@cryptotaxi247 / infra-1 / commits / eeb802d2

non-critical-infra: added secret management with sops-nix

Julien Malka committed Aug 23, 2023 at 16:56 UTC eeb802d24000e98f67be5397527c3444a46dcab0
5 files changed +102 -7
non-critical-infra/.sops.yaml new
+14
@@ -0,0 +1,14 @@
1 +keys:
2 + - &hexa age1j3mkgedmeru63vwww6m44zfw09tg8yw6xdzstaq7ejfkvgcau40qwakm8x
3 + - &julienmalka age1qlwzeg37fwwn2l6fm3quvkn787nn0m89xrjtrhgf9uedtfv2kqlqnec976
4 + - &zimbatm age1jrh8yyq3swjru09s75s4mspu0mphh7h6z54z946raa9wx3pcdegq0x8t4h
5 + - &hetzner01 age1sv307kkrxwgjah8pjpap5kzl4j2r6fqr3vg234n7m32chlchs9lsey7nlq
6 +creation_rules:
7 + - path_regex: secrets/[^/]+.hetzner01
8 + key_groups:
9 + - age:
10 + - *hexa
11 + - *julienmalka
12 + - *zimbatm
13 + - *hetzner01
14 +
non-critical-infra/flake.lock
+38
@@ -219,6 +219,22 @@
219 "type": "github"
220 }
221 },
222 + "nixpkgs-stable_2": {
223 + "locked": {
224 + "lastModified": 1692492726,
225 + "narHash": "sha256-rld5qm2B4oRkDwcPD+yOSyTrZQdfCR6mzJGGkecjvTs=",
226 + "owner": "NixOS",
227 + "repo": "nixpkgs",
228 + "rev": "5e63e8bbc46bc4fc22254da1edaf42fc7549c18a",
229 + "type": "github"
230 + },
231 + "original": {
232 + "owner": "NixOS",
233 + "ref": "release-23.05",
234 + "repo": "nixpkgs",
235 + "type": "github"
236 + }
237 + },
238 "nixpkgs_2": {
239 "locked": {
240 "lastModified": 1689168768,
@@ -346,9 +362,31 @@
362 "first-time-contribution-tagger": "first-time-contribution-tagger",
363 "flake-utils": "flake-utils_4",
364 "nixpkgs": "nixpkgs_5",
365 + "sops-nix": "sops-nix",
366 "srvos": "srvos"
367 }
368 },
369 + "sops-nix": {
370 + "inputs": {
371 + "nixpkgs": [
372 + "nixpkgs"
373 + ],
374 + "nixpkgs-stable": "nixpkgs-stable_2"
375 + },
376 + "locked": {
377 + "lastModified": 1692728678,
378 + "narHash": "sha256-02MjG7Sb9k7eOi86CcC4GNWVOjT6gjmXFSqkRjZ8Xyk=",
379 + "owner": "Mic92",
380 + "repo": "sops-nix",
381 + "rev": "1b7b3a32d65dbcd69c217d7735fdf0a6b2184f45",
382 + "type": "github"
383 + },
384 + "original": {
385 + "owner": "Mic92",
386 + "repo": "sops-nix",
387 + "type": "github"
388 + }
389 + },
390 "srvos": {
391 "inputs": {
392 "nixpkgs": "nixpkgs_6"
non-critical-infra/flake.nix
+8 -3
@@ -7,6 +7,10 @@
7 flake-utils.url = "github:numtide/flake-utils";
8 disko.url = "github:nix-community/disko";
9 srvos.url = "github:numtide/srvos";
10 + sops-nix = {
11 + url = "github:Mic92/sops-nix";
12 + inputs.nixpkgs.follows = "nixpkgs";
