update secrets
Michael Schneider committed
Feb 12, 2025 at 12:53 UTC
9d51ddc30563092e51a3f12e92142cdaa4b5ddfb
4 files changed
+23
-24
non-critical-infra/hosts/staging-hydra/bootstrap-staging-hydra.sh
+1
-1
@@ -1,6 +1,6 @@
1
#!/usr/bin/env bash
2
3
-# Use this script to deploy the initial keys when bootstrapping a new machines.
3
+# Use this script to deploy the initial keys when bootstrapping a new machine.
4
5
set -euo pipefail
6
tmpDir=$(mktemp -d)
non-critical-infra/hosts/staging-hydra/hydra.nix
+9
-10
@@ -30,16 +30,15 @@ in
30
# Don't rate-limit the journal.
31
services.journald.rateLimitBurst = 0;
32
33
- # age.secrets.hydra-aws-credentials = {
34
- # file = ./secrets/hydra-aws-credentials.age;
35
- # path = "/var/lib/hydra/queue-runner/.aws/credentials";
36
- # owner = "hydra-queue-runner";
37
- # group = "hydra";
38
- # };
39
-
40
- sops.secrets.signing-key = {
41
- sopsFile = ../../secrets/signing-key.staging-hydra;
42
- format = "binary";
33
+ sops.secrets = {
34
+ signing-key = {
35
+ sopsFile = ../../secrets/signing-key.staging-hydra;
36
+ format = "binary";
37
+ };
38
+ hydra-aws-credentials = {
39
+ sopsFile = ../../secrets/hydra-aws-credentials.staging-hydra;
40
+ format = "binary";
41
+ };
42
};
43
44
services.hydra-dev = {
non-critical-infra/secrets/hydra-aws-credentials.staging-hydra
+8
-8
@@ -1,5 +1,5 @@
1
{
2
- "data": "ENC[AES256_GCM,data:CWXoy4wCzx4N7SrcnfMwT0ctrJqTeVgSRlMjHfBrLVFXG+4bKw4jb0KINsarB75VJjE9xVb6Ccrs4iZ1eeTwGQ6xK6cDQpFOfqzxOOJYd4fqgRkVHtUi7m6lv0STrsXyuY/6A5jZg46908gEnsoRikdicn0=,iv:llZCq43c83EPrMMaDH7effRFUWl6BA3QJI9pgnN47zM=,tag:RYFxkPl5x6eL5Gx+tQH34g==,type:str]",
2
+ "data": "ENC[AES256_GCM,data:d/rjsri6EXmB4IXu8atZRKjk9pAn9GLTDybq89RnvRDy8olxc7S0z8CABqZXcCYwlyzlbBXYLTm75EwhfDq/GYstD9Bxh7j/iRctnNmBxRkzk5fiIMYCTXOyOCbPyeNkZ0+AkrmVs+11usH25DU2C/1g16o=,iv:0bTqh+lVMIT4gIYJ20LbX6KOJnhq6cEbWLSJEBtW4ko=,tag:uxgfFVbPozT3QetMg4AAeQ==,type:str]",
3
"sops": {
4
"kms": null,
5
"gcp_kms": null,
@@ -7,20 +7,20 @@
7
"hc_vault": null,
8
"age": [
9
{
10
- "recipient": "age13emk4xkrde0qhgnuu24jl7vt6mdq99w56c4ngse9mxh4j0pxvuvq3zsppt",
