CIJbImgV1hHfg5ZN+LE7UB29+pLZzK4DlVCQS4hZjQ8/fnbxJl3x2XkdcEDa/69Ad4M6cZlU+Pbj5OfB+PfoluPMTMWX5YxaoZjGvDobh+lUrPnQjf/Yai7nFr0k/qhpSbFbwRNQ4k1rcTPLaopmjtn7WbvC21+lZN8wSmOF5duMc47REslZgodJyr75K9qFWE/V3l6w1r9oD9i1WLbLdQSJ4Dvd5WWvwT0Z9Klx3Vey9AUJ7IE2g78e+6adWzkuqJunJ7nZmxPZNSuDz3ElGK3aFFlUpwpOGkRrJ18We3E9f5LXjbn3FEvHsmXmxgSaxYEjubHtyLyctupETHROG6QIcUEo8OrQqtHpN0ljTo6qD1fJXC6/tQF0SEfYayGiXetEVTdLjJAvKggThbKMdnGRN7LPNxOqRVHSWi5VFJMizZrPiZZizmMApe73TH0wf6bUKOmkUjN1MgIC+T5pKlsHr+1xadLObrIOL3FiCjg70setSiTjLRJjJJ97+pQqfo1z5SOit8DUv55K3Rth/C01hl7/RKkpWl2z/tXSnYcfdfmIky8OrUFGorPiZ7S3pSPlwcjLZmscu1SXZVSDnhaAp8nTUKEOw6pwN3mDcI88cgVF9Qi9HGKxL/fjCO14OkBCGE6rjANXtGsGfY0FG6H98uyD2U7IiS6oRUBFaVwvfjzQYESQCqH3UYFCIeRfwpCzB59g5xhiJni5+9DcIKuJAKM6/mnmQKyRu3SReMElsXN7xme7ggOQQ5FtnXa7wPUcDsMYZvs36Rkc25Jyjnh5T0iqpU/46Rj7owKMCvz860ZCDTbL4J3APnYKV63ix4y+8Lh+E7fQOXEyci7jBK+3ArCKysitEVc55QvFDX/XDAtdBWLZT4UvUASyX+7MN4OtfqbTXCrwA7zXCKrA==,iv:seUxszOTK2/oct+FlKVFPseo4/CHpdp0eiLUyddmmWg=,tag:HWrNTJKz7oQY+aPRk4H55g==,type:str]
4 +sops:
5 + kms: []
6 + gcp_kms: []
7 + azure_kv: []
8 + hc_vault: []
9 + age:
10 + - recipient: age1rrrj8tgcyp9xfxvy6zmk9487x62cgx0z68l7jretz2th6ey9nf4qh7nq7h
11 + enc: |
12 + -----BEGIN AGE ENCRYPTED FILE-----
13 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0QlNpd2c5MDhBcGEwQjQx
14 + OTFXSUd1SldaNUdTc2t4Ukx2c3FncVFzZWtRCnd5a1hwekxYVjZmY0tiaEhIbWFU
15 + cWpZUGxxcjZDVWx0L3FnaDBKaU5mdEkKLS0tIFVSUkJsdWpWeXhoYit0SGVCZC96
16 + Y1NZVHp6aG9PMVZYM3FSTU1vUWJWamsKma/fA+Gko375jMBmT/oOrbbnkju22SYo
17 + Vcc4qUthuffHxlSCW5fW7Coyl9JEA3tx2lOBUk0hZO5kPkVpquS8Uw==
18 + -----END AGE ENCRYPTED FILE-----
19 + - recipient: age16d0phf8c5wy3rfsd4pgc42mqa3aw2llfukdhgu7pzklnzjr2rvxsusz842
20 + enc: |
21 + -----BEGIN AGE ENCRYPTED FILE-----
22 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrc1NSckN4ZEsxZ0RtWUcz
23 + czBMcDR6akRzN0pVUnc3a2dHU3RZelBXTUZZClNzWXBmYmhUMW9pbVVXYXJOdDF1
24 + QWJsQWE5cFQwdXp4ck42VkRud050OG8KLS0tIGVNeXdBMmxOTXp1TUhDY09sbE5r
25 + Z0NLRXNzcWdTL0lzcEtRd21CRFd0dUEKNjzdg+qidmug1Jn/kvpaeOcSm6U3iZnP
26 + um0wz8k3sWsAZdnzxm3jYPhjEFaRZMkEez4OGv5ZAbj6QOJ/LgVu0A==
27 + -----END AGE ENCRYPTED FILE-----
28 + - recipient: age1qn3q3y04pxumygmq96x0gk9qtrdcgdw4y5nl6xd780u4avk0qgsqy8tuu0
29 + enc: |
30 + -----BEGIN AGE ENCRYPTED FILE-----
31 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6UWFycmhQRlhJNjNBZElZ
32 + aDBBSHgrUXZIbVRCZzdiK0NkV29rZ09laWxFCnhZMFlzdFh5aTlBdkU5bFdPNDMz
33 + REFEZ1hZdHpFNUQ0RmJrUm1aYVRjd28KLS0tIGtVY29NOGhOa0J1YVh5eWJIUDA2
34 + ZnhUNmhMQUdwN3UvcFU4Y0hlZDI5NWsKfmVq2vz6fg+V/VEtHBNykjs/1TO6PPql
35 + HQL8GEWGJtATdlLkbfIiYF/I/mFr04Vm8Efk7kDPfhMAtDtah5cr9A==
36 + -----END AGE ENCRYPTED FILE-----
37 + - recipient: age1yssfznyq8rljcpfthpulnvfls0l5t36fpqxkk5taxcwpkqhv9gcqrvvwh7
38 + enc: |
39 + -----BEGIN AGE ENCRYPTED FILE-----
40 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNSENwSTJqaTNYSnZIOFlw
41 + Ulk0TWZtaEJUUVBlWG9lUmlMQ1REMDhZcFVZCmVoTzVaNHZuUGowVnkvSEVrZXdn
42 + b2tSemNYZjJSQTdIcHl3UDhJTEdwYjQKLS0tIDJXVDRSUlBnWXdleGROUzA1dVBD
43 + R1NzN0ZRay8vNzhQYnJqQ3pXcUJpSFkKT2r2INWOiYqg1Z/QY3Uz8O0jqvC+zOyD
44 + EIKCCHO1S4FdO6lmcsA0ArncL6LwStSQSb0JC4iHyhzjuRf2Jqo6jw==
45 + -----END AGE ENCRYPTED FILE-----
46 + - recipient: age1vunut833rrdfulgnsjqtuke4yjtzexn2xqjqavwzxlgrg7n4y45qhurzwc
47 + enc: |
48 + -----BEGIN AGE ENCRYPTED FILE-----
49 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKTEVUeUJVNTA5dmsrcWVw
50 + Q3R5RGF0cVYrQVJGWXBFWEs3a3lmSWEwRGpZClR6ZGJaZHJ1ZE9oQ28zZ3RRRUMx
51 + VGY1aFNBRGNkSStuUDlDNUZZeTN6azQKLS0tIGUzWXIxQ0NranBDZHJQQVRvb2dF
52 + QWQxbmRJSUlKSmdGaGRXTHhNRnc5OGsKKUz1rJXZpDkyVuLafUzzYurPm0SHdXF0
53 + u5gBoEUFK302z04UFIKu7TXKDFthNxCnh7bKLGjlmPQ9mkEoDAx5FA==
54 + -----END AGE ENCRYPTED FILE-----
55 + - recipient: age1j3mkgedmeru63vwww6m44zfw09tg8yw6xdzstaq7ejfkvgcau40qwakm8x
56 + enc: |
57 + -----BEGIN AGE ENCRYPTED FILE-----
58 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVc1BzZGtHZHFKN2VYc29D
59 + eGpkaWdXalhSdjFRT2Nhd3ZUUjMwdDNFL3ljCmZLdnh5MUI2WWFNNjRhaU14M05K
60 + WkVpR3NjYjNwem9rYkJ4NkRvUDE3Ym8KLS0tIDZjbXV4R0hwTUUzaEtzMkV4N2NP
61 + elMwbUFHV2RCemdWeFQzYlRnNnlBLzgKQD8sy0m0vI85vQEKcKNWkZlaOyJMoikt
62 + XNXNkx+PT5cXIrPHcQOsbRqTM/lgepJqHsSrnWCf7HmVgaBxpLN03g==
63 + -----END AGE ENCRYPTED FILE-----
64 + - recipient: age17ez23w2kpxl0gcdx4ehcglkcfcfnv4qz0gq2n8ylxwx4yrtjpvjqxfasua
65 + enc: |
66 + -----BEGIN AGE ENCRYPTED FILE-----
67 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvc0ZsY0w3Wnhwemtoa3pH
68 + MVRuYmNoQkpJSU5oZFh6Y3R1dDl4bURwMzBrClVWOVRacndkN3c0TlVvWnpIaWdK
69 + Z09FUVQ1bDUwcHMzaXN2YlNwQzhQVEkKLS0tIDhvVGNzOUZnNjZucXdXNE1aWkJW
70 + SjBPS003bWh1Z2NFbDYxazlKVUF0c0UKiH+DGOBx7tSzjBelBwea7Av4oG50aV7R
71 + CWZc5efN8naw9r0+c1QwSQKQ40a4fXaIoy66X6oLDPfBO0nApUlAag==
72 + -----END AGE ENCRYPTED FILE-----
73 + - recipient: age1lz3mvem0rgfxj7uavth8du4xsw23wp5ts77m5vvclxyj5mjxfujs0jgtcz
74 + enc: |
75 + -----BEGIN AGE ENCRYPTED FILE-----
76 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6SVIwZlFnQ0NweGxaVW8x
77 + WCtZVm0yOXE3VmcwdEwwWW9YR3lCZ1hCczFJCkVjSjA4SmNhTXJRTzNGMVNqY210
78 + NTh6bUJyODhIY2ZjT3JhRk1waHdnVE0KLS0tIHdxcDJFRzlDTVpqZlArZWVFcHFj
79 + MHZteHZHRG52VEhraDd5akd1Ym0rN3MKaotVK+V+sgN3jYO6eRT6iklBInF17S47
80 + pB0epMvdUSvu0rXeNlkyrKzqKSPQDA+iwJJws7N3fsYiL91MjYrFgA==
81 + -----END AGE ENCRYPTED FILE-----
82 + - recipient: age1m68dw9dltvtsg8e9lf5ts2vwnn4ykraguhjr8v65s0xessk3xqeqyz5jwt
83 + enc: |
84 + -----BEGIN AGE ENCRYPTED FILE-----
85 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5cGtQN2dZOVg1dU9GcU5h
86 + ejFOc25HRGYyajhFMHZGQ0ZLc2hiNHV5d1FzCmlGa1lWaW9tQi9TMk1Pd3ZBMjl1
87 + WGV1azgwWkx2VUFEODBUOFpLeFFtYXcKLS0tIGh5RkozSEFkeVg0eVFaa1doUDV3
88 + K2RuMHZyUnltallXQk4xamxLQ3h2NzAKlMaEXoukMvK6O5/88nfYmCSxFm+MmSk3
89 + t4et95x+87Kyen5LX7z+Pj+X5MrjC0O2DDyoDQj6K7wT/hjMzarbNg==
90 + -----END AGE ENCRYPTED FILE-----
91 + - recipient: age1nc9sh92wf62nt89k4vgyvqws2pt49cq6xqxx46jqpz4vqxsh5a4q8ltzp8
92 + enc: |
93 + -----BEGIN AGE ENCRYPTED FILE-----
94 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBUnNnR2IvelptWW1DL3pq
95 + V3pKMXFKZXlpdmFKMEQzN1VIanlFNjRHWW13CmxocThhTDdOQ3oxd1ZoNHpJYnpT
96 + Z1JXUE5TZE1ZWEwvc0x4di9ORGdUWWMKLS0tIFY5Y2NLUXZwbi9uaVVvYU9DbkJE
97 + TFpQaW0zYWVMMkExc0tlb3FxVDdTcmMK+QNN15A44FNROjzoNEdLJCc3t3s8YX3g
98 + abliHcCZmf4PxF0Z2KTem7vfglkKZiA8kf//nmH3UADiVm2K/AY6Vg==
99 + -----END AGE ENCRYPTED FILE-----
100 + lastmodified: "2024-12-29T16:57:50Z"
