umbriel: migrate mjolnir from eris
This migrates Mjölnir and its E2EE proxy pantalaimon to infrastructure maintained by the non-critical-infra team, to unblock maintenance on it.
Martin Weinelt committed
Nov 14, 2023 at 21:35 UTC
905b18db0820248cade6d6707a90ac436655933b
6 files changed
+56
-13
delft/eris.nix
-1
@@ -10,7 +10,6 @@ in
10
./eris/github-project-monitor.nix
11
./eris/alertmanager-matrix-forwarder.nix
12
./eris/channel-monitor.nix
13
- ./eris/mjolnir.nix
13
];
14
deployment.targetEnv = "hetzner";
15
deployment.hetzner.mainIPv4 = "138.201.32.77";
non-critical-infra/.sops.yaml
+11
-2
@@ -2,13 +2,22 @@ keys:
2
- &hexa age1j3mkgedmeru63vwww6m44zfw09tg8yw6xdzstaq7ejfkvgcau40qwakm8x
3
- &julienmalka age1qlwzeg37fwwn2l6fm3quvkn787nn0m89xrjtrhgf9uedtfv2kqlqnec976
4
- &zimbatm age1jrh8yyq3swjru09s75s4mspu0mphh7h6z54z946raa9wx3pcdegq0x8t4h
5
- - &hetzner01 age1sv307kkrxwgjah8pjpap5kzl4j2r6fqr3vg234n7m32chlchs9lsey7nlq
5
+ - &caliban age1sv307kkrxwgjah8pjpap5kzl4j2r6fqr3vg234n7m32chlchs9lsey7nlq
6
+ - &umbriel age15vcp7875xwtf64j4yshyld0a3hpgzv6n2kxky493s3q0swr9hdaqxugpv6
7
+
8
creation_rules:
9
- path_regex: secrets/[^/]+.caliban
10
key_groups:
11
- age:
12
+ - *caliban
13
- *hexa
14
- *julienmalka
15
- *zimbatm
13
- - *hetzner01
16
17
+ - path_regex: secrets/[^/]+.umbriel
18
+ key_groups:
19
+ - age:
20
+ - *umbriel
21
+ - *hexa
22
+ - *julienmalka
23
+ - *zimbatm
non-critical-infra/flake.nix
+1
@@ -63,6 +63,7 @@
63
buildInputs = with pkgs; [
64
colmena.packages.${system}.colmena
65
sops
66
+ ssh-to-age
67
];
68
};
69
});
non-critical-infra/hosts/umbriel.nixos.org/default.nix
+1
@@ -6,6 +6,7 @@
6
./hardware.nix
7
inputs.srvos.nixosModules.server
8
inputs.srvos.nixosModules.hardware-hetzner-cloud-arm
9
+ ../../modules/mjolnir.nix
10
];
11
12
# Bootloader.
non-critical-infra/modules/mjolnir.nix
renamed
+11
-10
@@ -1,15 +1,16 @@
1
-{ config, lib, ... }:
1
+{ lib
2
+, ...
3
+}:
4
{
3
- deployment.keys = {
4
- "mjolnir.password" = {
5
- keyFile = /home/deploy/src/nixos-org-configurations/keys/mjolnir-password;
6
- user = config.systemd.services.mjolnir.serviceConfig.User;
7
- group = "keys";
8
- permissions = "0600";
9
- };
5
+ sops.secrets.first-time-contribution-tagger-env = {
6
+ sopsFile = ../secrets/mjolnir-password.umbriel;
7
+ format = "binary";
8
+ path = "/var/keys/mjolnir.password";
9
+ mode = "0640";
10
+ owner = "root";
11
+ group = "mjolnir";
12
};
13
12
- systemd.services.mjolnir.serviceConfig.SupplementaryGroups = [ "keys" ];