11
- "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2b3pvazZwVnlZYXY1UjVO\nSjRsV3VRNHJjb0RPTU1lemMvUFhXYkxRQUdVCnFaaW9zd1BNT1hvMHBVeXRsRmw1\nNnovcjFMTzl4a3pKU3ZLd1BNVFBnSk0KLS0tIHZCUkE2Mmg4RTZoUW90WmhXSkhI\nMDNIenQ1UTdNK0VYRmE0UjRyQnlTak0Ki2ZT0WS0a09VldISk+RoUPOlv8RV6G4v\nolrCSX2IRAt+KZYbnXCfVgO3cOltNLD+k+sl6Pe2nKX6Jo9V+/r3Xw==\n-----END AGE ENCRYPTED FILE-----\n"
10
+ "recipient": "age1vawam63mv097z4ae94tm2xlzkc66u3s87n7neu5jzm6687482u4sx8us3v",
11
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBReHQ1WkRhbHRDOTBtQ2JL\ndFk2eVJuM2JaU2NCY0pSL0lCalc1ek1iYVE0Ckd4ajR4TGRHM1pnNEZCeUJZYjQy\ndFVpSTJ2Ynk5TDN2UlRXb09Ha09sSnMKLS0tIHFiQ1M0SmRvQVlQbDk4OThSRFBX\nTG5QbktuK2JrTDdGdHZkUURVRUhkSEEKnD+B5Bft0oW2hc7/Gmj7UnqLTXlQz18E\n+3jNAk9hPDrynzFU8SqRqK4hsawb88xYGbZPJGQE5twp6O5OzNhMrg==\n-----END AGE ENCRYPTED FILE-----\n"
12
},
13
{
14
- "recipient": "age1j3spleg4m7rtjww4zqsws6qaj69v5j0rc3asaxxlpwnu7fmx8p9qvmvjn8",
15
- "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkRG0yZ3lZUzRtS0IzUnZk\nUlpQTlhBVFZSRUtHdnV5R1VvZGhtWXFIa1VFCkV4MGQ0dlNqNXloalVFYUdYb2Vu\nWEpxMkhlcEpyUXZ4N3FxY0tzMnpFaDQKLS0tIE1McmFISEpRRlNPbG14U2QyeUYy\nV05CczN3VW1pZDFsbDVmUnltWGNobW8KtHFX2gyh5+KCamEUhiMlbqBG9R4C7884\nFfzhcIuWMJTqk72TBnRyvuPPvdX3YTQE9vce240GObX+ccKHBApH1g==\n-----END AGE ENCRYPTED FILE-----\n"
14
+ "recipient": "age1v5qpkvs3zpz65gvfr2gv3ln7x6yfexvpregdr02hyvxnunu63ujqgwevf8",
15
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtc015Q0paTmlLWWVWMTJG\nWUgvK0E2R0hLaFcvSlZoNDlIK0dsaWhXR3prClFJLzRvdGowemdRbGZ1U281ZVBt\nc2RyRFFMa3QyV09BcFBXMFI4ZXJoR0UKLS0tIGs3T1MrTGo5RDY2UjdhV1UwNDQ0\nSnN6RHFkaHBsVXdiekVZRC9UajRRaDQKCoc8Xc1R6atrbdZsroe+xJ1TyucIUlmO\ny5sCxtuG423KzYOkAEaiB4ZRgtB5pXpxuvfEBHfGiBn9xdsO8qzY+w==\n-----END AGE ENCRYPTED FILE-----\n"
16
},
17
{
18
"recipient": "age17n64ahe3wesh8l8lj0zylf4nljdmqn28hvqns2g7hgm9mdkhlsvsjuvkxz",
19
- "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByZkdET2FNQmRtSlFnSjBL\nRVd1QjZoZW51NmloWDg3Zko4MjVmaldNM1dFCmR3bWJaemtpb2FsdzFUMmt0aHJI\na0d3SlhWcnVJNy9EeWVXU1F3ZU5kVzQKLS0tIG5mUGpXSk1PRXlKUzRBSjFLUGJy\nTTNiZkkwZTdsazloSFQwdk1WVnllSk0K06IY5kC5KGdKX3QvVA37RMZV4A9s5EDr\nxCgiAUii6d7xtUNYTBhgMj9tNGcs1Rs1yRurfM86IBLRsohXkSN1oQ==\n-----END AGE ENCRYPTED FILE-----\n"
