@cryptotaxi247 / infra / commits / 5fbc76cc

staging-hydra: init

Michael Schneider committed Feb 12, 2025 at 10:54 UTC 5fbc76cc63330f401514113d18c3f0a669fcf37c
8 files changed +76 -58
non-critical-infra/.sops.yaml
+2 -2
@@ -3,7 +3,7 @@ keys:
3 - &zimbatm age1jrh8yyq3swjru09s75s4mspu0mphh7h6z54z946raa9wx3pcdegq0x8t4h
4 - &caliban age1sv307kkrxwgjah8pjpap5kzl4j2r6fqr3vg234n7m32chlchs9lsey7nlq
5 - &umbriel age15vcp7875xwtf64j4yshyld0a3hpgzv6n2kxky493s3q0swr9hdaqxugpv6
6 - - &staging-hydra age13emk4xkrde0qhgnuu24jl7vt6mdq99w56c4ngse9mxh4j0pxvuvq3zsppt
6 + - &staging-hydra age1vawam63mv097z4ae94tm2xlzkc66u3s87n7neu5jzm6687482u4sx8us3v
7 - &m1-s age1j3spleg4m7rtjww4zqsws6qaj69v5j0rc3asaxxlpwnu7fmx8p9qvmvjn8
8 - &mic92 age17n64ahe3wesh8l8lj0zylf4nljdmqn28hvqns2g7hgm9mdkhlsvsjuvkxz
9
@@ -23,7 +23,7 @@ creation_rules:
23 - *zimbatm
24
25 # ssh keys used to bootstrap new machines
26 - - path_regex: secrets/[^/]+.hostkeys
26 + - path_regex: secrets/[^/]+-hostkeys.yaml
27 key_groups:
28 - age:
29 - *m1-s
non-critical-infra/flake-module.nix
+19 -21
@@ -1,7 +1,7 @@
1 {
2 - inputs
3 -, lib
4 -, ...
2 + inputs,
3 + lib,
4 + ...
5 }:
6 {
7 colmena.hosts = {
@@ -17,25 +17,23 @@
17 ));
18 in
19 {
20 - nixosConfigurations = builtins.mapAttrs
21 - (
22 - _name: value:
23 - inputs.nixpkgs.lib.nixosSystem {
24 - inherit lib;
25 - system = "x86_64-linux";
26 - specialArgs = {
27 - inherit inputs;
28 - };
29 - modules = [
30 - value
31 - inputs.disko.nixosModules.disko
32 - inputs.sops-nix.nixosModules.sops
33 - ];
34 - extraModules = [ inputs.colmena.nixosModules.deploymentOptions ];
20 + nixosConfigurations = builtins.mapAttrs (
21 + _name: value:
22 + inputs.nixpkgs.lib.nixosSystem {
23 + inherit lib;
24 + system = "x86_64-linux";
25 + specialArgs = {
26 + inherit inputs;
27 + };
28 + modules = [
29 + value
30 + inputs.disko.nixosModules.disko
31 + inputs.sops-nix.nixosModules.sops
32 + ];
33 + extraModules = [ inputs.colmena.nixosModules.deploymentOptions ];
34
36 - }
37 - )
38 - (importConfig ./hosts);
35 + }
36 + ) (importConfig ./hosts);
37
38 };
39
non-critical-infra/hosts/staging-hydra/bootstrap-staging-hydra.sh new
+21
@@ -0,0 +1,21 @@
1 +#!/usr/bin/env bash
2 +
3 +# Use this script to deploy the initial keys when bootstrapping a new machines.