13 + };
14
15 first-time-contribution-tagger = {
16 url = "github:Janik-Haag/first-time-contribution-tagger";
@@ -17,7 +21,7 @@
21 };
22 };
23
20 - outputs = { self, nixpkgs, flake-utils, colmena, disko, srvos, first-time-contribution-tagger, ... }@inputs:
24 + outputs = { self, nixpkgs, flake-utils, colmena, disko, srvos, first-time-contribution-tagger, sops-nix, ... }@inputs:
25 let
26 importConfig = path: (lib.mapAttrs (name: value: import (path + "/${name}/default.nix")) (lib.filterAttrs (_: v: v == "directory") (builtins.readDir path)));
27 lib = nixpkgs.lib;
@@ -31,7 +35,7 @@
35 specialArgs = {
36 inherit inputs;
37 };
34 - modules = [ value disko.nixosModules.disko first-time-contribution-tagger.nixosModule ];
38 + modules = [ value disko.nixosModules.disko first-time-contribution-tagger.nixosModule sops-nix.nixosModules.sops ];
39 extraModules = [ inputs.colmena.nixosModules.deploymentOptions ];
40
41 })
@@ -56,8 +60,9 @@
60 in {
61 devShell =
62 pkgs.mkShell {
59 - buildInputs = [
63 + buildInputs = with pkgs; [
64 colmena.packages.${system}.colmena
65 + sops
66 ];
67 };
68 });
non-critical-infra/modules/first-time-contribution-tagger.nix
+10 -4
@@ -3,11 +3,17 @@
3 enable = true;
4 interval = "*:0/10";
5 environment = {
6 - FIRST_TIME_CONTRIBUTION_LABEL="12. first-time contribution";
7 - FIRST_TIME_CONTRIBUTION_CACHE="/var/lib/first-time-contribution-tagger/cache";
8 - FIRST_TIME_CONTRIBUTION_REPO="nixpkgs";
9 - FIRST_TIME_CONTRIBUTION_ORG="NixOS";
6 + FIRST_TIME_CONTRIBUTION_LABEL = "12. first-time contribution";
7 + FIRST_TIME_CONTRIBUTION_CACHE = "/var/lib/first-time-contribution-tagger/cache";
8 + FIRST_TIME_CONTRIBUTION_REPO = "nixpkgs";
9 + FIRST_TIME_CONTRIBUTION_ORG = "NixOS";
10 };
11 environmentFile = "/root/first-time-contribution-tagger.env";
12 };
13 +
14 + sops.secrets.first-time-contribution-tagger-env = {
15 + sopsFile = ../secrets/first-time-contribution-tagger-env.hetzner01;
16 + format = "binary";
17 + path = "/root/first-time-contribution-tagger.env";
18 + };
19 }
non-critical-infra/secrets/first-time-contribution-tagger-env.hetzner01 new
+32
@@ -0,0 +1,32 @@
1 +{
2 + "data": "ENC[AES256_GCM,data:QfZKMt/EfEx/EYUbizZCkNyPWyyBzx3tBfG/BdQdUSoIUgjBGJSXRZQrXIaiczaPTRK4BoHjLGBo+5gY3jTffmoyrZ1JMYLe4ZHVTnpLXyk=,iv:varEp8M6uS8Kw8P8Ou9M7TDS+ycMjMqCOUFQ1XWnqKM=,tag:q8NH8BKm2ZpxciBJ+sFzfQ==,type:str]",
3 + "sops": {
4 + "kms": null,
5 + "gcp_kms": null,