19
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiSlVJOVJQL1B1NFhnRFpC\nSlczMVlCRllQVE83clJSd0JmMEJwTlpybmtrCk8xaisvV0t4Y29ZQ0VUZVo3OXcw\nYmFPZXJrWnBuL0tzK2x6M3pnSmltQkUKLS0tIFNQUmVTNU9mYVB0Q0tvL0RXNlFV\nVVMwa0lGN2krODYrN0ZXWk1XZFgzakkKsU/gYH12e0EqAKlh0e36JQTqa0FG1LCv\n+D1F/8cM+FnWdIp9m2rRn4Y17F4TlQ4G+z1s/1qFPNrX3xyQ1VpKEw==\n-----END AGE ENCRYPTED FILE-----\n"
20
}
21
],
22
- "lastmodified": "2025-02-12T09:37:26Z",
23
- "mac": "ENC[AES256_GCM,data:a4uXcqFoAKCqBeYH8Dw3qG9LQ0OaKhPWmKtXPBdyV1mR42LjvYaQkw+vFjSLwzzdYgRhC0B3F9C1Sdt17enFI+HL37XlxNRYn/28rm48BqWf1V5/HPijEusvefFpWlHYO/8qbslciH0YjV32SPfgGB79USzCen6EXK78FAeqngo=,iv:plk7T/a8/LyPCwpwvtQN1oJsbErNIFxuUbYgUmdhx9Q=,tag:sYIaorwrqsbC+Co7fJ0u4Q==,type:str]",
22
+ "lastmodified": "2025-02-12T09:43:35Z",
23
+ "mac": "ENC[AES256_GCM,data:NFlmL4am9aN+K8xQeR7qBYyQMJNl5exAlOo6IvmVd0tQ51n5uzyZ7rxJK5ku3amh/ZxNF4G2FJKJQFbN+7I5aq58xJWUF4ApsZfAsNBUG8e1/4/Jzdk5BSHaP3N8wkkNb3zWBFqE7aijcq+GH/P8Ra+hprbkAYLjEoTcJoMVtsE=,iv:kdqS91wd4cat1dgxbVo0AuHPxJ4BPSKFyTAOg3VP+KM=,tag:9vvYEwJWFTdXB4HJ8viy8g==,type:str]",
24
"pgp": null,
25
"unencrypted_suffix": "_unencrypted",
26
"version": "3.9.4"
non-critical-infra/secrets/signing-key.staging-hydra
+5
-5
@@ -7,16 +7,16 @@
7
"hc_vault": null,
8
"age": [
9
{
10
- "recipient": "age13emk4xkrde0qhgnuu24jl7vt6mdq99w56c4ngse9mxh4j0pxvuvq3zsppt",
11
- "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1U0xMRmlPV2ROMnFOVk9X\nZC9NWjJ5a2ZoTWlWVTNwUTVxWlFhZHN1bFd3Cnl5TmgwRE5aVkdjMVluYmI5VHJD\nMVhyQTM0eVVpejVRMjV1WWxyTGRzQkEKLS0tIG1IZnM4cmo5NW9ha3h2cFFOdWRQ\nb25yUmVOdkZ6NCt4QW9LNHpDSWNJZXcKbvtROz30bj6DYn8bRX++TpZWYTc6LPBl\nu3WgIKIq1nucagf+tAsIO5ZTdNByK3DGYKFdp9+RLFxHLu6XCTePZg==\n-----END AGE ENCRYPTED FILE-----\n"
10
+ "recipient": "age1vawam63mv097z4ae94tm2xlzkc66u3s87n7neu5jzm6687482u4sx8us3v",
11