4 +
5 +set -euo pipefail
6 +tmpDir=$(mktemp -d)
7 +sshDir="$tmpDir/etc/ssh"
8 +mkdir -p "$sshDir"
9 +trap 'rm -rf "$tmpDir"' EXIT
10 +
11 +SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null 2>&1 && pwd)"
12 +
13 +for keyname in ssh_host_ed25519_key ssh_host_ed25519_key.pub; do
14 + if [[ $keyname == *.pub ]]; then
15 + umask 0133
16 + else
17 + umask 0177
18 + fi
19 + sops --extract '["'$keyname'"]' --decrypt "$SCRIPT_DIR/../../secrets/staging-hydra-hostkeys.yaml" >"$sshDir/$keyname"
20 +done
21 +nix run nixpkgs#nixos-anywhere -- --extra-files "$tmpDir" -f .#staging-hydra root@157.180.25.203
non-critical-infra/secrets/signing-key.staging-hydra
+3 -3
@@ -1,5 +1,5 @@
1 {
2 - "data": "ENC[AES256_GCM,data:r5OuTSn3XvJnDotfbVuCC/CmMJM30GTpvi9xYd824nc8RwoFG5ivV29mUo8kj2A/C8I1sgmxHbRSM3zCDQ5nDV6ul9XFqsFlK+9l5O2hZXSEq7crE6IEPJKXlYvQGTbZH9VcIrigDOCUiZgbfDFTnWIQ,iv:DcMMvNoINfUwCp4kKcQt3Ya5iOD1rQ08ft0blz7QuoA=,tag:APdvyc+0L9rz+5vhtothtQ==,type:str]",
2 + "data": "ENC[AES256_GCM,data:cPViz9seX59g1dneq/kngFZSIUP81osOEs/kbLr+OrKB8MSe4tg6O1G5c3uSHPfMNbeYdhG6CinZZCY5Lk22rRyrFLaJfHi8xTsnsEtIcC9v4q+cFyOfPmJE7SblmiNGyjYNTZl6sdC5awnbXjo1aNPGfQ==,iv:DrY/VDNXiV/WMNjyD8wrQmEE36jHbCTUn7UiHk/PeDM=,tag:DRVVu7VMqlfnxwDJaobSpw==,type:str]",
3 "sops": {
4 "kms": null,
5 "gcp_kms": null,
@@ -19,8 +19,8 @@
19 "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWb2ljNWl5SUhGUXZmQXhP\nTDF4bzhVYnpSdUFFVWVzeURnS1gxSVUrNWtVClR0S05HWUtpSU5ETWh0YVhJcS9C\nMmtwS1ZZSnRSMlVYQWtMMk5GVGhWVjAKLS0tIGdnYmEyaDBMbDhaUVpOUzN5OWk3\nKzkvSU1wQWxETDJiMWxVYUhuV1V4aEkKwjiLNhN2WvjV1WC648tl2bUIgcthFo/r\nwGF2G+J7ueAp3WGWRtd1a2kQNn8MLqCZksUMeksy4+3570kKmdCOrg==\n-----END AGE ENCRYPTED FILE-----\n"
20 }
21 ],
22 - "lastmodified": "2025-02-12T07:28:02Z",
23 - "mac": "ENC[AES256_GCM,data:Kk+FO9fjspAPkzs1orp5iXuVc1iLXbMr5PRmM9lDULjGZ2gpgS2JJF/Uf+4OeWrmLRmUwqa0dPPr3gR4/BEQmPk7FKqlr66iFun8Y/ExV38hWKGzBOvDxZIGdzT5i0S5SrohjhjQN2qzM8l6YANN21wogv/I0Mb/KKUNlBK/z9E=,iv:2fN19YDoZ7+0BVBo9FQJkPpjyGr2AB9GtYp4kvX+tUw=,tag:KrYOLR38mxv1eYOEoG9pNg==,type:str]",
