add hydra user init
Michael Schneider committed
Feb 15, 2025 at 18:31 UTC
95e77d0d7418e13cc787444f2187bce3f8765de4
2 files changed
+57
non-critical-infra/hosts/staging-hydra/hydra.nix
+29
@@ -135,6 +135,35 @@ in
135
];
136
};
137
};
138
+ hydra-post-init = {
139
+ serviceConfig = {
140
+ Type = "oneshot";
141
+ TimeoutStartSec = "60";
142
+ };
143
+ wantedBy = [ config.systemd.targets.multi-user.name ];
144
+ after = [ config.systemd.services.hydra-server.name ];
145
+ requires = [ config.systemd.services.hydra-server.name ];
146
+ environment = {
147
+ inherit (config.systemd.services.hydra-init.environment) HYDRA_DBI;
148
+ };
149
+ path = [
150
+ config.services.hydra.package
151
+ pkgs.netcat
152
+ ];
153
+ script = ''
154
+ set -e
155
+ while IFS=';' read -r user role passwordhash email fullname; do
156
+ opts=("$user" "--role" "$role" "--password-hash" "$passwordhash")
157
+ if [[ -n "$email" ]]; then
158
+ opts+=("--email-address" "$email")
159
+ fi
160
+ if [[ -n "$fullname" ]]; then
161
+ opts+=("--full-name" "$fullname")
162
+ fi
163
+ hydra-create-user "''${opts[@]}"
164
+ done < ${config.sops.secrets.hydra-users.path}
165
+ '';
166
+ };
167
};
168
};
169
non-critical-infra/secrets/hydra-user.staging-hydra
new
+28
@@ -0,0 +1,28 @@
1
+{
2
+ "data": "ENC[AES256_GCM,data:WvJf4tSJeVjYzXZv50LAz6xfc3GZjYXhRja3W/UAbTYtPzL1yPdMO4p3fkN6x5LUw99yW+c7BQ60NKFpj8XMa8WacVIgzX9KqQO7Kq8+LY/II2sBnhXNUpMbkIsaXRBeX7sDYEd9KNC9yUVAILzaOwIONqjTXzzoMQt5PxixtHbH,iv:C9HYmVDqZ++smz3RKv496jE8ymEk/xa74vL9dH9t3VQ=,tag:lXI4NpoHfYpHLE3d5T1D7w==,type:str]",
3
+ "sops": {
4
+ "kms": null,
5
+ "gcp_kms": null,
6
+ "azure_kv": null,
7
+ "hc_vault": null,
8
+ "age": [
9
+ {
10
+ "recipient": "age1vawam63mv097z4ae94tm2xlzkc66u3s87n7neu5jzm6687482u4sx8us3v",
11
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMYVJQaTNxZUZ5SWwyUTBq\nU2kveW5wMzBVSWd3Qi9jZHd2djJwVXFCZ3pjCmhSMXF1YVJMS3FVNVRndGgvbWNC\nR3VpS3dVdDNZQzc4V0haQ3J2Vkt4NDAKLS0tIHl3N2dscC9oMHNJZnBpYzVjNlc0\nTnIrWFA3YjZ2aHAwMGR5UStDL2UyKzgKSTdcEY1oVC6RnJmigj/EGz5/LhpLmhcj\nBUlah8cxgStQDpF9N3mmc90FQRpQUHBRnE9kbE7rpHILhbl3NqYnfg==\n-----END AGE ENCRYPTED FILE-----\n"
12
+ },
13
+ {
14
+ "recipient": "age1v5qpkvs3zpz65gvfr2gv3ln7x6yfexvpregdr02hyvxnunu63ujqgwevf8",
15
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBK3FLOXBkM2IzdnRrd21K\nNTZtbUdycHNXSG9iOUhyNTFuWFlLR2U0NHhZCnVWR0RwSmw0NGJWVEFGdDhtbE5I\nOU5JZm53SjIwRDZnazlaaU90MUhPVnMKLS0tIG9JazZnY2RGYmxLdGN6c3hiRFgy\nVVk4cnJGcFFjdkFyT1JXRFlLNjI5eEkKTjEd5RIMv8TLPipT/BwpdEAcr4MmUw9i\nNkolj6duCw0m8PgRjHBMcN3vKbCPJC7vxqPqBtndy0rwr7pbJ7WHbg==\n-----END AGE ENCRYPTED FILE-----\n"
16
+ },
17
+ {
18
+ "recipient": "age17n64ahe3wesh8l8lj0zylf4nljdmqn28hvqns2g7hgm9mdkhlsvsjuvkxz",
19
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwNFB0bXNFKzk3dnBJTkNw\nQytpNFJBWWtINFpqUVFod0piekgwUVlpN0hFClpzY1FWUmJZNFJtQ09IVVRhVnN3\nSGtFNExrakFySjhGS3Y4ZTR1UjlPeHMKLS0tICtMNExQb3orZzJJaUJ5UUVmWGpQ\nS2RFcXVFN0ltL2pYNlNYc2JqaFZtZlEKOsfFinN/zbsYIB4PLSaHgN7f8QRgK8wt\nzqzk7uk00jSEni/uLj2b74QlLbxEEVnNXWb1+ZWGXSU0XNahGYreOQ==\n-----END AGE ENCRYPTED FILE-----\n"
20
+ }
21
+ ],
22
+ "lastmodified": "2025-02-15T15:31:35Z",
23
+ "mac": "ENC[AES256_GCM,data:sVE0BSe/R5qyQkBqGFrUPLoARkhWckUlkF8cKWVVx0mo7HXxt3mahyPbo5Qk2pzxM7GZt+jOBBDOTuCUT6SlX5ENoSGQ6Bnf1a33g7k4aBGNyvekXlXC2GBH5w65yoEm5qax+6SsNhqp/EnDnIoIKwXqx8ipOOhYCoWw9gxCdnk=,iv:3zMqazSGVqsewj+zwTc0B5dJ3mNEf2I81GMXDMf66Hw=,tag:mB5MsGb9a7Ed8wc0+WCc8w==,type:str]",
24
+ "pgp": null,
25
+ "unencrypted_suffix": "_unencrypted",
26
+ "version": "3.9.4"
27
+ }
28
+}
\ No newline at end of file