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmcTBnUzBNU0J1MGN1MnJN\naUR5dnEwSmQwQVlHcjVFcmJ4QWZRSDlXVXlzCndyd1dSa2l3ZGtTN0l3ZEJKM1Fl\nNWNOOEFBS0M2bFVGcGczc2J6SUpjVnMKLS0tIEcvYmJjWlFkZXozOHhxcTlHemla\nOTl5dlhsRkM0MGdrR0ZtU1p4UEdOZHcKnIXOb8UaRSPFwM+yztXsu2KJr4afVwqd\nevTsIfzXH5inEvkMOW8emtkexCc9TBVSvP8+8lKE63M3ysFmaToy8w==\n-----END AGE ENCRYPTED FILE-----\n"
12
},
13
{
14
- "recipient": "age1j3spleg4m7rtjww4zqsws6qaj69v5j0rc3asaxxlpwnu7fmx8p9qvmvjn8",
15
- "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrNHJCcmUzT2pFL3ZrT2FF\nN1grblQvL3Y2eWNXb2pJS0JXeEVOMUlPVFZvCmgyMDRwamFaSFk5TzE4cFJGaHlF\ncStOaUplOUZOTVBWUCtnWVNseFpoOHcKLS0tIDRIUGtpd1dWV2pqQnliK3NBcHVQ\nQnU2MTJNeUtHMEpmcmI0K0lzMjhZaHMKgGzuhwZqGLzufcGAYD/Io7rRO7EMmegq\ntKik/ZPqCRSw8XIX+Iiqp1miDV2MzgmLwQXm8IAT/9kWJmVK4j8ILg==\n-----END AGE ENCRYPTED FILE-----\n"
14
+ "recipient": "age1v5qpkvs3zpz65gvfr2gv3ln7x6yfexvpregdr02hyvxnunu63ujqgwevf8",
15
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCTjNkdTJRQ3MrKytVYkV2\nK3hVR25DWVpNUUpWOG1xS25FYk45WDI5bmcwCmpWZTRzbFZTbmxqaU5IcmViK0dY\nVW5VVzNxaGRKaVpDSFhseVBEL084T2cKLS0tIFRoRDNCSXQ1eDFZYWtnY2t6SEhk\nd2FRTFE3dG1sR2VvLzhwWms4cHUxSDgKPT3VyycykmGXTeKZXD9SfeUhZcN7NIr5\nYOFO9J/pdqJ90G4m8WSaBG82w1ktJblrcy8sEzD2V37Nfl4UiB/QwA==\n-----END AGE ENCRYPTED FILE-----\n"
16
},
17
{
18
"recipient": "age17n64ahe3wesh8l8lj0zylf4nljdmqn28hvqns2g7hgm9mdkhlsvsjuvkxz",
19
- "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWb2ljNWl5SUhGUXZmQXhP\nTDF4bzhVYnpSdUFFVWVzeURnS1gxSVUrNWtVClR0S05HWUtpSU5ETWh0YVhJcS9C\nMmtwS1ZZSnRSMlVYQWtMMk5GVGhWVjAKLS0tIGdnYmEyaDBMbDhaUVpOUzN5OWk3\nKzkvSU1wQWxETDJiMWxVYUhuV1V4aEkKwjiLNhN2WvjV1WC648tl2bUIgcthFo/r\nwGF2G+J7ueAp3WGWRtd1a2kQNn8MLqCZksUMeksy4+3570kKmdCOrg==\n-----END AGE ENCRYPTED FILE-----\n"
19
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDd2taT3JJcjhwVGZORGp5\nTFd1Ym85VnBiU2psektnT3grcGx6UlhYbkVNCnUwQUQzc2JZV0JMWXkwSjNXZGdq\nL3ZSOHpNQ3hwV1VuSXc4eVNOZklNNjQKLS0tIHlvZGYzQnliak5VKzdxeUFQakJn\nQ1A4RWk3ZjF2bEtpNktXMklScVBUUXMKrOW8MDPUjtsjOBcHx7BxOK4Kt2BYl318\nA1ytiiSi8kan3ta1QSZJOuQLYmSmlI/TGuFjY17wQJsrx0a2OAYFng==\n-----END AGE ENCRYPTED FILE-----\n"
20
}
21
],
22
"lastmodified": "2025-02-12T09:27:43Z",