22 + "lastmodified": "2025-02-12T09:27:43Z",
23 + "mac": "ENC[AES256_GCM,data:6IPR2vcE0XxIbwsyaTIADl34wHSikT/Jy1UYPJPexvw22JbAQyIJn8dZQvpa6IrIi1+thLyambL1BXwiYmOepQWCXIWTYNDhu3xNi9UwpjdwGpLGCFQz18eXnqRLWZT3UXyZ5aEFdHGHgbMbHEkJ+suK3FqJCXn4AvmlqER211Q=,iv:q1ZKHd4VwLLmx5lUekt0yVdSy7kiZCUMzuygjg/jCh8=,tag:VBkblBU0osFoANXymHiWcw==,type:str]",
24 "pgp": null,
25 "unencrypted_suffix": "_unencrypted",
26 "version": "3.9.4"
non-critical-infra/secrets/staging-hydra-hostkeys.yaml new
+31
@@ -0,0 +1,31 @@
1 +ssh_host_ed25519_key: ENC[AES256_GCM,data:Okg9SB54M1j/Os2cjYL4b7Xy9qafNKjTD+/pJx8NoPg5+GACiPuiseDa3WcF7gtozzpzLOn+37nrnE11Qy+GT7FrRFnbhWlv41ZEWaktaysOOnVdclHu1e8gGdLYqX32cK2AL4hQYxVJgk9aVVQ+Zm0cnv9Tz8FEdCPuItOwaph6N0WF9+Ssq+zf50RKn8DwOrssGb/QOM45JC4R1wLP6Qf3OjvJRThP8TvVoFCn2kaQS1rKmJ84kn6HAjOkkDZVIHekea0OegKY1szA4FL+Tt+9S1PbtTcjkWnLVISCOkH3FpzNFWDRkLAloZtAHOSOUCwxumzBKApLpvp1K4Z/ctFWIqEI7pCpVxL32KJC2S7u2xc/tXvH2KWG+/u0dfX9UXHEm5UCZ8njHZYGRQl46tbBfBv45KQUi+mL+Xpcv176XGpx08kYeIlKIQ/vKqp2hPfBQkHMisA+bUwzIqg3eWQrrfbNU1cevMqSPg3VzXtfdf7sTnG5tsIqsEHspTURzIdBFSEKPxB5TR2MWLPM9iO9LQCLuyvA/qTG,iv:kWEbM4cKF2gBc6YFkjag38CQFHwPr1WjoFazQJKJCPA=,tag:JTcCuDq5VbwcvnLX7/fT3Q==,type:str]
2 +ssh_host_ed25519_key.pub: ENC[AES256_GCM,data:l81c4JwjKoWutFi1+WzyDh8Hcr5spDbRCOtghyPlRjq8vIzCqwnhtf5ifTKVgIvN1Updd0oYDSWa9YhjFhrWvCGBh0JVqKLVKB/ejm1jRdUO,iv:W9CY6YjtnCv6L7kdSwpFB/38GoU2AIIzdWTsxUPHnGU=,tag:TNq7oDVbUb6mrSdZ4Z6/wg==,type:str]
3 +sops:
4 + kms: []
5 + gcp_kms: []
6 + azure_kv: []
7 + hc_vault: []
8 + age:
9 + - recipient: age1v5qpkvs3zpz65gvfr2gv3ln7x6yfexvpregdr02hyvxnunu63ujqgwevf8
10 + enc: |
11 + -----BEGIN AGE ENCRYPTED FILE-----
12 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBubThhZ2U2Tnp3VjEyVEtD
13 + TnNScHFVaVFVV21WbmZNSjlEcG1FSGYvbHhBClVHVEJPZnNvVGhHbWJvRkVENXFu
14 + OGlZWUFBL2N2T0kvWnI0cXZnU01vMHcKLS0tIEcrUG84bGhQZEVpWVN3REZhNVgy
15 + bUFzL0xJZVlTaGpEdnk3NG8rS1o5VDAKDQc62S+uy/sl7lDyUMfrqDhurqAua5ik
16 + l2y+nFnzv4/RVa3Y4xbJyy/TEuNpEsNS0s3bgnHD5kOAgjtIKjEFkQ==
17 + -----END AGE ENCRYPTED FILE-----