101 + mac: ENC[AES256_GCM,data:9eXCFgz2dK9F4yWZ/vZykAZV6B0dh2ZrtsPMcy0EfnT12JFgt6AHpkmclEhqVLS7oXshUi4mVwkQjB2ZdVVega2IePu3EmWkpxbFoJyNW+kce0d/CYZAZRjigwPS68lxXT8+q1rUvIeMAq60EnZaefTwU9+xM+x05lXsw2yxsIo=,iv:ouMLuOX1mBlJ2wcn7MPexfZs0RT/xxOWovgYQIpafxY=,tag:SHjoqoBrSdUZB/RTqdB9RQ==,type:str]
102 + pgp: []
103 + unencrypted_suffix: _unencrypted
104 + version: 3.9.2
non-critical-infra/secrets/ofborg.build01.ofborg.org.yml new
+65
@@ -0,0 +1,65 @@
1 +ofborg:
2 + builder-rabbitmq-password: ENC[AES256_GCM,data:PJutzppfwBpsqcnCn8nsiistlFAFvqx+WyClEFQAPbFPi8l4wTZ1emVkkPt7b6tmI/w=,iv:iGSvtMrTV6hcKkbubgH5bwJbJIB30K+apjX5xZ0BTC8=,tag:16W2YeZoED5PjKCW2piiyA==,type:str]
3 +harmonia:
4 + secret: ENC[AES256_GCM,data:l0ksas81hQj9u9FHZiW54tNWf9h6KV9G2zQD4T210xeW+zA/5C+fMqO6XVcQfISmxUjBzHCROr7mhLo/26S1ko+nUJq2sKu6fxiAF+yREH6rqFwC9wn4egochDaXQoAcE4a+8uPh8u8XT+A=,iv:hCVtTwC170TPpBHQDzPK72+RxS5HNYLv8J3LvvttJ4g=,tag:tvIzWGanqOPku3+oywJ7Lg==,type:str]
5 +queue-runner-client.key: ENC[AES256_GCM,data:/8jVcQHp4rUDZizbuPmQy3IrSAlxuYJ9vMHDUSbShu7iZ+oIq1h0cxJmfvFZ+Rf6/a1ZZZQykyUcJeGlNvCpFYabKWit6RKcHHSy5S3lg50kKMwyZga4h9FWjWBd4rJ3XOCbelQXNwAfXBBanxgF1hMlE+SXoAg=,iv:6VUR22+ZIlu0eyWechcAM8Z6QWqCfBynORivUjV5SOA=,tag:0CQ7BVo4IKqnV7j9gyplXQ==,type:str]
6 +sops:
7 + age:
8 + - recipient: age1ulnex45wt7fpj92jy9c5del3ccz6mmnqptrsva24k8m7qsez9pcsdu3eae
9 + enc: |
10 + -----BEGIN AGE ENCRYPTED FILE-----
11 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVaDJ3K3RobDN2bU5lNTJK
12 + RTd3WVFmQUpGVFFYb3dMeDdJVE1DOVp6NW5NCnZEZ2lqald3TVVuZWJhZ1I1Mi9E
13 + bkNaaU56K2xLYmdEVWRQRWEvTUFWU2cKLS0tIE5oeHFaTFJKTitJVk1XTndIeUFl
14 + cmxhbDlBSVRJeFlDM3BpbnZDbElSYTgKruwJAwrNYk52IQCwWgOTUIFN3NPDTP0k
15 + jd7TvMStgqBKU2jz5IBHkzKjgpEY4vjqwTnj5Fw9ArRJ6mIzctFDlA==
16 + -----END AGE ENCRYPTED FILE-----
17 + - recipient: age1j3mkgedmeru63vwww6m44zfw09tg8yw6xdzstaq7ejfkvgcau40qwakm8x
18 + enc: |
19 + -----BEGIN AGE ENCRYPTED FILE-----
20 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkWXRCcVg0bVBJQm93U3My
21 + Z0V1bXM5YUo2b3dDMVNZajB5alByS0EySmlJCmxEVjdZY3BZbnlyNVRZWXFZTjM3
22 + MnlJNEw1Q3FMZFF1YmRpd3UxN0g3U1kKLS0tIHB0a1IxT08weFg0UHZkWmJMMWkw
23 + Smp3a2EwcDVXWnROZkE0SU5tZmdGRlkKKkbWDY1iJLrxnZx9VBHQKZ31SdDsA80n
24 + ikiuB935RLiT0qk52BnkGmakXGyiEMS1SjP1+OtHIbpFw3Y2Y4Iarw==
25 + -----END AGE ENCRYPTED FILE-----
26 + - recipient: age17ez23w2kpxl0gcdx4ehcglkcfcfnv4qz0gq2n8ylxwx4yrtjpvjqxfasua
27 + enc: |
28 + -----BEGIN AGE ENCRYPTED FILE-----
29 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLeXU0YjA0djBxZ0c2R3h6
30 + ckdWS1pqSnUzUjhNZ0QwcWZYUDM1aCtmQ24wCkhNemhIb1dNUmtZdUc3QnZ2S3RY
31 + eE5VN0xhVEVYNUUxY2JCSFBHT1lnMm8KLS0tIFcxV01NRk8zRFU4MFJQZ2xOc0N2
32 + Ym85YkdOWUxkS1NhZE9mUFFSbThtTjQKTtu108ofDN0wv5wucmUn7xYNA/dd2rWi
33 + NG62pg5S39oi6V+JdXddV8WJ4Cr261zQA67s5/4U6mCGr2+5iC7npw==
34 + -----END AGE ENCRYPTED FILE-----
35 + - recipient: age1lz3mvem0rgfxj7uavth8du4xsw23wp5ts77m5vvclxyj5mjxfujs0jgtcz
36 + enc: |
37 + -----BEGIN AGE ENCRYPTED FILE-----
38 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBla21sWFR1VEtUTnU0Szls
39 + ZmNGcmJyZTdDak9Wd25Kam1jckE2ejZ3aGg0Ckxuc2N3eXlKSDZkQUt6ZXUwMDM1
40 + S0txYk5yNXZGdjRtVEhxWnVINVg1MEUKLS0tIGVVWU9kRVFVYm5vZ05HNzU1a01W
41 + N2svOGQ2NWV5cFd2MlkzQ1dEZFJCVjgKsYDLsz8EUWKt4tU6ecc9qhEd6CghRmke
42 + GLoMfLXmC1UkxoJq2/1ZoUbWaM1nLTHXcd0jRvqY2PtFgOzixs+5dQ==
43 + -----END AGE ENCRYPTED FILE-----
44 + - recipient: age1m68dw9dltvtsg8e9lf5ts2vwnn4ykraguhjr8v65s0xessk3xqeqyz5jwt
45 + enc: |
46 + -----BEGIN AGE ENCRYPTED FILE-----
47 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1Z1ZQczFRRUdKUjR0Q3FC
48 + SGVPb0lkNWMvQkVJNVoreVVJT1AwVzhaMFVBCm9FUlFselU3TDBBQTMzcHdlZFQ3
49 + d0RiWklleC9ZeUcrY0NBeHRUWHZOZFkKLS0tIFlFMkdKZDkwN1hNS2xQNEd2NWF1
50 + anpIWThNaG5rNEw2bVNrTGxTVjc3aWcK5uq2oy5WdJ1Hv8ah+3AUULVrSOcz/NgS
51 + QrIbuzvbjJqH7TOsTd0OUPz0liYkWoZTvt4jORdxRRRnYaqr02pZmw==
52 + -----END AGE ENCRYPTED FILE-----
53 + - recipient: age1nc9sh92wf62nt89k4vgyvqws2pt49cq6xqxx46jqpz4vqxsh5a4q8ltzp8
54 + enc: |
55 + -----BEGIN AGE ENCRYPTED FILE-----
56 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwTGJwbjRpR2ppanRFekdq
57 + T09yYm5FR0hWeThCV1pLOXNJZnljWE1aeFhJCnZudkZhMG1sMzhXYUwzQW1NL3Fq
58 + cHdkc2g1STNrMStOM1BTS2pBSlpadnMKLS0tIGVhc1NyWlFnaVBRM1ZrT3N6MkRG
59 + VTQ5VjgzeWd3Kzh5YzlDdW9wWjY1TUEKf0BR88592mPaCyRbDQXk0qrxTRsPpV62
60 + ii/0v3v2eQH4n3DESR5xe0ZXRW3YUoqnHzJMu7e7zKhVexQiskwOrQ==
61 + -----END AGE ENCRYPTED FILE-----
62 + lastmodified: "2025-08-10T19:16:28Z"
63 + mac: ENC[AES256_GCM,data:dbrYWe2uHQRY0lkaCaqwAtXNJe+NzPEhTVBEjN/gybqILx7EylTNxkEC2OUeK66nm6PoRQ6F/mrqf9qLcXwfVqnQAHVa8CWFCb9EeYBNGoe7KPmxCxzpyHHG+mQdvz3jLD5h1lXVoRYcks2yOOYUKJQGpjZe8gxoraqkUEQQiiU=,iv:+6oRGpSd6uMyXrEO0dJq+6RvLNGzie1p1st7d00+q+k=,tag:VnZs/kGP4yPcM15q/tYvEg==,type:str]
64 + unencrypted_suffix: _unencrypted
65 + version: 3.10.2
non-critical-infra/secrets/ofborg.build02.ofborg.org.yml new
+65
@@ -0,0 +1,65 @@
1 +ofborg:
2 + builder-rabbitmq-password: ENC[AES256_GCM,data:QVJgi+XJWIlSHBXWIHZTh/ADCChlyLbRekV5bpyIvxmacvi5D2ILVq8U2RC2Nf0gnOc=,iv:fSUmuf4sAg/8+ZFvxM+JEVpUWXudwszSt6z+SgF2kfQ=,tag:+GF3yKvt0ZoxeTiHiWRu+w==,type:str]
3 +harmonia:
4 + secret: ENC[AES256_GCM,data:n7l9VJh9fpp3RIoGbofZivhLjrMRBdZYLMBxoIP/6Gbm5WVXnKqJ3QinVGuzdUnJN7nCgupmD6OWza38PS6DJ1ZZ0WzwZ5qR2M7l0BERzUwl4Ow+APeSyv4DFhUg0J6Fmwvb/PmAGfG8ows=,iv:bX/dQR8YPWBJ9OdpAuvHuBCf8J0yDxSqALrGf/ozlYE=,tag:SEWdW+zuSvsQovK299i4BA==,type:str]
5 +queue-runner-client.key: ENC[AES256_GCM,data:ySLkgrEoq17F5mHSYi9gxLTebpK2BYStrGsfsyTc5qpGCFi36heHLrS8fH2ChGOe4Bt+AVuRjgSWYMAFZPL6RoS9E1a2Pd35J5DLjXI330D237ouRMBeKu2LBCPUzaiO0AD73fRfpwYbh7TzhYm+qlCdKmgMLpE=,iv:nKQ9MqjbznvEWduAeGmzoRt9NQAr0bSRAJwt7qMa7gQ=,tag:FtVM7uDyYW58CctQx9m8rw==,type:str]
6 +sops:
7 + age:
8 + - recipient: age1wrp04f5c0d4jx3hwjsn8cyxdjzpzx6fl202zftqfvfdt7hx8efgskf6s86
9 + enc: |
10 + -----BEGIN AGE ENCRYPTED FILE-----
11 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqTHUwU1pFSGZCT3ZpMXdJ
12 + bk93bDhZSmVRbDBibXAwZGl1SFVveXNER1RnCnNwQURGUUZsVDdEZ1d4VjVPMk00
13 + NWNJaWZGSWMrczA3VzNJNWFFMFBWQm8KLS0tIHFvN2l5QXR1K3NvK2xUV1JYTTFn
14 + bmY4TEgvMndzamZyWnc5QWFDcFd6NGMKu3UzG5HGJ+kQtOfOxaPVyZnxfQaIU/41
15 + KB9X1NBPXyJzkRIdM8p0wm1Wmv8tXMjn/vg43zzR5yjEaCgg1amhqA==
16 + -----END AGE ENCRYPTED FILE-----
17 + - recipient: age1j3mkgedmeru63vwww6m44zfw09tg8yw6xdzstaq7ejfkvgcau40qwakm8x
18 + enc: |
19 + -----BEGIN AGE ENCRYPTED FILE-----
20 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvY1VveWpqbWxHUWRtdGE1
21 + Nk5DMXNkWU0yUzY5YmVpbVNmVXJpRHBSaDBnCkFhR2s4ZmlHcGRHS2J4VHNXQ2pB
22 + UTY4dE5leEVydWdNZnJTV2xsNmh5Y3cKLS0tIFVlV2tCdnY1VTFQQkdKYzdyakVu
