hydra-staging: fix s3 bucket auth
Jörg Thalheim committed
Feb 16, 2025 at 00:04 UTC
a96850783018b6383230a6f54ca4c38f686cdc52
3 files changed
+11
-4
non-critical-infra/hosts/staging-hydra/hydra.nix
+3
-1
@@ -39,6 +39,8 @@ in
39
hydra-aws-credentials = {
40
sopsFile = ../../secrets/hydra-aws-credentials.staging-hydra;
41
format = "binary";
42
+ path = "/var/lib/hydra/queue-runner/.aws/credentials";
43
+ owner = config.systemd.services.hydra-queue-runner.serviceConfig.User;
44
};
45
};
46
@@ -58,7 +60,7 @@ in
60
extraConfig = ''
61
max_servers 30
62
61
- store_uri = s3://nixos-cache-staging?secret-key=${config.sops.secrets.signing-key.path}&ls-compression=br&log-compression=br
63
+ store_uri = s3://nix-cache-staging?secret-key=${config.sops.secrets.signing-key.path}&ls-compression=br&log-compression=br
64
server_store_uri = https://cache-staging.nixos.org?local-nar-cache=${narCache}
65
binary_cache_public_uri = https://cache-staging.nixos.org
66
non-critical-infra/secrets/hydra-aws-credentials.staging-hydra
+3
-3
@@ -1,5 +1,5 @@
1
{
2
- "data": "ENC[AES256_GCM,data:d/rjsri6EXmB4IXu8atZRKjk9pAn9GLTDybq89RnvRDy8olxc7S0z8CABqZXcCYwlyzlbBXYLTm75EwhfDq/GYstD9Bxh7j/iRctnNmBxRkzk5fiIMYCTXOyOCbPyeNkZ0+AkrmVs+11usH25DU2C/1g16o=,iv:0bTqh+lVMIT4gIYJ20LbX6KOJnhq6cEbWLSJEBtW4ko=,tag:uxgfFVbPozT3QetMg4AAeQ==,type:str]",
2
+ "data": "ENC[AES256_GCM,data:OTKF4ciLxhfcmeqS78NsoS24e2PaUmpdbD+Ol2toWDcc/WdRYDcw8uimtJE/B0VfXUgz8sqEPISXOHV1kw2Jh3+089HVLlQPdJPpC9aCSQ9zPv3wwyCAXATH2nOv1piF+h8tNqHYmsxykDFVkMs1oEvGPQOlo9HaFd4OSB2y1nSAA/S79wOa,iv:ZCH/gsD91QcVKQtyymUXXOrSioHrOwa9mW/PIe6WG1k=,tag:ck4C6U5RphH5rR0yR0rqIw==,type:str]",
3
"sops": {
4
"kms": null,
5
"gcp_kms": null,
@@ -19,8 +19,8 @@
19
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiSlVJOVJQL1B1NFhnRFpC\nSlczMVlCRllQVE83clJSd0JmMEJwTlpybmtrCk8xaisvV0t4Y29ZQ0VUZVo3OXcw\nYmFPZXJrWnBuL0tzK2x6M3pnSmltQkUKLS0tIFNQUmVTNU9mYVB0Q0tvL0RXNlFV\nVVMwa0lGN2krODYrN0ZXWk1XZFgzakkKsU/gYH12e0EqAKlh0e36JQTqa0FG1LCv\n+D1F/8cM+FnWdIp9m2rRn4Y17F4TlQ4G+z1s/1qFPNrX3xyQ1VpKEw==\n-----END AGE ENCRYPTED FILE-----\n"
20
}
21
],
22
- "lastmodified": "2025-02-12T09:43:35Z",
23
- "mac": "ENC[AES256_GCM,data:NFlmL4am9aN+K8xQeR7qBYyQMJNl5exAlOo6IvmVd0tQ51n5uzyZ7rxJK5ku3amh/ZxNF4G2FJKJQFbN+7I5aq58xJWUF4ApsZfAsNBUG8e1/4/Jzdk5BSHaP3N8wkkNb3zWBFqE7aijcq+GH/P8Ra+hprbkAYLjEoTcJoMVtsE=,iv:kdqS91wd4cat1dgxbVo0AuHPxJ4BPSKFyTAOg3VP+KM=,tag:9vvYEwJWFTdXB4HJ8viy8g==,type:str]",
22
+ "lastmodified": "2025-02-15T16:47:02Z",
23
+ "mac": "ENC[AES256_GCM,data:wilD1Hhi9/+eFmfPznq4WQYBYROkPfvKV7cjKsfRzgm1k5GRwvXe1V2bHpHJAVgPADFQ8b5JJrRmOGqNwds28Tx5fKmp8B4g7s7i8v7JK62OLMOl1BX3AeJxjvDBEPIKLkZUZuosSmCZUBEWcXppyVmdvHJETLi6RIFpAEw/Zc4=,iv:CcSj6oSjmWPQXJv9O7GlPIVfj+0h7fgktIZHVFWdFbI=,tag:2C0vY1Fvh5nvuzmdcoUYNA==,type:str]",
24
"pgp": null,
25
"unencrypted_suffix": "_unencrypted",
26
"version": "3.9.4"
terraform-iam/cache-staging.tf
+5
@@ -36,6 +36,11 @@ resource "aws_iam_policy" "s3-upload-cache-staging" {
36
policy = data.aws_iam_policy_document.s3-upload-cache-staging.json
37
}
38
39
+resource "aws_iam_user_policy_attachment" "s3-upload-cache-staging-attachment" {
40
+ user = aws_iam_user.s3-upload-cache-staging.name
41
+ policy_arn = aws_iam_policy.s3-upload-cache-staging.arn
42
+}
43
+
44
output "s3-upload-key-staging" {
45
value = {
46
key = aws_iam_access_key.s3-upload-cache-staging.id