14
# pantalaimon takes ages to start up, so mjolnir could hit the systemd burst
15
# limit and then just be down forever. We don't want mjolnir to ever go down,
16
# so disable rate-limiting and allow it to flap until pantalaimon is alive.
@@ -26,7 +27,7 @@
27
pantalaimon = {
28
enable = true;
29
username = "mjolnir";
29
- passwordFile = "/run/keys/mjolnir.password";
30
+ passwordFile = "/var/keys/mjolnir.password";
31
options = {
32
listenAddress = "[::1]";
33
};
non-critical-infra/secrets/mjolnir-password.umbriel
new
+32
@@ -0,0 +1,32 @@
1
+{
2
+ "data": "ENC[AES256_GCM,data:GMHlNuJT6oR0jCWyVaYdFxhMw6XGlMaxV7ysobHz6Io=,iv:X81JEKLt0Xg4+rGAp8nPcyq5fYQY7CQzYAG4FfKVZX8=,tag:husw5zwOuMsEREGK19qUWQ==,type:str]",
3
+ "sops": {
4
+ "kms": null,
5
+ "gcp_kms": null,
6
+ "azure_kv": null,
7
+ "hc_vault": null,
8
+ "age": [
9
+ {
10
+ "recipient": "age15vcp7875xwtf64j4yshyld0a3hpgzv6n2kxky493s3q0swr9hdaqxugpv6",
11
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsOUlLYnBzcVgzY2o2YXdV\nUzdBdUIvUUptclFxWGF1S0lwUm1iVUNHeDBNCkVBeXFoaEcvbjJRRmNzbUZaWi93\nNlQxQk9nRGhMd0FnMWRadmRZaHZwMjAKLS0tIHU5S01QNExEdHdja0VnRUJxdjEz\nc1FwWDV6MC9BWXlucmdmSFdTV3JVSGsKuUL+N48N/aD7nKsm77gM33crAuGBTK3c\nV9H4vEYOvbpn49Y6ayVM2ct6uyFARwy7aO20YamtdD0DQ8hxJxnVFw==\n-----END AGE ENCRYPTED FILE-----\n"
12
+ },
13
+ {
14
+ "recipient": "age1j3mkgedmeru63vwww6m44zfw09tg8yw6xdzstaq7ejfkvgcau40qwakm8x",
15
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFTXlrYS9OeGgyZGtqWUVl\nWjQvdkJocVdveVJGd0Z2Qm55Qml0d2dDSXpjCkovVHFQUko2UkZSRURzbTY5UEh2\nZ2dPVDJZbi9JNXM1bnREMk1Td0QvZXcKLS0tIFNqWXo2ejFoZ0FOQVAzNFdudnEw\nb2pNMFBEUXhFbUVkTHdxRGMzMXZQVmsKl/Zcaio6CqCTGs4rKM6gKFQainEDzvE7\n82ynmkxeI16lvOa+xj5v323I13tQTMyakL9J/mWYDnKPXjuQQa4yPQ==\n-----END AGE ENCRYPTED FILE-----\n"
16
+ },
17
+ {
18
+ "recipient": "age1qlwzeg37fwwn2l6fm3quvkn787nn0m89xrjtrhgf9uedtfv2kqlqnec976",
19
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2OHJEOSt0bTlIcld0Y3dJ\nOW9xRHh3bzBiV2NtOXQ1TjVKTmJMYXduMDBnCjJkbDlPY3o0NWNBQkNVRnI3eERU\na0tnYXBEa1NUSWt3ak1IaDdDQllPM2MKLS0tIGNZVlY3eXFvcUFBaHlkK1F1dzVa\ndjMwbE9DV3BVWWZjQVMycFRweFJ2a3cK5yqRTOjj/0Xb9CEEHwltQZKihp8c9Hl2\nv03vd88w9tZ3sTbOcyHcqqNWmxinYjeKEhve6ktfn4R1eMBTnX8CVg==\n-----END AGE ENCRYPTED FILE-----\n"
20
+ },
21
+ {
22
+ "recipient": "age1jrh8yyq3swjru09s75s4mspu0mphh7h6z54z946raa9wx3pcdegq0x8t4h",
23
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWUzNoUEFyb1lPZkw5TDBv\nQnY5Y2JUUUlEZVB2YWdIelNhVjcweUNraXdFClJmekdOMjloNFNqQWlzT1RyVll4\nWkZUUVRzNWcwM2VBNkV5eEhha1h6aXMKLS0tIGxpU3JTaTlkM1pJNHppZmZ3dk9n\nZ0ZrQk1hcmpZN2hhUUI3N29RTjRDQTAKzKzakgdLduTXXXIFZPy+5mNPHnwDYmib\noekwJI6fVZcxCXdVR5VmHQH4w70joCFTK9HNlZTdyspHUfBbBEqXsw==\n-----END AGE ENCRYPTED FILE-----\n"
24
+ }
25
+ ],
26
+ "lastmodified": "2023-11-14T18:58:37Z",
27
+ "mac": "ENC[AES256_GCM,data:zk3/qHNxqpctBJrrXjUaOunPHH02jiCeIuNIAhI5R3s7fhakrIJtLFP/KSH836wis+3+MnCMiqda9FHMd750uC2nH52jNW9Ywc1VJkWaygUZLhXZfObGND4u7e58VYQgPRPiuP8V6Q6Xcqm1vo+4ntpU/906e5tugqE8kxFH4CI=,iv:wC1bgksS1k2LXhIk0VTQ6oee8vY4AiW1Do1u2snL0iQ=,tag:6cuuqRFTUNXNpWD3dh/D2A==,type:str]",
28
+ "pgp": null,
29
+ "unencrypted_suffix": "_unencrypted",
30
+ "version": "3.7.3"
31
+ }
32
+}
\ No newline at end of file