23 + TWJRdU1zcWQ1dTlpR3crZjJRZkFzZTgKTIF6ZjO+Ur1df08YadOzLIKbuGurx76I
24 + jc3rbvK2yzWhrcDltC/kGHrXe8ZJp8kILXIDaE3WQgQ+EV7DMNqcDQ==
25 + -----END AGE ENCRYPTED FILE-----
26 + - recipient: age17ez23w2kpxl0gcdx4ehcglkcfcfnv4qz0gq2n8ylxwx4yrtjpvjqxfasua
27 + enc: |
28 + -----BEGIN AGE ENCRYPTED FILE-----
29 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4dEhaUnhxZWZlcmU5dmRh
30 + NDJBWENjS215aUVJTytqTi9KVGR6Z3BpY1FJCjc5ZmpjZFZRQkVON29NTGk5N25T
31 + ZEJkQnhodUJJM0ZIRUI2TjRwdk1XMG8KLS0tIHUxSkd0KzF3L1R0Wnp2MUJIeEND
32 + WlZ6N2xIZ0t1UGp2NHlOYkpPYnlTTWMKkCBa5YRHnmXNpGS71jBzbEZIQq6yeHct
33 + m7/kKz3cBN7857ClbJeKQRcZkS0gjR174hb7nwz+gBn6LUe6hTuYaA==
34 + -----END AGE ENCRYPTED FILE-----
35 + - recipient: age1lz3mvem0rgfxj7uavth8du4xsw23wp5ts77m5vvclxyj5mjxfujs0jgtcz
36 + enc: |
37 + -----BEGIN AGE ENCRYPTED FILE-----
38 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtZTUrT2FVcm9ITG1QYSts
39 + OWcreGJuRG5lRGIwb2NOTWM0QS9CNlJPcjBNCm5WeFNtT01OeE1GOStmV0xXSVNC
40 + OUpDeGxOdnREWmQyOHVoZVoyeW1WU1kKLS0tIHBNcE1uRWNvUGloejQwTmo4WGVs
41 + a20va1pka0xPK0VSdDgxVWloRU1QTXcKFpVCaJRWcJLXxnKDWj4S9zM2h6KVN1Vz
42 + cWWc+LSkVuwMgPS9KQRudsTVPC93AKzc3qM7CMpo0yIRv/2wukhFDA==
43 + -----END AGE ENCRYPTED FILE-----
44 + - recipient: age1m68dw9dltvtsg8e9lf5ts2vwnn4ykraguhjr8v65s0xessk3xqeqyz5jwt
45 + enc: |
46 + -----BEGIN AGE ENCRYPTED FILE-----
47 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUYVhkQXpTS3N5bm9rN2RM
48 + cEhCQzlYNktXOUcreTkwbnVuV3kwbUNIWERFCktUZ0VQZG8rMk9qUXhycnd1OXM0
49 + MTNqck04MUtCVTNiR3k1TGR6N3YyMHMKLS0tIG5ZSkR1VUdpdjFBeFE1M3VaeFFS
50 + YksrN3QvOFNESGJLUDFwUDRqVFpXOVEKZB/pdEmjGY3nJF+sd2Z733pFx9Cymq2/
51 + u8xa2ofgybrfLM3UgWZXQJZbZHkmn9huUD2uo8cLL/hOY6+247DYeg==
52 + -----END AGE ENCRYPTED FILE-----
53 + - recipient: age1nc9sh92wf62nt89k4vgyvqws2pt49cq6xqxx46jqpz4vqxsh5a4q8ltzp8
54 + enc: |
55 + -----BEGIN AGE ENCRYPTED FILE-----
56 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtVG9JZ0c1SFVLaURYQ0dX
57 + YWwxcGx2WFhRc29YY0E4TWlsNkZ2TjlHZ1ZrClpNKzVYTkVkZituQlQ2d3lnMXRx
58 + UjI0NDNuSnBRVnBkQUM2Qm54NlAwalkKLS0tIEdDcGFaVUlJRHJ1OVZRcHFvRWdW
59 + UVRoaXFTa2xmSUZUY0psMEtnZGFIL0kKpceOpY9f3LaCWtF465HzU/+3TzofV27z
60 + ZQf0aFz0u5+T5ZYOwIsQMx8MV7vorI5Ifz+AnSMirSZKUQsba4dpOA==
61 + -----END AGE ENCRYPTED FILE-----
62 + lastmodified: "2025-07-31T12:39:01Z"
63 + mac: ENC[AES256_GCM,data:eOCu6Ih5JpuZekioxI+jkwxIkTqiMxVnOT9mN6BPYp4wBLzAPrampuNoZV9gU63cjX2zzqNP+GaXygyW4A+DbT5K1uCxZLAM4AgyvCnSs27ck5mJZKi1H2CC5XTs8Huk4QerbPdI5+EfIDGelorAW9BFS6uc+s213udXAKdLNcY=,iv:/TPX4juuVEpDj/5GPE542rsGknl2NX4ZutJGVHKUxtw=,tag:JpBJQPWHyKGaK3D7BDAvBw==,type:str]
64 + unencrypted_suffix: _unencrypted
65 + version: 3.10.2
non-critical-infra/secrets/ofborg.build03.ofborg.org.yml new
+65
@@ -0,0 +1,65 @@
1 +ofborg:
2 + builder-rabbitmq-password: ENC[AES256_GCM,data:YXvfUctFG4D0HEa87dW8YBTQiDpAEvFjHONrvync5kcFHrbwBFUPr1+sdGauShJDPeU=,iv:Uubwa947ItOcswBwB7Wq6QVXSlg8TKy8wetd1H6lSVY=,tag:bF4vEaWqyO8aGEir56cGOQ==,type:str]
3 +harmonia:
4 + secret: ENC[AES256_GCM,data:bd+Yj1sQWbPEBHjVNUP4DfTsuz55y3jgBslycICP86IafshhA/x4aoqGYRPN750PR0iiZJkkvEABigjBD3wh+p5yuHxLAQzfmaTghJ8vatvAoarjxZ6CmeAHD5pKDWdn0NBqtyknRsr9/AU=,iv:refy8KB76qxLAE8CHA47N7GFnIxsMxM4/8XnJ4N0/+8=,tag:7YXtRhLqITJdz0YCBdROcQ==,type:str]
5 +queue-runner-client.key: ENC[AES256_GCM,data:wq9bLGk9xDZoFz5zWHymTw2OxujgpWbojgX7Fbj2IdlGN9r7++BLRx8sR2h++Hi0YuY6kUdlvlSJ+SeOj/IwG73ke80mJB7zx88++jw8FnQ/xrQiP0Jdes3AJMe/t2PGJtOXQdy9GHIZlokBJovSuwZ4E+SqMjo=,iv:e1Ky7/sfQlWk9AfdT0Eu6Dck8LVKJSeQ/WYlzV4/xoM=,tag:aHARMMfrBXT07Kq94aCRTw==,type:str]
6 +sops:
7 + age:
8 + - recipient: age1n0yrvl2v397kztuhf00cdvrhf26c9uegwz6day8z9pyqj3zff4sq6ha0lm
9 + enc: |
10 + -----BEGIN AGE ENCRYPTED FILE-----
11 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5SUJsTXY4TjRIT2R2VWhY
12 + VmJQVW5Oc1ZBd3grdE5EWGNETURaNFFUYXdvCnZaemtwYno2VUxuRVhTZFFYdTdm
13 + c0VOY28zYXNPT3ZsZk55ZFFSMXp5L1UKLS0tIExOa3ZoR0ZaTk5vUTA4cTF3VXAz
14 + TXBzaUJkT1ROWHBrekVaZTZOMk9hMUEKYfhdyoFIlSUhXUNQ9x48WQlN2/EGrFmU
15 + 73w+WKGkANoEg/728DsKYYkRmeAQh7D28fdsG1ssXz4QXI9cgbd/DQ==
16 + -----END AGE ENCRYPTED FILE-----
17 + - recipient: age1j3mkgedmeru63vwww6m44zfw09tg8yw6xdzstaq7ejfkvgcau40qwakm8x
18 + enc: |
19 + -----BEGIN AGE ENCRYPTED FILE-----
20 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPeUJwa2VLNEVMRjRQWUhY
21 + cDl3ZUlkNHg4Z2hYMmM1UmRDVHNuVGZFMG13Ckloc2w0VHJTNDVXOHBSYVd3d1Jp
22 + bzhVRXlKTHR3c0puQlpQQWpIWHJieFkKLS0tIHNidloybkRCcVdzYk12V3lSVEZE
23 + aTNoY29NeDBPbzdRU00wU2hVNm54R28KzZBQ/CEPKfZ6GOtIDAjDP6C3pSGKkrTm
24 + NODg2Ewtfr6ssL40A/ocAO3lBODQgjTRXXo35g5/Zb1fRnTgrV9yvg==
25 + -----END AGE ENCRYPTED FILE-----
26 + - recipient: age17ez23w2kpxl0gcdx4ehcglkcfcfnv4qz0gq2n8ylxwx4yrtjpvjqxfasua
27 + enc: |
28 + -----BEGIN AGE ENCRYPTED FILE-----
29 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0eDhFbVlvSkNVUHU5WGtr
30 + Mmt5V214R1dFaHd1KzNQL25zRkxZS2RPaEh3CnZieTdnSGUyMWxjUVVDZGRRWmZa
31 + eGFuNk15VGpwYzhCd2pnRkR0QlgvckkKLS0tIGMrMDhTbTRqRGFXbGNBYUVTNDVy
32 + UHNzRnFsYVlPZUY4YVpTVmNEcmRwQm8KdgrgnU3IF59nx9u74fkQnjqfgCVG8PKE
33 + IVdqwYBGVjU472cGTlY+ALQINkjE99bJZUkwTs0dM9NZ0tyYPU72dQ==
34 + -----END AGE ENCRYPTED FILE-----
35 + - recipient: age1lz3mvem0rgfxj7uavth8du4xsw23wp5ts77m5vvclxyj5mjxfujs0jgtcz
36 + enc: |
37 + -----BEGIN AGE ENCRYPTED FILE-----
38 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTV0hYWDQ1R3FWNFE5bUhZ
39 + a0luTGVrSW1uRnRqM3I0SUtOY3RWVHM4ajJBCnZLcEZXMUg5NFRJSENlSm1uazNY
40 + aTZSVitrMTNGZ1lpNzdKbWs5SzU5ZlEKLS0tIEkxR21wdlBiTWVVc3NtM3ZnQXFy
41 + bVBJbXowQTIyYTBDRlp5d3VJWWFOZ28KoIsbDW2qf4jUVmv7dOgynZvbEtrBHptg
42 + 8YnWWBIqpD1GfHgaQ5igtXvCgelVMK6D3vnxztO92uZzU2b3Bm+8VA==
43 + -----END AGE ENCRYPTED FILE-----
44 + - recipient: age1m68dw9dltvtsg8e9lf5ts2vwnn4ykraguhjr8v65s0xessk3xqeqyz5jwt
45 + enc: |
46 + -----BEGIN AGE ENCRYPTED FILE-----
47 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxcGxHUHI4cHZJbnpYeXpO
48 + T0RjeUtKYmsyakl4WHgvYXV4dURpRS9BS25ZCmZBSkhWSDlkOCtqclNpWDFZRmZT
49 + YmpxOUxRTThYYWpwVG1TcllPTmNGL28KLS0tIDBBWC9LMSsvT1hKVmk3Vk5ZM1ZZ
50 + d1VIWFBNRGhrQTBnUnJTY0V0NXpLV2MKd2O4NTuuxnlIFJfYAu4W+KIckrsLRkHr
51 + hXg+VlQa341UFPkmd4Ruj1yLI+fFSCRsobFll7exhIZm8qziiG95Og==
52 + -----END AGE ENCRYPTED FILE-----
53 + - recipient: age1nc9sh92wf62nt89k4vgyvqws2pt49cq6xqxx46jqpz4vqxsh5a4q8ltzp8
54 + enc: |
55 + -----BEGIN AGE ENCRYPTED FILE-----
56 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByakhyc2ZSQ296RFZScDFX
57 + aTFCcmxhQVpKc0ZvVHBWdVRRczFmMHl0SEZFCkJYTEowcXM2OUd2UGNENkZNUTA0