18 + - recipient: age17n64ahe3wesh8l8lj0zylf4nljdmqn28hvqns2g7hgm9mdkhlsvsjuvkxz
19 + enc: |
20 + -----BEGIN AGE ENCRYPTED FILE-----
21 + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGaEZVMVVqSlYyTDVuT29p
22 + Yk9lT0VZb2dIV3MyR2luV21taGV2ZC85akRJCjNnYktKWFg0MjlqU2hDNXZOYk9J
23 + Y0VUK3BJR1l5S0d3eVRjM3MxR3hUSzgKLS0tIFNPNitGOGgrK05hSXhCWkFDNHZa
24 + eFF2SlQwSmVoVUszeVI0SWRZK2ROS0kKUAjRNmIDiavnbL9/sgLu12DPf5qEXiFu
25 + w0vTGO5ffR0I04SYpHznSf28Ja/EcbpDrZ6fMh6bC7Q+k1uLvASBEA==
26 + -----END AGE ENCRYPTED FILE-----
27 + lastmodified: "2025-02-12T09:19:59Z"
28 + mac: ENC[AES256_GCM,data:Ym3YsYfQOd4D8iZ0K01gF6IzvYYvQEKFWzLqL815Nk0ozW1g3D8xPcNxVxb0juvRjbeBXlz0fkDLXxJ1N0ZMASmZ2wHxfR9w5J+CL8hyCmsutJ+ofdiZVJ+ZwEKfenPp/Ke02ce+5EixxU5X3Ad04kLjNalOmmkNhTd5WRFbFe8=,iv:guGa3Nz1DC8Bo5yVP6unoCFGVigKmAKliXA8r5gKyNg=,tag:k69LdmsWW5gYbamdD2S4Ig==,type:str]
29 + pgp: []
30 + unencrypted_suffix: _unencrypted
31 + version: 3.9.4
non-critical-infra/secrets/staging-hydra.hostkeys deleted
-24
@@ -1,24 +0,0 @@
1 -{
2 - "data": "ENC[AES256_GCM,data:6b/6T5yhrAHKFORpq0JM0ge/lI0LUTdT+IcyYu5oDwy4LEhIKfICpziYqKeRm1JWHf+DAjCweJlTsK53HT31h6wcC7eA9j4J2pEk2ws7UYKKAeeqaAdaQO0EKaZvcwcVq48tY2gvdVhsaIS9s7/rvZEWXrrAOaNn9h3hM/HWLgfZTo9HZm87A+EKMPnQ75LRYZubZFLgrkKU/t82ocSIQD4VGk8ne58ncLY8BT/BdXOdwauyho6BQ8VKMK4JzXEK4ISvOwW+xrnOjuOz0R5QwPHyewBF9hLx6Wd8JT1fDqLdpTsWTi2uPlGHgkvBFcrbBxHpioJ5Z5wQVIWkKG21+7cRhLK1TJCi0O+z0czxS2BMNaPxrKiE5QfL+vtmnyX2xfYTcxrWdg3pqkemaM7T54kIa3O1SIQxitGXlgBsFQxr9Nw/iiz+Ys05ObhWPmENQIZlslUUg3ounnXmTA7eU7ogoH05feNOawPDWcUdyLX9eQ2JfhC9SlfQnKSJ7egNZd1592ybFPJkTnQeE5QFCxUOzISSV33BTnObFPSXYOEHYixvyPm8ALHZQdL9xbWu7qSADouc4xgR9vWm85BxJwjSqUNAM/L2CCDJtJqYT+O8k8M0DLHqrYeuMlnL5zLQ4ZcDYF2agezZStf7Cdm8xVHdd+Tfi1AePU9op3MeHmYMHzIIkc/eLGNOhBlQ5pZZ3S0gjqbD+0av+qSLTdx6fjaqnUCp7eS44QRSVUbzqO8mYWgXbRlfh0ewpBIHaTM=,iv:5z+8/wJR2tFuZF5aRKUX7xa89QqHVx0YVCjsPfIoC8Y=,tag:sC4/gyabxyFhdhWc7jAFIg==,type:str]",
3 - "sops": {
4 - "kms": null,
5 - "gcp_kms": null,
6 - "azure_kv": null,
7 - "hc_vault": null,
8 - "age": [
9 - {
10 - "recipient": "age1j3spleg4m7rtjww4zqsws6qaj69v5j0rc3asaxxlpwnu7fmx8p9qvmvjn8",
