non-critical-infra: migrate mjolnir to caliban
This makes umbriel a dedicated mailserver and moves mjolnir closer to the homeserver it connects to.
Martin Weinelt committed
Mar 13, 2025 at 18:44 UTC
5eeb20e3a34afe3a1830357dc4d7b525d25f6282
5 files changed
+31
-35
non-critical-infra/hosts/caliban/default.nix
+1
@@ -11,6 +11,7 @@
11
../../modules/backup.nix
12
../../modules/element-web.nix
13
../../modules/matrix-synapse.nix
14
+ ../../modules/mjolnir.nix
15
../../modules/owncast.nix
16
../../modules/prometheus/node-exporter.nix
17
../../modules/vaultwarden.nix
non-critical-infra/hosts/umbriel/default.nix
-1
@@ -6,7 +6,6 @@
6
inputs.srvos.nixosModules.server
7
inputs.srvos.nixosModules.hardware-hetzner-cloud-arm
8
../../modules/common.nix
9
- ../../modules/mjolnir.nix
9
../../modules/prometheus/node-exporter.nix
10
../../modules/mailserver
11
];
non-critical-infra/modules/mjolnir.nix
+2
-2
@@ -1,7 +1,7 @@
1
{ lib, ... }:
2
{
3
- sops.secrets.first-time-contribution-tagger-env = {
4
- sopsFile = ../secrets/mjolnir-password.umbriel;
3
+ sops.secrets.mjolnir-password = {
4
+ sopsFile = ../secrets/mjolnir-password.caliban;
5
format = "binary";
6
path = "/var/keys/mjolnir.password";
7
mode = "0640";
non-critical-infra/secrets/mjolnir-password.caliban
new
+28
@@ -0,0 +1,28 @@
1
+{
2
+ "data": "ENC[AES256_GCM,data:grIvbuQ4QLcsMq+vJ2L3HR8wG4axM9WmEgHjbO/fvHcu,iv:Vyd1335Pg1i11fP2X2G2cyKMyM2/0uFuXO3T28Ml228=,tag:NA2nLx864A7SJAwvkVfj6w==,type:str]",
3
+ "sops": {
4
+ "kms": null,
5
+ "gcp_kms": null,
6
+ "azure_kv": null,
7
+ "hc_vault": null,
8
+ "age": [
9
+ {
10
+ "recipient": "age1sv307kkrxwgjah8pjpap5kzl4j2r6fqr3vg234n7m32chlchs9lsey7nlq",
11
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBteXZkeEt6WE1KdkZDUXhM\nOUtOVUFIMzgxUDFSWnpkTFVCM3BQZHY2aEVjCjYrRjZpaGxvZ1E5Ly9vazlINFp6\nNG4vMnlwZE04Q1JWa2pzcFZ5WXJDcjQKLS0tIElZU0JGZnlkTUs4QXU0UmpienFR\nVk1ESzROMURCalBSNWRaODYzVHN6ekUKMSc1M5L603f+Onx9japy2rgmVKgTcqzD\ni5CIX4LCCbB5YEWk6TqkXSGtEiShYwFNs7DcthmZyAFT/z+1k62TiA==\n-----END AGE ENCRYPTED FILE-----\n"
12
+ },
13
+ {
14
+ "recipient": "age1j3mkgedmeru63vwww6m44zfw09tg8yw6xdzstaq7ejfkvgcau40qwakm8x",
15
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWUVZsR1kyVEtyd2VrZG5K\nRVhnV2kvTVVrV1F0d0VUUm1FaDJvZ3B3U1dVClJLY254RFcrSUhPWkQxMHk2UUV3\nR21HMkMyQ0hzWmI1MnhLUU5KeGlZTDQKLS0tIENVRWlpcFlRaHNDNFpibldaMmFF\naXRzYmVuZXZGTisycVF2NjA5RDFuQjAKs3zhqJKX0YNaD++eWNLgNh+dGAxPc3Cp\nS1g1LkZQE46ceiQRdz7h+lSoEyPfKDbV8510glHnqWSaEKd8WYY49g==\n-----END AGE ENCRYPTED FILE-----\n"
16
+ },
17
+ {
18
+ "recipient": "age1jrh8yyq3swjru09s75s4mspu0mphh7h6z54z946raa9wx3pcdegq0x8t4h",
19
+ "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXTG9qeW56WjlCczZyUy9h\nR09kTjZNbE1TQXBtYjZSdTZlSCtkbklVT2dnCkt4cEpSQ2l6WUg1TVVpK2VvdWNa\nYjFEeFRIWDJCekRxYk4wQmlSSlNQQk0KLS0tIGUyeS9GZUhnU2cvb21qMGp4OVVa\nRHNKWEpRbUt0V0JDbTNlN0EySlZUaGMK9grWJ8pZ8IRfCBOQsfFmKeL3/++KT3D1\nBApdOOOYZLc4rHeMHWHwH2J0AP+YYyVHsxQo2yknf2CS8imNI1figg==\n-----END AGE ENCRYPTED FILE-----\n"
20
+ }
21
+ ],
22
+ "lastmodified": "2025-03-13T17:36:44Z",
23