58 + NmFNTXlOTm94amxJL2FzaDRNRnhlcjAKLS0tIDI3ZmVsMkVYSnNWRmZpZU1RVmJx
59 + elB6SC9DQThBdXhPVGZ1V3prWTM5ZkkK4WAp7pEhKAHVWUGl/Yr+k/NFxS2xDErT
60 + Uh5XEHQSL87JA4DSJGSzJNDeFN3TJiVCwFWaQ3rR422/A2YWQVphzA==
61 + -----END AGE ENCRYPTED FILE-----
62 + lastmodified: "2025-07-31T12:39:15Z"
63 + mac: ENC[AES256_GCM,data:SK6NlMDwRXtr6heqyakmm388FFu1cBCzZ4P9CYNimrb/Qt6ZXf9YDzsyuiyvPpUEjqrnXqDtlaz7b43hG4LiKP8DmM9guVKzywmwea9QmircihovvZ48Et60A28eGBvxQFOJWgn434aI7xaJuU2dpDQgukjjkjwzE5me5SsM+Ns=,iv:vzicQbbt2/Q3KKgOR7q/V4r/L4kostr/eWv/C1oY0LI=,tag:ZT7SVqgGhHuR/1toYPkECg==,type:str]
64 + unencrypted_suffix: _unencrypted
65 + version: 3.10.2
non-critical-infra/secrets/ofborg.build04.ofborg.org.yml new
+65
@@ -0,0 +1,65 @@
1 +ofborg:
2 + builder-rabbitmq-password: ENC[AES256_GCM,data:BY214D12Z800uyoMHxoH4y/BRxpg3cJMXCjae3k5lCmZeYahpaUx7Frd2i9fQmPaiOk=,iv:NNADJIcdzvtNWv++Q4Sd8MpHdJ1DhwMDNqI5RGc5KtY=,tag:8OTV+0gk/v6moTjFzFXDIQ==,type:str]
3 +harmonia:
4 + secret: ENC[AES256_GCM,data:BA5Vq/CY3lnLxbvzvTKfztlBdpPqTmkJ0DAAnk8OYSfCu0HF0kXUuPlhkqfZIi/Z9KKETrMtAPmtwSsakRtjlGgwXX1yPFNLCvyjyDY6CuqYFqbWESSThCqg9Ygm2yTtfOEH6sr0NPKHXHM=,iv:UUhp73xbtBfZnhRY5OTGWmYD+uaQ1TlJfC3cQ26p/VI=,tag:svclNQwF8Vib+wCLIDybyg==,type:str]
5 +queue-runner-client.key: ENC[AES256_GCM,data:BsP0kv7VmThjFR8JoxSjif7nD9at7egv3i/5ZEFzF6euz7NBxV8F4GpXeqUIVzx02pDWzcnMmGpXb2rZkPCUoecE06Y/Dz8GktRZaU/IJnhCmaa0ktlYl0X9ttXr66Jn0cyt0bnSjQE1O/yTMaFXCrPLeAVMd4o=,iv:wvFZwdqyuoX4sc3yDAJy7oWpwvoFnq1zERyeLscc99k=,tag:35jBsVfPIvjSVnoZWKZcWQ==,type:str]
6 +sops:
7 + age:
8 + - recipient: age1l7xmxkh6y6d5svj06txknamlwdpfwac8855p3edgpu6jcqea7pvslw4r9a
9 + enc: |
10 + -----BEGIN AGE ENCRYPTED FILE-----
11 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0VmtPY0V6QUNFSHFzSUM0
12 + NTBpaHc3T21CR2dnL3ROanNpOUlaeVoyR1hVCnJHVnlxUkg1aXRJQjFQK0VlUEtG
13 + MC8rZDdsek82S1pTcjQyRXR4UTZrMG8KLS0tIHdZOGVxcHA0MHMwN2tSRHZFN0ta
14 + WHZGRDJaUG93QjBiWUFzK25Cc29LVHcKkA8SQeH6spdyLye1Mnsei+z75zOrzSs/
15 + F0Ndz7JSbO9Tg1TmMk7ttQJ8BGC7A0Yi44GNCALjxV8m1Vs62/wNTQ==
16 + -----END AGE ENCRYPTED FILE-----
17 + - recipient: age1j3mkgedmeru63vwww6m44zfw09tg8yw6xdzstaq7ejfkvgcau40qwakm8x
18 + enc: |
19 + -----BEGIN AGE ENCRYPTED FILE-----
20 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzNEtQelM4WjgwSkpESGVv
21 + VmpmSzVCV2gwN3AyalllN2xCaklXdk41TmxBCmdqNmlZWmJkc25RVC94dGpXK0w1
22 + V2dhSjFZSUFGdzM2QXFjVHA1VHFwbGcKLS0tIGdHMDUxRVQ4NWlNcHRIbzdEdW5U
23 + NnE4QlNtazlqeXdHZ3dHcFdNRUFBOVkKWlZU6HYIJayk1YUH+9MLwVRxpissLBUr
24 + qy7HdzTdWm6JH9P+L7p92THJ230HZYx7c6Zd0Xo6bFe9sLtdZndk/Q==
25 + -----END AGE ENCRYPTED FILE-----
26 + - recipient: age17ez23w2kpxl0gcdx4ehcglkcfcfnv4qz0gq2n8ylxwx4yrtjpvjqxfasua
27 + enc: |
28 + -----BEGIN AGE ENCRYPTED FILE-----
29 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuVVdGWkJ5N0l3UXZBZ0k5
30 + Ump4Y3AvZXJrSktqR2o2MUVGMGQ1TkcySGtVCk9WSTVqZVRoT2w2NHlVNTJZcWxj
31 + a2V5L2NxR3Q5S2wwR2NZcVZoYUhLN1UKLS0tIDVCMkkzUDJJY016elNQVkdPVXFi
32 + bi9ObFgwVjFqeW85RXdEdCtTd2tOU2MK+ZI77YveRdA6//gLPneQQNPFsE2uWXcS
33 + WtIKzMAm9VDtJnKL8oSzkFdAZ2Pvn8ouJySH/Uk5zPP7jDrYJueeTg==
34 + -----END AGE ENCRYPTED FILE-----
35 + - recipient: age1lz3mvem0rgfxj7uavth8du4xsw23wp5ts77m5vvclxyj5mjxfujs0jgtcz
36 + enc: |
37 + -----BEGIN AGE ENCRYPTED FILE-----
38 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLZ2xLMDFRa0p1eTM1ZXUz
39 + aUxuWnl2RUZTR3ZtUWNrazRubzJuVjRNMlJFCm1kT056ZkVjbFFMaWJPWkxYY0RH
40 + UjNUQVRnWXBxY25JOHRwd3NQd2ZyUW8KLS0tIFkxd2xmMW9yd3RKdlJLZ1RRL2tO
41 + anFWVkZYQlRZS3pDclkzSko1MnVKNFEKkkC/vtOhX0mM6NAILDAYlXIKKDP3XxQJ
42 + VDleil6XqULQyFzvCbHwdAiakjZhDigtiwbX21pnILr2eX/+mg95YQ==
43 + -----END AGE ENCRYPTED FILE-----
44 + - recipient: age1m68dw9dltvtsg8e9lf5ts2vwnn4ykraguhjr8v65s0xessk3xqeqyz5jwt
45 + enc: |
46 + -----BEGIN AGE ENCRYPTED FILE-----
47 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0VUQ0MS9TcjBKcXVySWNh
48 + Slc0d0hqSmZOL0ZnZVhoOEExakVxazljV2d3CnRHM3I1anUvajBTODJpbTBuNCtp
49 + SmoyNEVZSll0cUQ4ZURhU2lLWXFJN2cKLS0tIFFYRDQ3WEdNTjk4djNkQUh1QjRo
50 + eFpUV0xVVlhGaHhVUmh3REpXaDg5bFkKdsJkLKA/B2ydQH374zOfPQZ0LqkwNKZV
51 + njHmW1+Rvb7Rh5GvNSM6K67hxzIw7tdI9pisWozbIwDQoi/I5csE7w==
52 + -----END AGE ENCRYPTED FILE-----
53 + - recipient: age1nc9sh92wf62nt89k4vgyvqws2pt49cq6xqxx46jqpz4vqxsh5a4q8ltzp8
54 + enc: |
55 + -----BEGIN AGE ENCRYPTED FILE-----
56 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxZTBnd2NkTlNXMkF2c0Q3
57 + YXpCQ0RyYXFua0tJbDhQQ3JqOGt4UVQ0cGpJCmJkbFNBQzhJcjBaQlI0ajJqdTJJ
58 + WkRnMFd4Q0hzeVEzUUVxRkFJQWNaa2cKLS0tIGxBUVQwc0xKVXVyOGtXSVJ5eGFU
59 + T1BteWw0U0JHZ1plMW9iVk9iQ1ZpNmcK+tLr+/uq+yhhyZBv0LmSL5XLx1kpVIlA
60 + Xnqrw2lD2h79/UI5/T/LKEzWf0vUCDatNoK9f3ISYCzDopvoS+Wzcw==
61 + -----END AGE ENCRYPTED FILE-----
62 + lastmodified: "2025-07-31T12:39:32Z"
63 + mac: ENC[AES256_GCM,data:RiDq8uRtVR3ojwLeM0ZyE6I3/Et+QeG9kxYOe61iPiqlM0zQZCSZqdDKOnUNxIquAbMyoVuwmHTtE6TGB1XER1KRNST7CPYnut9pnO8ouNspS8QE2+zs2guqfaN9aPMgJ/9YsKaIeie5eP6NXLO8X1j5AvVz5E9T6zswQWFRMQw=,iv:yXqEUowR9hl8l7afqYglBtVpy7n3Bnh3v4pFvBUHHy8=,tag:dgHSLCKmE1cG/lT4KFrZMA==,type:str]
64 + unencrypted_suffix: _unencrypted
65 + version: 3.10.2
non-critical-infra/secrets/ofborg.build05.ofborg.org.yml new
+65
@@ -0,0 +1,65 @@
1 +ofborg:
2 + builder-rabbitmq-password: ENC[AES256_GCM,data:6C7gffgkLc1e8rg3s9nDOPsY3/tjA6V9N8bVIOhas9UyTMB+phWQtTeoSrnb03qEjis=,iv:zZoiq7hMzADohBx9MzqBMiEiH17GvGNAlqZy9uGn7zY=,tag:6h7kpX51Pa/JWQvyYPt7hw==,type:str]
3 +harmonia:
4 + secret: ENC[AES256_GCM,data:3rXrIPnJ5c4pnAchjHZE5waic9vSiou3wloEANmpPore6WlGx56V1PTA1kd0UYDcLSCSkUts47U/5KyKXkaQOHyKcilBzv0vlWgkHWi1n/HplVSkTIGNfl75ROYd3TeQ0PP8UnpQaxGF0A4=,iv:A9uvQJw+TqqGdQLWHJhYyf4FUVGgNDx7zwQRcIFUr2Q=,tag:5LMibUs/f+yIcpIrz99RGQ==,type:str]
5 +queue-runner-client.key: ENC[AES256_GCM,data:Av6MqHkWm8tzf93easgr1kXXX2rHSenO5XIdf8nrDXGSKDhftHpzcuO3TRvRVM2jJmzfVO0j4x/pUR91of+K3elx3rUuEFszUtNogJOe7NdTc17pQFvThXVa2U+GPZ6o63f7/VhKTh3btsjfWQBDG7AqywJoFG0=,iv:neAYivmwJp5Bau2KsVt2YTHwMngozRA0yHUJuct3EMU=,tag:mO61AJHGuBmnlR+3mOl1lw==,type:str]
6 +sops:
7 + age:
8 + - recipient: age1mduqldqpqp33u2wwh685cwwkpj2ak36z67dtrq2tcskgqkultvps7w9q7u
9 + enc: |
10 + -----BEGIN AGE ENCRYPTED FILE-----
11 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxZE8xZy95YXRnZE5EUXFY
12 + R1Z0dTVmQmlrdmtYdjJjNFFFcVY3VFJ1Y2d3CkVoSVdWbmE0VmdZeVFLazk5SzVi
13 + TkVhZUJMNnBNT2t2a1ZVSUlISUVHVzQKLS0tIEdKeThjdTBmSTBVeWlLdm1rWXNJ
14 + UkRuRXo3Tm0rTWxzMmdVQzdsd2FtdzAKjDcgrjcFeISLyNdmRLJagkf7Afn237eZ
15 + ENwFKVXOjtXF3HN4fiUqO6dCZyl8D3g7X0B1VVgA3FlvY2/ucmUitA==
16 + -----END AGE ENCRYPTED FILE-----