11 - "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTSzY3WFc2dDhPRVNTOFJH\ncVlkWnQ2L1V4dGNhZllvZVhlYnlVZXQvVzFnCnBiWXkwS2FFbVMrdjNZOGhIU001\nL3VmOGp1QTRpMWlRY2s5UGFqN01tc0UKLS0tIHV1b2FwWEhTY09SdGlGc3NhbnVZ\nUmd5dVdIZE9jWUV2VW8vb3dNK0JDYlkKElQj+C53jgVk2QTKAhsHCFMzKAwXWozP\ngSI8j4osvza/GqEM6XvQl/tW/TYcxIPDazK9tXOJEfbHmGh8ADyCaA==\n-----END AGE ENCRYPTED FILE-----\n"
12 - },
13 - {
14 - "recipient": "age17n64ahe3wesh8l8lj0zylf4nljdmqn28hvqns2g7hgm9mdkhlsvsjuvkxz",
15 - "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMakVLWHFSaDVwTnpud2ZF\nZExnSDY1VGI1YjF4ZGl0NWdLQi9udGlwS2d3CnhwVEtIU1ZLMGdFaGhLQlNMSjVJ\nTjZXTUo4SzJiVUZiM2tjQVJJT3ZiL2MKLS0tIDkxUlhTZnZmVEN6RVdSTndwazdn\nZU1QcWlWL0gwTWIvWXhtQVFOb2VYaWsKEZX9COQbwRP/OvimWL6ijR2lsQBihssd\n7lZwH5xcKNWXH/u4lLxXQx7ARtEBX9kMKGtF8uGq6NCt2Gjlt/lJWg==\n-----END AGE ENCRYPTED FILE-----\n"
16 - }
17 - ],
18 - "lastmodified": "2025-02-12T07:19:21Z",
19 - "mac": "ENC[AES256_GCM,data:ZS6cY/umbUO7Aj1cnmLiCMLyhiiyAupEBL8/qDkO5JYZ4ufQN3WfiKebbndpLyl+35bMBL9C640BWTFh90Y0AwaZ2IxbAmTLGiqaeMG7ESzNXv1XYWF1MJdIa5i7hsl6DdKn26aHocmDIMMQ1tglZfk42fucJTWncUbio4trPfg=,iv:9dPqNw6utDO9boVzbRdtd1CtKSTG84upG0QQDPfH5Ow=,tag:CJm4QzxRi0SwCuGHxxw/Ew==,type:str]",
20 - "pgp": null,
21 - "unencrypted_suffix": "_unencrypted",
22 - "version": "3.9.1"
23 - }
24 -}
\ No newline at end of file
non-critical-infra/secrets/staging-hydra.hostkeys.pub.tmp deleted
-1
@@ -1 +0,0 @@
1 -ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK81IHfeA/GXIgb9N5hl/qtCSsSBqs+FkppGklxworUD m1-s@thinkbook
non-critical-infra/secrets/staging-hydra.hostkeys.tmp deleted
-7
@@ -1,7 +0,0 @@
1 ------BEGIN OPENSSH PRIVATE KEY-----
2 -b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
3 -QyNTUxOQAAACCvNSB33gPxlyIG/TeYZf6rQkrEgarPhZKaRpJccKK1AwAAAJhqdU+1anVP
4 -tQAAAAtzc2gtZWQyNTUxOQAAACCvNSB33gPxlyIG/TeYZf6rQkrEgarPhZKaRpJccKK1Aw
5 -AAAEBsDJIMqVf7Y3FoTZk42DsRyLaBz0fGJUjazwskqATxxq81IHfeA/GXIgb9N5hl/qtC
6 -SsSBqs+FkppGklxworUDAAAADm0xLXNAdGhpbmtib29rAQIDBAUGBw==
7 ------END OPENSSH PRIVATE KEY-----