6 + "azure_kv": null,
7 + "hc_vault": null,
8 + "age": [
9 + {
10 + "recipient": "age1j3mkgedmeru63vwww6m44zfw09tg8yw6xdzstaq7ejfkvgcau40qwakm8x",
11 + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDY1lGRzVmajJuMFZPdGM2\nYnljMkwvNTZ4cTlvTzBZK3h5QUVqVHFwOEFVCjR5U003ZVZ3Rld2Y1VvWVJYOXNS\nTTZ6N2hkRGlNYTdYa0hQYU85dnVidU0KLS0tIGtaZ2RhNmVGV1VxZ0Zobkw2QjFY\nMXRteWE2cWw5anZWeGtqZEYyeTZHTDAKX5ybCiVckAldRZ4lZrYcU2c3Gt1/UUOp\np4VgzQyNbuFkyQSpWkl4jEpOO590PvYE1D50EQ69pouVj1y/UBlDtA==\n-----END AGE ENCRYPTED FILE-----\n"
12 + },
13 + {
14 + "recipient": "age1qlwzeg37fwwn2l6fm3quvkn787nn0m89xrjtrhgf9uedtfv2kqlqnec976",
15 + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3aFhlZWcxWlpQMjloT3VQ\nS09yMlhkZVR2a0xDZTBORmlxdFVTRWN2M0dRCmtBcnA1NW5CL003d0RWZWRKQ1Bp\nL2hJTmNwREtlNTBENEpmeENOYU1PS3MKLS0tIGNWUFB1WGFnZFFkNGtiei8xNFpm\neDJadEdMUGgxd21pc29xamR6TVJUVHcKNqxzHPv9C8O6T49UQg1yqXjad2wRanS6\nNlgxR/yREQYiYCJuA8juqPsQJruNHrM+SCSHRUsaYcbH2+GjVkQncw==\n-----END AGE ENCRYPTED FILE-----\n"
16 + },
17 + {
18 + "recipient": "age1jrh8yyq3swjru09s75s4mspu0mphh7h6z54z946raa9wx3pcdegq0x8t4h",
19 + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMSUt6bW81aGxwSTh6RDIv\nZHBQTURnU3BLSzltN2Y0TWdHZFcrdmF2V1U4Cm9FUzZpb25RS2QvVExwMFFqdHZL\nZStBOWN4dnAvWWN6UXMvdHduSlF5U1UKLS0tIFlKUGFQZkxpdGxOMGRXUXIvZWNq\nSWV0UEQ0QlZUWEtDaDFMZE5qVlo2WEUKid1Q5gQVrczlkinUmF2/xT4yxt1z/p6c\n4tLRxCCl1IO3bZ+ci9LWRZQung+Mwj4bQE9i5mf8yZqKGSs26z0DTw==\n-----END AGE ENCRYPTED FILE-----\n"
20 + },
21 + {
22 + "recipient": "age1sv307kkrxwgjah8pjpap5kzl4j2r6fqr3vg234n7m32chlchs9lsey7nlq",
23 + "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrRkxPcVRMUFkvclZDVEVE\nT1pJdWxROVRpTVRzOWQzZkZ1OXdiajJidWdNCm9qemJHSGlUTXA0aVo0eFM0MGJi\nTDEzek1YbThNcGFOcFpEL2l0bWpySkkKLS0tIFgvSXlicldVZTdhTTVUQU5qZ29Q\nNTY5bloweUYxUzc5NVVGWTdMdzZ6UGMKghtaC7SHai0ilVnO87OwC3vlI97U5s3t\n18gr9qHETPFDkj83X5IBpneYC84rHI5D1OVpEDNUg/sGbgXgzcjzTw==\n-----END AGE ENCRYPTED FILE-----\n"
24 + }
25 + ],
26 + "lastmodified": "2023-08-23T14:49:15Z",
27 + "mac": "ENC[AES256_GCM,data:xjbHz6Lbf0H9r8Lx3v2DNoEa44ZpEDe2gbHxQiB0iDct1EROr1dt99V7sN6oc2KyuSSHYTJCNvgTimWVRgmTKF7S+bhgrMY5I/4TLqcv5zpq0NcbWB4BePj8W73sBVQEKRKt9giHLSDyb1KJ5/ywMpF2ZF7D6wz7BB2Qiqovz08=,iv:oS3tumdSKWCmwkWunwY5HHC92LlU6Z9YkDjIqcCWCYI=,tag:chkpbOLnx4JT9PkuAYbhCA==,type:str]",
28 + "pgp": null,
29 + "unencrypted_suffix": "_unencrypted",
30 + "version": "3.7.3"
31 + }
32 +}
\ No newline at end of file