17 + - recipient: age1j3mkgedmeru63vwww6m44zfw09tg8yw6xdzstaq7ejfkvgcau40qwakm8x
18 + enc: |
19 + -----BEGIN AGE ENCRYPTED FILE-----
20 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArQ0FNYVlCUkJBdUx5VDJF
21 + TWlYOWVNQ3IvNDFEajljZjNWaVFza0xnQUZnCll2KzdHdlhqZVVKTzRTdmZHa0pv
22 + YnRLS212ZDdrdVJWaUZicnF4VE14a0UKLS0tIDF3aFRYK0NpT091SGpsajlyZ1JY
23 + Unk5dGZXNURicFlNNjZaaFpZNVF2WW8KKZALYweB4jsRuFOhzM0v2Ls+WuxvbwHt
24 + EZT3JggbPSe728PybUv2l4F49Rqmh9DVndFvGRlnNoGHb02rBARvhA==
25 + -----END AGE ENCRYPTED FILE-----
26 + - recipient: age17ez23w2kpxl0gcdx4ehcglkcfcfnv4qz0gq2n8ylxwx4yrtjpvjqxfasua
27 + enc: |
28 + -----BEGIN AGE ENCRYPTED FILE-----
29 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2VlRRZGVCU3NBM2hQOVZw
30 + cHF4NUNxT3ZvUjhYcnZDMDdTSXBHNGV0ZlFVCnhaRUYrNklnL3kyTWNyMFp5aFZv
31 + R3FsMmVhMURwRGQ1eFhJZUpQYXVKTlkKLS0tIDg5OWdaVnRmNzZBbTNLYVFXZ1E4
32 + SHRYYmZIUDJIbnlyKzBxdUJ5ZzNLSFEKrlGODX4fv/CjGplGuutSwLJmjl6y4fBo
33 + DyZykN4mZhxQy4P8GshUEX1+vTffcO48S2c1w4XPTfiFHcNVRhYgLw==
34 + -----END AGE ENCRYPTED FILE-----
35 + - recipient: age1lz3mvem0rgfxj7uavth8du4xsw23wp5ts77m5vvclxyj5mjxfujs0jgtcz
36 + enc: |
37 + -----BEGIN AGE ENCRYPTED FILE-----
38 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrUkxQUGhzczhDNzBVWUgy
39 + UDJScFRvVWptNVBxb0FlNWJ5akczZXl4RkFvClFzL1ZhSnpySlEzZTBvOFpHL2pQ
40 + YjJLNGJvaXg5K0tZaUpSay9QeFhCNkkKLS0tIDc2dUlGcXNZTnJMcEw5MUg5UWhq
41 + VjFkVGhrODgrQWZWTWhOTS9MbEJLRmMKoHak92bGtBkyoYDNqYPXzPczk7ltNOmt
42 + DCSCx9Cgq0gmNDryMl8DXZdEiN334nOXu/HB1RiUHoQIjJnEiwul9A==
43 + -----END AGE ENCRYPTED FILE-----
44 + - recipient: age1m68dw9dltvtsg8e9lf5ts2vwnn4ykraguhjr8v65s0xessk3xqeqyz5jwt
45 + enc: |
46 + -----BEGIN AGE ENCRYPTED FILE-----
47 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxSjQzZ3hwY0k0bmRuMjN4
48 + WWNrWVB6bTF5UGZ6M0Y0ZUtlaGhFN0ZNb2xnClpRMDhkWk1kOW5lQ3hHcFJ6K0E1
49 + Z2t6QVVyM0FadjBkSlAxcWFvb3FiY1kKLS0tIDhTdVlHM2RGRnMvMWxQR0RGUXVt
50 + NjhqdEZVYkdwQUhBS1FHN0JJckowK28K19Ond+UZ0/MFHHR20kp5gAC8ov42xlgB
51 + ZEvAd88tXfJvrbBBAySykj83wg1FYCi3GvWdFOZ5dq18V3ffKKTy0Q==
52 + -----END AGE ENCRYPTED FILE-----
53 + - recipient: age1nc9sh92wf62nt89k4vgyvqws2pt49cq6xqxx46jqpz4vqxsh5a4q8ltzp8
54 + enc: |
55 + -----BEGIN AGE ENCRYPTED FILE-----
56 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCUnhyd25Dei9rYWZlc3Qw
57 + bzd3cGk5S0N0NlQ3K0JvcGphT3hheW5nM3k0CkVBbU83RXlyZWwvME9yZ2wyUktI
58 + RmRQYmhrWHZ4UzhBUTFkSnVTYS9WWWMKLS0tIHU1L2VIbEQvNDlaWk82ai8zRnov
59 + V2NGeVQ0aWl5VVRoazA5dlY5RlpoRU0KTLh6k3QPa+CSyHMe/NBQw1hoo1UNHUV6
60 + hToDcRsJrsGdtFT5hthvljZA4JTZjraHP2sqsv8mZNsNcVyE7R4NSQ==
61 + -----END AGE ENCRYPTED FILE-----
62 + lastmodified: "2025-07-31T12:39:52Z"
63 + mac: ENC[AES256_GCM,data:YSo7nBvqrZuwH/yzY1U8mFn9PdxPJEm07rY1mHJGdqtDY1h+mp6NufMvW2cNqUk6IUakxuqUUOcXgDtnkS3hLW+lN+Yur8jklyhEx4m1/XbIq01PGHIgLPC8v1Kvigc1ZO89UmFrba8+gFXTgImfXVg2LTyHjWp7VIySvUxnlNw=,iv:qlgxip8P7Ud3xR8qnrJ7W+BhujLBdb9bOgEucw8wXkc=,tag:j61ADB3G6wGVMco9WvnFnQ==,type:str]
64 + unencrypted_suffix: _unencrypted
65 + version: 3.10.2
non-critical-infra/secrets/ofborg.core01.ofborg.org.yml new
+72
@@ -0,0 +1,72 @@
1 +ofborg:
2 + github-webhook-secret: ENC[AES256_GCM,data:9yLN867F6kJHHQcrDGw/TC/tUQage4t0Uhnu+BMjj/qqaA/BULCUu73U1R+Llb8BdkAG6Pd9sLEcTsoz5kfSug==,iv:lFVdhOI9a08Q06dRxOqS2YDbYudIxqkalNeS+qwall0=,tag:VVTzGj4Rvul6z7Z8c+zS7g==,type:str]
3 + github-webhook-rabbitmq-password: ENC[AES256_GCM,data:UYJ1Cy0gJ+n5HLgnxmm6ggZg8GlBGWGOUoYC1eB8FWBbo3UtVoq0syXQSFNQl9w84+E=,iv:C94Ma14s6CFKlogrIMc+JYTDBjhzAqCscPqonXrMsdM=,tag:hzBD63/qBye5belOmE/vcg==,type:str]
4 + evaluation-filter-rabbitmq-password: ENC[AES256_GCM,data:HCpnksWNrl+7gmGv24sC/Hew6GbM/xzZpKYdNE/zmQ+rwvfZVvVncromEbTW7ksyZ6Y=,iv:PDDf+U5xmTvKx4+5NY1gc+J9rIuepXRPvf/7Zd+yBG4=,tag:g+7UA6Q8W70Tx/qepMXPUQ==,type:str]
5 + github-comment-filter-rabbitmq-password: ENC[AES256_GCM,data:EL3y07go0UP2nHpvSmDkF9DcdyoBFe3XOE8HxQ5xb611Hs5owGFfCOEmHxNRfkNUNN4=,iv:Q054FgRtiFuCwQgm4+npi7AkdO9k1Is3snd8QFXgKXI=,tag:eMTsLRLaVmZsvGbVaurjow==,type:str]
6 + github-comment-poster-rabbitmq-password: ENC[AES256_GCM,data:dYm6yZ94yX4RMWSZdHzC7/8NNLN/u9Yyr0y8WtnySy2bkdvOfxtXgPnafeCt4hUrdXg=,iv:xu27b9YM4Z3apmVoolq8wYy5bi2Ip5ScrNMXi6pFnNs=,tag:qdaYYHV8f7PLb+xXgfdxVA==,type:str]
7 + log-message-collector-rabbitmq-password: ENC[AES256_GCM,data:HZaFkL/coGffcROPb0Np/zyIwVSEjmoQmAteV8fx1SBmVSLGsSWmkwitvRHNKDXZu8o=,iv:ICOwj8kYiEbrkldIE54DmVHdglpwR0W6Bqvh9GKroJY=,tag:/DOrZzK62S6Ut95uJjtf6A==,type:str]
8 +sops:
9 + kms: []
10 + gcp_kms: []
11 + azure_kv: []
12 + hc_vault: []
13 + age:
14 + - recipient: age1rrrj8tgcyp9xfxvy6zmk9487x62cgx0z68l7jretz2th6ey9nf4qh7nq7h
15 + enc: |
16 + -----BEGIN AGE ENCRYPTED FILE-----
17 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkOXF5RThxTGFFNHh2Q00r
18 + cGcwVHY2RlhDUUN4Q0Q2UUw0VjVWUWsxRXdvCnFXa3VjbmpjSnBnVW1vQTl3OHBK
19 + ZFBSWHRMekRBL3REQXNEdmFFNEJPUUUKLS0tIE5xcG44ZEYreVpCb3YvWHovMVJh
20 + dkdyRGtUaThBNVBKaHRQRUcyZGxja0UKVvt/NZOpa2YhhhZdig2OKOauZnY40Q+2
21 + VuOMUuvrW/lzHI2xNQtd5XYNM+OB9kNgcxmQltqndxZJfs4XJQge8Q==
22 + -----END AGE ENCRYPTED FILE-----
23 + - recipient: age1j3mkgedmeru63vwww6m44zfw09tg8yw6xdzstaq7ejfkvgcau40qwakm8x
24 + enc: |
25 + -----BEGIN AGE ENCRYPTED FILE-----
26 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoQk1YTDhxK3BsVTgwZnND
27 + V0Mxbi9MZTdsMWQ4Q3JvNzVhRGRpZ3NIVHdrCnlkN1pLRElJNk5NZUw3Vkt5a2Zz
28 + SGJsTzBqSnhnU3cwcU4zRTlCc3RTRDgKLS0tIGpycHVrMzBYVWZGenBnYXoxM1VI
29 + cFo5ZTNSajJmQS9ZZi85V1FHaUplbTQK09kAVXeEVXWWWjKg9zIFNB55EN9tfD1P
30 + CaF/rmtb9hmvdpkaFkDVY5ok9+2T2gTZqvT5FsCFypCKLZFxMA4tLA==
31 + -----END AGE ENCRYPTED FILE-----
32 + - recipient: age17ez23w2kpxl0gcdx4ehcglkcfcfnv4qz0gq2n8ylxwx4yrtjpvjqxfasua
33 + enc: |
34 + -----BEGIN AGE ENCRYPTED FILE-----
35 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrOXZvV0hldFVzQUl5OTBn
36 + c2pnVEhEdCt3OCt6ZWpMbksyVUM0L2hib2hzCmZSSTBEMnl2YmoxTFRFR1hEV3NI
37 + Z2JadlM1YUpnSzRBZWRxaE9xdW42RXcKLS0tIC9ROHZhYS9SNjZ5Z2x4SCtoTDVC
38 + VWYyWDlaWWJHQ3V2QTQ0Tkw3K05vclEK+YYPsfCnCdoO+rEVMa6SgVJb5t7JIym6
39 + 9n+2d82caUcopTaLTgzj8t7tzBGCceaxtRUTruIOH2EvvhLoL5RjnQ==
40 + -----END AGE ENCRYPTED FILE-----
41 + - recipient: age1lz3mvem0rgfxj7uavth8du4xsw23wp5ts77m5vvclxyj5mjxfujs0jgtcz
42 + enc: |
43 + -----BEGIN AGE ENCRYPTED FILE-----
44 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmWlFvQ3dMSnpMQjM3SW9Z
45 + SFU3NjUybUVQcXRuNlhLb2l5Nmc3UUExbFJNCkQ1amUwb25yZXo3NTE3aEJieGNC
46 + d1JiSHQyd255VTMzZEQrRVZOZjBJKzAKLS0tIFpJTUZ6REhjVSsrMmtIcW0wL2tN
47 + ZzhValo0eUkzSThhU21HenRvZTNwOWcKeHbXUgWbPEzNdEm6mm755v9cZReLBVwO