+ "mac": "ENC[AES256_GCM,data:f63uKmOODv1uI3r9flamhtcX+mM8O0B3LAbnhOD/XECrmRo/4iQT+eFmDXuwqBo4dVf0ITgKOnCTIviA6V7nMSUK5o5irOgqm+/rHarCn46zPaLMS+D6Pb8qtnuX4jF27+f4tqEcA1ux6Pjx817XjDnyv00wEGd+7dYbq7bTgNM=,iv:XNgzYq4ALDp+cIBHAzFMgJD+X2/XI6Y7b6IYIgaAB4Y=,tag:+Y/MUccCguCzKj6kpIoU6Q==,type:str]",
24
+ "pgp": null,
25
+ "unencrypted_suffix": "_unencrypted",
26
+ "version": "3.9.4"
27
+ }
28
+}
\ No newline at end of file
non-critical-infra/secrets/mjolnir-password.umbriel
deleted
-32
@@ -1,32 +0,0 @@
1
-{
2
- "data": "ENC[AES256_GCM,data:GMHlNuJT6oR0jCWyVaYdFxhMw6XGlMaxV7ysobHz6Io=,iv:X81JEKLt0Xg4+rGAp8nPcyq5fYQY7CQzYAG4FfKVZX8=,tag:husw5zwOuMsEREGK19qUWQ==,type:str]",
3
- "sops": {
4
- "kms": null,
5
- "gcp_kms": null,
6
- "azure_kv": null,
7
- "hc_vault": null,
8
- "age": [
9
- {
10
- "recipient": "age15vcp7875xwtf64j4yshyld0a3hpgzv6n2kxky493s3q0swr9hdaqxugpv6",
11
- "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsOUlLYnBzcVgzY2o2YXdV\nUzdBdUIvUUptclFxWGF1S0lwUm1iVUNHeDBNCkVBeXFoaEcvbjJRRmNzbUZaWi93\nNlQxQk9nRGhMd0FnMWRadmRZaHZwMjAKLS0tIHU5S01QNExEdHdja0VnRUJxdjEz\nc1FwWDV6MC9BWXlucmdmSFdTV3JVSGsKuUL+N48N/aD7nKsm77gM33crAuGBTK3c\nV9H4vEYOvbpn49Y6ayVM2ct6uyFARwy7aO20YamtdD0DQ8hxJxnVFw==\n-----END AGE ENCRYPTED FILE-----\n"
12
- },
13
- {
14
- "recipient": "age1j3mkgedmeru63vwww6m44zfw09tg8yw6xdzstaq7ejfkvgcau40qwakm8x",
15
- "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFTXlrYS9OeGgyZGtqWUVl\nWjQvdkJocVdveVJGd0Z2Qm55Qml0d2dDSXpjCkovVHFQUko2UkZSRURzbTY5UEh2\nZ2dPVDJZbi9JNXM1bnREMk1Td0QvZXcKLS0tIFNqWXo2ejFoZ0FOQVAzNFdudnEw\nb2pNMFBEUXhFbUVkTHdxRGMzMXZQVmsKl/Zcaio6CqCTGs4rKM6gKFQainEDzvE7\n82ynmkxeI16lvOa+xj5v323I13tQTMyakL9J/mWYDnKPXjuQQa4yPQ==\n-----END AGE ENCRYPTED FILE-----\n"
16
- },
17
- {
18
- "recipient": "age1qlwzeg37fwwn2l6fm3quvkn787nn0m89xrjtrhgf9uedtfv2kqlqnec976",
19
- "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2OHJEOSt0bTlIcld0Y3dJ\nOW9xRHh3bzBiV2NtOXQ1TjVKTmJMYXduMDBnCjJkbDlPY3o0NWNBQkNVRnI3eERU\na0tnYXBEa1NUSWt3ak1IaDdDQllPM2MKLS0tIGNZVlY3eXFvcUFBaHlkK1F1dzVa\ndjMwbE9DV3BVWWZjQVMycFRweFJ2a3cK5yqRTOjj/0Xb9CEEHwltQZKihp8c9Hl2\nv03vd88w9tZ3sTbOcyHcqqNWmxinYjeKEhve6ktfn4R1eMBTnX8CVg==\n-----END AGE ENCRYPTED FILE-----\n"
20
- },
21
- {
22
- "recipient": "age1jrh8yyq3swjru09s75s4mspu0mphh7h6z54z946raa9wx3pcdegq0x8t4h",
23
- "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWUzNoUEFyb1lPZkw5TDBv\nQnY5Y2JUUUlEZVB2YWdIelNhVjcweUNraXdFClJmekdOMjloNFNqQWlzT1RyVll4\nWkZUUVRzNWcwM2VBNkV5eEhha1h6aXMKLS0tIGxpU3JTaTlkM1pJNHppZmZ3dk9n\nZ0ZrQk1hcmpZN2hhUUI3N29RTjRDQTAKzKzakgdLduTXXXIFZPy+5mNPHnwDYmib\noekwJI6fVZcxCXdVR5VmHQH4w70joCFTK9HNlZTdyspHUfBbBEqXsw==\n-----END AGE ENCRYPTED FILE-----\n"
24
- }
25
- ],
26
- "lastmodified": "2023-11-14T18:58:37Z",
27
- "mac": "ENC[AES256_GCM,data:zk3/qHNxqpctBJrrXjUaOunPHH02jiCeIuNIAhI5R3s7fhakrIJtLFP/KSH836wis+3+MnCMiqda9FHMd750uC2nH52jNW9Ywc1VJkWaygUZLhXZfObGND4u7e58VYQgPRPiuP8V6Q6Xcqm1vo+4ntpU/906e5tugqE8kxFH4CI=,iv:wC1bgksS1k2LXhIk0VTQ6oee8vY4AiW1Do1u2snL0iQ=,tag:6cuuqRFTUNXNpWD3dh/D2A==,type:str]",
28
- "pgp": null,
29
- "unencrypted_suffix": "_unencrypted",
30
- "version": "3.7.3"
31
- }
32
-}
\ No newline at end of file