48 + l9Q5UntN1RzjNTe0+6/QZDlqm1E6A7BmMPFDKV8Advdkg+auBcFgjA==
49 + -----END AGE ENCRYPTED FILE-----
50 + - recipient: age1m68dw9dltvtsg8e9lf5ts2vwnn4ykraguhjr8v65s0xessk3xqeqyz5jwt
51 + enc: |
52 + -----BEGIN AGE ENCRYPTED FILE-----
53 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxdXNPcCtzT0dTalQ0NTZk
54 + d1pNaGdaQ0dEVnpZODlRaEM3czRwZVJ0aFRvCjdTZmZvelhUcHJoRmMvYmxHNUdu
55 + SFI4RHZOTjkyajBZd2MzU0tWVGlTZm8KLS0tIHNBZzlMS0VFcGZBRDJzcjV0V1RT
56 + M082VE5sQWNXcHJaTUhPcFdWQ3ZjNGsKAiQDeZ2KASXqYpLs72/Ns99bZXfuC65J
57 + EGiV23fkuCo//09nK9Ll8XFGm2CUTHrk352TBtL0v0Tz64jCUY8drA==
58 + -----END AGE ENCRYPTED FILE-----
59 + - recipient: age1nc9sh92wf62nt89k4vgyvqws2pt49cq6xqxx46jqpz4vqxsh5a4q8ltzp8
60 + enc: |
61 + -----BEGIN AGE ENCRYPTED FILE-----
62 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArVUhEZDkwQTBkYUhLYTRT
63 + ZC96TUJYbTluV2V1N0s0dVd2VnZSaHIweUVBCjV6ZlZ4NERMUm1ZUlk5ZlRvY0lw
64 + Zi9DMi9GaEV0cThSU3NUZVQ2RmV4Y1UKLS0tIG1PcmY4OEIrdXdlbnY1eDREQ1BV
65 + VkZKL0Q2TzF4TCtlbWVjSjJFVy94ZjgK75ST+KUV3pxkoEAwmqoeGVqlnf1lhm3u
66 + Kwno/31LOCmeivVkz+L7DD7/BlBeh7BaPyhDyD+WPnlD/jAeN6NPag==
67 + -----END AGE ENCRYPTED FILE-----
68 + lastmodified: "2024-12-30T12:13:27Z"
69 + mac: ENC[AES256_GCM,data:X+55YgOwJ1V2V11tO6JwCRa6EugXuAp1e3IqWUZHuEVz8SaeVDbU4IB4xIzXw8ug8caWs1vljtWSjXkcLpmnfA77rx5x4h3sKWjW9CM4Wrz1jtI2uTaGMlZ+xKpiPDQD1YJHjNRRPLp8QCUfUH6UC9RfaWONubiOOttfIaFbLOI=,iv:prULAefZKflT054J6i2y5QA5zLxQsnuO2YiR4wR1yho=,tag:BVo78nriAN5HmPfBdMqScA==,type:str]
70 + pgp: []
71 + unencrypted_suffix: _unencrypted
72 + version: 3.9.2
non-critical-infra/secrets/ofborg.eval01.ofborg.org.yml new
+67
@@ -0,0 +1,67 @@
1 +ofborg:
2 + mass-rebuilder-rabbitmq-password: ENC[AES256_GCM,data:vQTjY4bitWJwOxqIO6FdCcfpcsnSaK8FLYSFipAIwYIWoWK+VLpuJJJuRgcauXczVs4=,iv:8FPVs17xmeVAAcGQzN6pY7W78IaU7ynNE1a4GAZk62k=,tag:KXqp5ZBPPQHkl+M1G9+eTg==,type:str]
3 +sops:
4 + kms: []
5 + gcp_kms: []
6 + azure_kv: []
7 + hc_vault: []
8 + age:
9 + - recipient: age16d0phf8c5wy3rfsd4pgc42mqa3aw2llfukdhgu7pzklnzjr2rvxsusz842
10 + enc: |
11 + -----BEGIN AGE ENCRYPTED FILE-----
12 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4dVBNVmNpQzZDVDBKR1RB
13 + Qm5uMjN2VFhDeThXTUEyRXZFMWJsSlZSTmtjCk5ZMGdTenp4TGhiQkRZbCsyKzI3
14 + STVvQktGWVhJNkFCVlJXNVJCdEJ0UkUKLS0tIHNVQWFsb0FsSnJVVDdCRGRINHVW
15 + dmVaRGFja2c0OSt2SEtYalFpdlNYTkUKm1VelPESqM6q1uzfvxW9iNTOAt4U1tsz
16 + 4kBh5oc2rx+hNWP7gNsS4kRkJxxTNOvu8GWltt42ItJ1o9FLCCdb5Q==
17 + -----END AGE ENCRYPTED FILE-----
18 + - recipient: age1j3mkgedmeru63vwww6m44zfw09tg8yw6xdzstaq7ejfkvgcau40qwakm8x
19 + enc: |
20 + -----BEGIN AGE ENCRYPTED FILE-----
21 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuLzBITFJZTHNuOGdGNHl6
22 + dCtFaU8xQW9YMitIM3FMODVNT3NicjF5K0dRClNkS0xId0tRaU5GdVZJcVduVUJD
23 + U2twdjQxa0RJS3lwS3J6ekJIRVA0cEkKLS0tIGdJeXBkUnZUbk9zVTJXOFd4cVBz
24 + M3dUUGhhZmVzSUE4eGFVY1JwRXRObU0KA08rMP65rri96BMZe5/qVQaLvFzLWfot
25 + snuCObBwodr968tjWMv6tcotvVfBhGZ6GTTbE1iRAc5+iYENHIwoeg==
26 + -----END AGE ENCRYPTED FILE-----
27 + - recipient: age17ez23w2kpxl0gcdx4ehcglkcfcfnv4qz0gq2n8ylxwx4yrtjpvjqxfasua
28 + enc: |
29 + -----BEGIN AGE ENCRYPTED FILE-----
30 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOR3E5dER5aVRHVUJVWUhs
31 + dzBBdlA2a3VBWGJiWFNBRUpxWlR3anBkbkM4CmN5VDFkRkp0d1ZQeEJKRHNrRlZQ
32 + SVBlTkNndjErWlNzcTArNW1FNUloVGMKLS0tIHRyN1VJQVpZbTZOa2FvQTdWM3lk
33 + RW12UVRuLzRsZTZZV055R3JkODd2SkUKnNMbhGDeAGJwFDDySVhM+jxAFtyxAI9R
34 + ZSTBQjmY/VaZy35hwiZ7utrq9bzy5WjmYmJHkyQUEIWAmUDdoSZ3qA==
35 + -----END AGE ENCRYPTED FILE-----
36 + - recipient: age1lz3mvem0rgfxj7uavth8du4xsw23wp5ts77m5vvclxyj5mjxfujs0jgtcz
37 + enc: |
38 + -----BEGIN AGE ENCRYPTED FILE-----
39 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByNHZOQUw2ZGo5Y1Z4SU5Q
40 + NjdCY1pUUkZmclBxVGkrdlN0VWVSRm04UEJRCnNYdTVrV1lWOEh0T0JSOXVqdFVJ
41 + VmNHZlhjR3FHMGhOVkQzNTgvTDZMdmsKLS0tIDlKeTgzZ05rOFhMQWNOUGlITTdM
42 + QjNaOGZZaG1ZZFRTNVQ1Z1MrODlhS1EKb0E+AZhS4K7X/Lh4pQaHTzfPB0uD6eB/
43 + aCLFDbjoraOrsMu4zZipOBwdKHJ+4DnN82Xmn40C4Ev/y3gDLyHxmw==
44 + -----END AGE ENCRYPTED FILE-----
45 + - recipient: age1m68dw9dltvtsg8e9lf5ts2vwnn4ykraguhjr8v65s0xessk3xqeqyz5jwt
46 + enc: |
47 + -----BEGIN AGE ENCRYPTED FILE-----
48 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBONE92Q2hzanh5RDlvajhL
49 + c0lwMEV6bzJZQlYxMDBBR3A5Y1ErRnJJdmkwCjR4UlFBSEoxQ2ZVQUVpWXd3L28y
50 + dUZQU1p2Q0VmbCtmMXhjWjBwZDRHY3MKLS0tIGpMcFBGbzYwWjV1VEh4czJnRmli
51 + WUJaWDBMelI1NVlWT3NQemZodXhMN3cKbb2yu0joqiYZswddPg5XSMvtdU+opMKz
52 + zosvMKRMqFnG1r9eR7Di2mD6xW8T9rvNluxpkOmAo3txCwhELxfLPw==
53 + -----END AGE ENCRYPTED FILE-----
54 + - recipient: age1nc9sh92wf62nt89k4vgyvqws2pt49cq6xqxx46jqpz4vqxsh5a4q8ltzp8
55 + enc: |
56 + -----BEGIN AGE ENCRYPTED FILE-----
57 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlZE05K2ZkOEJLRDQzcThG
58 + WnZPN1A4cit6VEFEV3RxQnNzMnZiQU9BajA4CmQxdnJHWEFUK1MxOGYwNzNSZzJl
59 + UUJnMEJIS1VwSU9mRTRkbitXelNiTlUKLS0tIElYcVErZ2ppN3NUL21JYk43Y3hN
60 + WlNtVUR0YitjWmhRZmhDUG1vNUdDRTgKw7sRQ1Ao876O5KBd7TxjyYBgYTKE7qFN
61 + OfbIj+IRgOtsh53cuBX7exu+Amuh3+yQvaf0oyjuSDyjJpfwCwK5DA==
62 + -----END AGE ENCRYPTED FILE-----
63 + lastmodified: "2024-12-29T17:01:34Z"
64 + mac: ENC[AES256_GCM,data:UlS0/7BBaHyy07Be/f44q1N/43zpeiXMCbD/uIyNhkAGTzRbPBLPMgUsfr84XQMdeNXJOiI5XN6Vxy8rXEkpz0O8xqE1TIZq/IMNTEFOasFV9Fk59hmJmOBXYaZzAEVBrIvOqJt74AT+0Y38AusUW+wczyQZt2ksVpL2vvBpqLw=,iv:iF3NoDcANH7QvfUT+8McXjIEBLSX4ApVwOExP1T7HVo=,tag:QJXvBouCzgEjPfWipbsNCQ==,type:str]
65 + pgp: []
66 + unencrypted_suffix: _unencrypted
67 + version: 3.9.2
non-critical-infra/secrets/ofborg.eval02.ofborg.org.yml new
+66
@@ -0,0 +1,66 @@
1 +ofborg:
2 + mass-rebuilder-rabbitmq-password: ENC[AES256_GCM,data:ipEMLuirLRKHMr58Ga3gLVm/NSMhIVEdbWG1RJ4Y1rOSQWaakyzfjEIwRRrBRu5oHkQ=,iv:tH3tuqUzVintlGnwONZ9lSvQzUpDI5q644PBxBdHssI=,tag:GunGT6vvbwUK14KQ0Ed+9w==,type:str]
3 + builder-rabbitmq-password: ENC[AES256_GCM,data:Mn6LTtIYUCaTc51eeRhssjqiRubD3oQxZa0KMA8ZbHJaIFJekiqfTUZA/G5LdT4nJNo=,iv:yyThReELLfPmOqsb7A8bIeRK6u1VwWWhhE82ypqoggc=,tag:C2XU/r8HKsJfHjP70J/SPw==,type:str]
4 +harmonia:
5 + secret: ENC[AES256_GCM,data:0Ovat+iPF/JzlDnhAUBAkPZLKwtu1ntLVS8UZoKNtaoftKqQ4rR4+1VFwfLLYnagBrDtf1zhWRJOnnvRSC8g08clsMUXk2CneogJVKZdPIKfeL8Dsk4Axh0t2nXVQYKQG09jyDPUs4UgAw==,iv:jx6arJ9d9qf+xAu5g4kNNERRvmWrRq72bVqdcSeqOD0=,tag:Lwa2/I++Y5GtADN+uz5syg==,type:str]
6 +queue-runner-client.key: ENC[AES256_GCM,data:DQjjWeAqT8aE0FwOnaUloEr3lan5Z9k1bMi/hxqo2O0T9PtuNMzJVBaU+uhLIsiUL7MtFHK7WDkLr95z2kNw6HrnVjEitnAy6RRc0e2uO/TryEhZJMf8D49a+LYoSEgUOAZt8DH0yqD9lRUSbLM1/JR3pPOUJeQ=,iv:TJ93bHR6amSgKlbYnUbVX0Wg1nfA4rU1NwfsAknqkwM=,tag:9veAYX2HcQiFaFahDrTxQg==,type:str]
7 +sops:
8 + age:
9 + - recipient: age1qn3q3y04pxumygmq96x0gk9qtrdcgdw4y5nl6xd780u4avk0qgsqy8tuu0
10 + enc: |
11 + -----BEGIN AGE ENCRYPTED FILE-----
12 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpRUJnWUk2ay94WDFkYXM3
13 + VG5lNkhWWjVmU24yaE5pVmY4LzdxQjlOaFNzCncvNWRLYlFTamliYWx5clBOeTl0
14 + UlYrMVVXWkJVcVR3Vlp6V2NkcGFkZ2sKLS0tIFVJN3c2UW1PeFVTNDZDVEtZUFRS
15 + c0VtUmF5WXY0RENFcEhwUDRFc3FMeU0Kkda4+csIM7ucD8qePFGy6eTdUJbsSmR/
16 + bWKnK1Sl/HJ+p5naF0IJ8JtXVKYHJYlUn9rGfJvkfS3RXBCRQhexXw==
17 + -----END AGE ENCRYPTED FILE-----
18 + - recipient: age1j3mkgedmeru63vwww6m44zfw09tg8yw6xdzstaq7ejfkvgcau40qwakm8x
19 + enc: |
20 + -----BEGIN AGE ENCRYPTED FILE-----
21 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZUWdXUzRMUnJVZXd6Q3Yx
22 + MlJDWTFsOVkxYU1kYWpyVThrdkZoZXMyNUc4CmFOZEpmT2s4clczQ0xndy9GRmZM
23 + QVl1WkdnNU1ya0NJT0xOQktDK1ZGdmcKLS0tIEhCVGdqNEsxYkNxbHovU2pURUZ1
24 + QzNodlg4T1NFMGszN2Y1TXRsR2FHd00KwG8buymdfyltvDa9YuvOdU5yjgG0s2ti
25 + 3UlK2gDcP7q4FcJo8/QP/v0QqKTuGv+0HrdhMgVw/VVdkIZ3dD3TKg==
26 + -----END AGE ENCRYPTED FILE-----
27 + - recipient: age17ez23w2kpxl0gcdx4ehcglkcfcfnv4qz0gq2n8ylxwx4yrtjpvjqxfasua
28 + enc: |
29 + -----BEGIN AGE ENCRYPTED FILE-----
30 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0b1pWSy9LSUZDbWtheTRO
31 + cW1VU3ZUcG1POUdwbjZzd2JXVStJQWZVcmdNCllwT1p3bUhrS21BUVgyZEJrdTJ3
32 + U0hOVXUyWGpXdi8vSXJWeHVyUXhKaVEKLS0tIGEwL1lHQjR1WjBjeUEzT2l4TGps
33 + QTIzanNXcmpZNEYxdjF2MVhrMktKNEUKncQUla/SmWXlkNz4LK3AMNNJLMYY5AzQ
34 + duy9IP1dhfOBaj8u39AH/9yK1C7CGSdlpZB4nQFMAviUmcFOLkjJcw==
35 + -----END AGE ENCRYPTED FILE-----
36 + - recipient: age1lz3mvem0rgfxj7uavth8du4xsw23wp5ts77m5vvclxyj5mjxfujs0jgtcz
37 + enc: |
38 + -----BEGIN AGE ENCRYPTED FILE-----
39 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5V1hZaTJUZHZFR2RxTmNn
40 + TUJVbkR0OFZEM3VEWVhCNC9tZkJvSG9qSm5VCmJSckt2NlNmVlM0ZFh2eExIUEo1
41 + bHJFVFNVd1pYZkNDQTltcGVPQUlMSWMKLS0tIGRQL1RMRXVOQzRUbjcwcFE1cFZz
42 + eW1FelV4akJmM3RTeDRVQ3FNZlhNWUkKLRAB/+bnexIGYwAyczY1IIDFzvji2OzW
43 + rqOdtyGCi/99tMxtfsK3h5UFZlMVEOOosjz8n8WTC2/g/P4H5CVgrA==
44 + -----END AGE ENCRYPTED FILE-----
45 + - recipient: age1m68dw9dltvtsg8e9lf5ts2vwnn4ykraguhjr8v65s0xessk3xqeqyz5jwt
46 + enc: |
47 + -----BEGIN AGE ENCRYPTED FILE-----
48 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEa0NFQ2l2V3dpekdDUGxl
49 + TFFZNi90M25tWTlYSnphN2FwaUFkdTNwUG5rCnBDK2laVUd0MHFGR25yc0tHUDdr
50 + eURKRlJJcHRDcFJhUDEvVWNvSmc3SmsKLS0tIFF1ZDNvOVhOdTNQaWZtc2I3Q054
51 + UHN1V3owanJFVkI2VjBVUzhwYUhpNjQKW6IQ0cjfk3vxbNuZY4thgOzL630Nxf3Y
52 + iQOT71FJA+Byj9NN2D/tapJdanilS6eVxzUJXhKkaFLRHa+D02vpAg==
53 + -----END AGE ENCRYPTED FILE-----
54 + - recipient: age1nc9sh92wf62nt89k4vgyvqws2pt49cq6xqxx46jqpz4vqxsh5a4q8ltzp8
55 + enc: |
56 + -----BEGIN AGE ENCRYPTED FILE-----
57 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2aGxKbXdyU0RLZlZ4eThW
58 + QUFYQnpoeVRQaWRLQWJLcmFZbERSaUlpQVJjCjI0bVoyNGhRMHp1TlFySmlMQk8w
59 + UVdaVW0zQWFMajZtdlphN2dZS0thcGMKLS0tIHRnWlRJQi83RWJhbTE0RzYwWGsy
60 + N0c5YUxDY09IY01kYUJvZFlLcWtvN1UK2eBUCm5Ikwt6NClzLI8xv5lSMsaM7ETo
61 + xW0nPj7CxS9Xpvte55lQja5bnCZjJe+0s1WJndtgBs+AgksuCTNseA==
62 + -----END AGE ENCRYPTED FILE-----
63 + lastmodified: "2025-07-31T12:40:14Z"
64 + mac: ENC[AES256_GCM,data:jO+sFUbBhw/OD5U9gXvwe1YxedMW7jxv8je2PJXOX4YApUlk98llGSth1AOMK+Jkfky2yyxgCUb+vDves0u8UOE41itdaFn3Y1FW46cacfgQFJUuepDB+btlC632DYULEM+e/9mAGALxI5AYap0rtce+SEWfPhXXGbm06c+kRI8=,iv:MZfvT6scO40FsqjA4augXuRnf8XgzbRx0coZ1X2MBe8=,tag:V4UPyi0gMjR+WO+stBx66Q==,type:str]
65 + unencrypted_suffix: _unencrypted
66 + version: 3.10.2
non-critical-infra/secrets/ofborg.eval03.ofborg.org.yml new
+66
@@ -0,0 +1,66 @@
1 +ofborg:
2 + mass-rebuilder-rabbitmq-password: ENC[AES256_GCM,data:bG3a7gAx9XhN7TM5wEvXeC7lB3ZaLz2NZU2VEjaTdTzHDtwQZl/T3gOvJR+RsO7fDJs=,iv:bTx9Bru62CCBcHvPSRIFfVG+eeSRvN1muk0p+ROqGO0=,tag:Zl/L52kl1qTd1VczlHa3TQ==,type:str]
3 + builder-rabbitmq-password: ENC[AES256_GCM,data:5sFff+ugVDLRiwHsXqp0evM9JT2P0I/0twqVEQ2HZo95wo+38Gavlx7tHfIEZC58+QY=,iv:maBiRtPM2/fv84kJIdkbh3sPrgadDPfFBlBCh0Lu7l0=,tag:0gvoarCDYB+Kb/mXIi1ifw==,type:str]
4 +harmonia:
5 + secret: ENC[AES256_GCM,data:DB0GIKQaVew6Ymn8cJnHrB0B0nlSRtkn+nDIFB1irlnTmBwyUFRnKUVL7Rmd4iejPI6tjZhjKccJ2/A+ZlM6I1kczrdK9+HwwVrTZml+X3QNtDe5EDB8MMVU8Wzn2gMWJQQN7SGQLdIVKQ==,iv:C3QsBXVUkXtRXC2mm2OlAL6TB1Js8O15NBpurm0a+zA=,tag:L4n/cNQA5fmnOOTudyQNbg==,type:str]
6 +queue-runner-client.key: ENC[AES256_GCM,data:kRctoguQnH9W088o/PLGf73Vv2YYJkom5r/mwRSMrBcSnQxYoHFcqvbuoX4bz4M0Qvjh8nX+yMacNP3n36HlYBaUv8tRoxwyH1Kf6F/WqBiEp6Ilrd+f8kZbPEL1VqA5ESQVQ3N2szUBOfCJDnk3wnCa4ZVj1jA=,iv:2lWsWdcFDmOQuusZx2TOIsl/49GWE2dlqseL0+UgLFE=,tag:lxRnciShgszhiP0itaceSQ==,type:str]
7 +sops:
8 + age:
9 + - recipient: age1yssfznyq8rljcpfthpulnvfls0l5t36fpqxkk5taxcwpkqhv9gcqrvvwh7
10 + enc: |
11 + -----BEGIN AGE ENCRYPTED FILE-----
12 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtZXR5WC9VRFNPMHRXSXRJ
13 + ZE5yZjlMRGV2bVpzMUx3cUloN0I4TGowOFQwCnRuS3Z3aDdnV01QQUF3dFlveHRY
14 + aUpoWXdmSk8vT2o4U1ZLS29OTUhkWm8KLS0tIGF0Uy9JQ0t3TkQxY0hyOWp4Yjd4
15 + NWo2N0hQSTJoRUNEYmpUZW9LUktKS1EKVl8MPhroHW4NJ7jcZo7uzwtjP3DmLqqj
16 + zWlITjyZATB8I2OsaricBocdtxlJDNtVRHCpimxjqUpFmItbMbrzQA==
17 + -----END AGE ENCRYPTED FILE-----
18 + - recipient: age1j3mkgedmeru63vwww6m44zfw09tg8yw6xdzstaq7ejfkvgcau40qwakm8x
19 + enc: |
20 + -----BEGIN AGE ENCRYPTED FILE-----
21 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLZkhjeFBnVHZSdHlMRmtU
22 + MWp5NWNEWkFrdUFFUEU5M05xNE4zYnFjL1FnCkVEZkxJOGZQUzEvazYycG95TzJl
23 + MWVvTW1BdzJ1TStGN0JtbGl1N2o0UkUKLS0tIERJRStwR1hPaUpvL0Y0ZFlZeWJG
24 + cC9KdEhCa0IraitrMkNUNWRVMm1JM3MKUUWWGTmpRwB6HYMb7kZ4KDH2jBUGsGuv
25 + 8eSTpyXXYbHCgkLAJIn7J+ET8agpEg5X9bNJc/uG0dxVYRgV0hQxUw==
26 + -----END AGE ENCRYPTED FILE-----
27 + - recipient: age17ez23w2kpxl0gcdx4ehcglkcfcfnv4qz0gq2n8ylxwx4yrtjpvjqxfasua
28 + enc: |
29 + -----BEGIN AGE ENCRYPTED FILE-----
30 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmVXFwdklma0F2OUkyQk5a
31 + VGN5Zkc1SXNkcnNvL2w1L084Rm5POG83NVNJCnU3VFVHak1ZVmpmU3p0aHFQeHdL
32 + Uk9QcmJsekcxT0wyOEtDN2JjQVBNY3MKLS0tIGhxRFQrL0ZVYnJpYURTczlPbWFD
33 + S2w3eW5ZTHBYSEExZUk4SmtxdnJCTmcKwcxD6oLROx2Y4aCEYVL1CHV273/ts54x
34 + mZSuD9kssOPc5GC6Wa/XIYbcGbXMlD+psveNpaNtMY/WS7lX8IwoEQ==
35 + -----END AGE ENCRYPTED FILE-----
36 + - recipient: age1lz3mvem0rgfxj7uavth8du4xsw23wp5ts77m5vvclxyj5mjxfujs0jgtcz
37 + enc: |
38 + -----BEGIN AGE ENCRYPTED FILE-----
39 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMS2IvMGwyZnRqenN4d2pF
40 + eEMvaHR5Y1ZSWEQxcXVRMEFjVjAxaDBNQm5NClJQaUljZjRxME94SkRNMUE4OWRj
41 + dTYycDBoTEZicjRJbFNvWStrQVZwNDAKLS0tIHUxTHZmTk94UzVjREpLRTZ2Y0lo
42 + ME5aODB5OFM4aUpHdnlMbklSejQyMFUKly7wnZ3q6n8Mv05EkcCAj4GyLGba4kcM
43 + IW/gg+vyuYPkoxllFb/lbkpQMs57kWQ32JgEaY0gXBaBjNNYZ7lpEQ==
44 + -----END AGE ENCRYPTED FILE-----
45 + - recipient: age1m68dw9dltvtsg8e9lf5ts2vwnn4ykraguhjr8v65s0xessk3xqeqyz5jwt
46 + enc: |
47 + -----BEGIN AGE ENCRYPTED FILE-----
48 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKUEpPdDJGRUJ3bjRLR0k4
49 + d0lKV3NJeWsxdjdSYUVuSG84ZFp6bndpNlRBCk40c0doeUEvdlhoZlgzdkFEZEtS
50 + NmpWdExsR2FNVitLYVhBR1NubTFrTFkKLS0tIDIwSkdTQmx1STZPL1BJa05EanN3
51 + bnYvMGZJdnJadXk2ZkhUcXpTS1NuOGsKDh8RAx/vuN4jYQKOWySdpdhbOD399TR2
52 + cl+Y6dnl6UM81lSAJz1B9eKI9hn2cuDW6TrLPc5fb4kFnwlYWwro2g==
53 + -----END AGE ENCRYPTED FILE-----
54 + - recipient: age1nc9sh92wf62nt89k4vgyvqws2pt49cq6xqxx46jqpz4vqxsh5a4q8ltzp8
55 + enc: |
56 + -----BEGIN AGE ENCRYPTED FILE-----
57 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6OEs5YkxoT0FHbEpFRjJv
58 + SnpGZExua01Hbyt0WUZhSFV3QkVpcGVXMkFVClFMU2d4cXlSSm4zRmRIWG15L2tu
59 + VDFjSFBGVHZxREJFaTJOY2JPVk5HQWsKLS0tIDREamUvSThrTkdRTUFrOUFrRjFB
60 + UFpzRHFaMkZnYkxFeTZxYzlZbTZ4b28K9Kmul+h7Ltzm/c4stGW5MzQflmFqKctr
61 + kgV1a+1qMkwHgoGFOyFZsCgrU62145EFuQ7X4bIq2ItSpeTAU8EITQ==
62 + -----END AGE ENCRYPTED FILE-----
63 + lastmodified: "2025-07-31T12:40:29Z"
64 + mac: ENC[AES256_GCM,data:ktTeS9q/Nn5OVw1uXgtOIWMQkgBe1VYyXxXEALExm/vK5rk3Y6SViY9xL9mNPySQr81NMzo8Y/5q61Owqqax3a5XrQA3m9x4pj16FvAOdcOFJjhRG+/Z9eZdC62DFa+GQDXL0FcauYmn4IgelcJxxJjeltGZO9T5tjB0d5qVeb8=,iv:zYLb1aBMZeKB4roG6ADKqrR9XDRmPgmpL76ky23/VXo=,tag:YhVMoyxi7T5I2h8gfklNyw==,type:str]
65 + unencrypted_suffix: _unencrypted
66 + version: 3.10.2
non-critical-infra/secrets/ofborg.eval04.ofborg.org.yml new
+66
@@ -0,0 +1,66 @@
1 +ofborg:
2 + mass-rebuilder-rabbitmq-password: ENC[AES256_GCM,data:VGNge1ehls864sKzDJVgpngMrey2E6Kl9Z2n0lljA5hQkHc1fMxoayJofeLiJPQI/NU=,iv:VvTb0V6vFxqhH4RHfVDqhgRWf8X/wDQtoDPGJRL8vCI=,tag:soyUaOTnwEUHrIRAzBcr8g==,type:str]
3 + builder-rabbitmq-password: ENC[AES256_GCM,data:bS1pbz+76nI8+dbqvYe+Qnlh+NuENd1AtKXY9W04n8LW2b0plwdA6JbhRqP7e1q+YNs=,iv:IPL0NKngwD+86NfSaRCK4RHB3d6Ceo7O84EXv6ctz0M=,tag:81T6syiQDyy7BrARgmtEKg==,type:str]
4 +harmonia:
5 + secret: ENC[AES256_GCM,data:kSdrSKY1Gei0wqvz2B/hhKd1ByoHmgyJZl84qvbP4Uc+NkmwM3tJmuunkPKz9na7Q86DLv3TCYz03mYoUskl5QsuePt2Sf9s7/ZOE4uYI5Xy+DWQqDXSQ0YWltiEth4FqOphkJS3SdmTgA==,iv:uDrxPaxL1fCa2YZYc9GqQAOVke/0P69TS+SEMexQ5xc=,tag:iOlSKt7gwMDyIaI6MeHpOw==,type:str]
6 +queue-runner-client.key: ENC[AES256_GCM,data:QJGUhlM7v0+VPfaQK1usjtFzfTvvjeDwjBEef5sxyd2T753Owy1tWUYMxLxNTikkAGqs+uVHOM6yprpTBSMnpB0J38MgrVtxXqTwNNmEQnJv4xkNV+ux743crxQW20GvoHCbpevob/yWeDTUhKJa9kmNxiKkKPk=,iv:9HJ7iWMr3T7xRoUWSsn7wMlY7abB8S2XgIN4UMLWMAI=,tag:kqO3RPidoGagOoXhfQAfmQ==,type:str]
7 +sops:
8 + age:
9 + - recipient: age1vunut833rrdfulgnsjqtuke4yjtzexn2xqjqavwzxlgrg7n4y45qhurzwc
10 + enc: |
11 + -----BEGIN AGE ENCRYPTED FILE-----
12 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3YzlpajQzeEtwVEdqYkhr
13 + bVc5UUhsZ0hWbmxWSkl4azNreVhqK0x0MWlnCmNqbEgvY0c5a20xQklSd09sMXpJ
14 + c1kyVHNqbURIZ3F0dm13ZENXV3VleGMKLS0tIDEwQUMyK0dwNGZFOWZzdi94QUdv
15 + c0xHNE5DSkp4cTZuakRoR0VPYUk4WWcKXFZA1mJIpkynTpgaTl2E0XJuMArkM6vB
16 + GLzuoMqAUzludzzSF+9f6CF+o5FoAyho/Q4scpqqsPcwpMZ1UMpxkA==
17 + -----END AGE ENCRYPTED FILE-----
18 + - recipient: age1j3mkgedmeru63vwww6m44zfw09tg8yw6xdzstaq7ejfkvgcau40qwakm8x
19 + enc: |
20 + -----BEGIN AGE ENCRYPTED FILE-----
21 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5ZlhqU2NoL3RsYVNReEg2
22 + ZTFqNFRmU3RxdmVTRTZtcWFNdmMzVTErZWdjCnU4Y3NURjBSdFdoTzMwYTk0RnVq
23 + Z3l4ZGxxcTFVOWdYK3NhekJ4VHlDaEEKLS0tIHI1RWJYbnhHNkFBSUhDS0M4RUZR
24 + OWordG56clBFWEQ4Y0ZKbEd0N0RHdW8KJLjKAyOIuK7eyBzjo1SaFxC9gN7fdRUy
25 + u0PxzZL7+FjWCecMB3zcFabWbuPyZPTFTrbM2diiqaM7BuCPm9Fhxw==
26 + -----END AGE ENCRYPTED FILE-----
27 + - recipient: age17ez23w2kpxl0gcdx4ehcglkcfcfnv4qz0gq2n8ylxwx4yrtjpvjqxfasua
28 + enc: |
29 + -----BEGIN AGE ENCRYPTED FILE-----
30 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRZDFGOUNyZmpvOXVYU2ti
31 + S1YvOStxbFZRTjBIVzBwdUlkL2xVTWoyazJNCm5FTGE0N2J6VVdGbldqc2t3WHV6
32 + L251TmYxczRCcjhIcGhEQ3NCdUJnOTgKLS0tIG1HN1gybUNXUHMybEdic3lzMFRH
33 + WmtzSmdZelE4S1pIVFZJeWJNUmdnVzQKGvbLhDiGOoAc7jMX7snlIrfNOU9VbN4D
34 + Tn9x350Urx3P2wklqz7xIGEoEriTUScQ7+qb/9XSpORNle0w8wamzA==
35 + -----END AGE ENCRYPTED FILE-----
36 + - recipient: age1lz3mvem0rgfxj7uavth8du4xsw23wp5ts77m5vvclxyj5mjxfujs0jgtcz
37 + enc: |
38 + -----BEGIN AGE ENCRYPTED FILE-----
39 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrTEtqa1JPM1ErT0owLzND
40 + T1hGRDV6ZFBFTHQyaXVKY2FqcGRXWnpjRFVjCi9HcElDTWk1R2FZMy9UUGl3L0FV
41 + aFhUVkEyTDFWQzQwNDBhNTBBdTdrZDgKLS0tIFRJNTQyM3ZUZmNRM05CZ29aR3Ja
42 + dE5nRTJ4TzNzaFI4NEtscmZUTnRmaGcKCyDbriCAE4Lk9t/gnYCmM810hWkkb1VB
43 + XXURC9kDBRksFIfx6kYtzx7o5EarGl5egSoCAHa49xqU5nL7+N7NQA==
44 + -----END AGE ENCRYPTED FILE-----
45 + - recipient: age1m68dw9dltvtsg8e9lf5ts2vwnn4ykraguhjr8v65s0xessk3xqeqyz5jwt
46 + enc: |
47 + -----BEGIN AGE ENCRYPTED FILE-----
48 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPbDV4Z1NNWHhrUE02QkQ3
49 + RFBMT1lRWWpkb05OdjZRNkEvV1EybGhOT2hNCnlZNWtYajJlOWhJZDdERlArdzNh
50 + U2d0UXoxWWt4bW9FRFhXNVBiK3ZmMEkKLS0tIG9iTWs0WFNpd1VjOE03NEdZR1Yy
51 + MWpteUkveTFKbVJoVUVaRStQc0RuK0UKkMxjbNrsq2ccVBqv8lr/yJJ75/CuEso4
52 + V3241AS1shx31IaPh17F11mulDkUCTUpU1jnQLn+IdLqKnQMHD6aXA==
53 + -----END AGE ENCRYPTED FILE-----
54 + - recipient: age1nc9sh92wf62nt89k4vgyvqws2pt49cq6xqxx46jqpz4vqxsh5a4q8ltzp8
55 + enc: |
56 + -----BEGIN AGE ENCRYPTED FILE-----
57 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMVGVQYklyQUdsVXVCR2Nw
58 + Wnprc1Y2VTJSL3VWUURtOGY1RDRFNG1KY0ZrClpxRnl4K2w2YTl1Z3BSRnFDME1L
59 + WWlBMG1LSGpXVXhjMlhGczdRSGpDTkkKLS0tIDgrRGJraU9lT1JwSjBMaWZKRU45
60 + SmhwL09qSUVlbzd0d2ZNQjNhV1p3am8KaX4iGe6V4URDTfe96HjwovLh1I10J3yZ
61 + Mb8Ht1xnGCtJc+MV61P8D20/4qRQQmXupuJ+Zkq+BicLVr+u+H3x+w==
62 + -----END AGE ENCRYPTED FILE-----
63 + lastmodified: "2025-07-31T12:40:44Z"
64 + mac: ENC[AES256_GCM,data:BPfQYeQSi3xp3SnGa3KAcPKrXQ9kDWS2KTc/3w1/rw3Qj9xAl7xPhEhj/I61zugObbVLtuFjilD+V/NzOq9gVg9b1ERq7bYhSAl1nJLQIjhT4IbPKKfkfh8XMRRhz7AxQReOsHS4SIxwf71JM84pwxOaL3KItTTHswxLXpqX0s0=,iv:GgeXMCtY6UzDArHUEwy/9hTo+C9Q6F9+Ib2aWo5MCcs=,tag:XbxBQAl19inpN80GKkGt1g==,type:str]
65 + unencrypted_suffix: _unencrypted
66 + version: 3.10.2