jungle/secrets/secrets.nix

let
  keys = import ../keys.nix;
  adminsKeys = builtins.attrValues keys.admins;
  hut = [ keys.hosts.hut ] ++ adminsKeys;
  # Only expose ceph keys to safe nodes and admins
  safe = keys.hostGroup.safe ++ adminsKeys;
in
{
  "gitlab-bsc-es-token.age".publicKeys = hut;
  "gitea-runner-token.age".publicKeys = hut;
  "ovni-token.age".publicKeys = hut;
  "nosv-token.age".publicKeys = hut;
  "nix-serve.age".publicKeys = hut;
  "jungle-robot-password.age".publicKeys = hut;

  "ceph-user.age".publicKeys = safe;
  "munge-key.age".publicKeys = safe;
}
Reorganize secrets and ssh keys The agenix tools needs to read the secrets from a standalone file, but we also need the same information for the SSH keys. 2023-09-04 21:36:31 +02:00			`let`
			`keys = import ../keys.nix;`
			`adminsKeys = builtins.attrValues keys.admins;`
			`hut = [ keys.hosts.hut ] ++ adminsKeys;`
			`# Only expose ceph keys to safe nodes and admins`
Add encrypted munge key with agenix 2023-09-08 19:01:57 +02:00			`safe = keys.hostGroup.safe ++ adminsKeys;`
Reorganize secrets and ssh keys The agenix tools needs to read the secrets from a standalone file, but we also need the same information for the SSH keys. 2023-09-04 21:36:31 +02:00			`in`
			`{`
Add runner for gitlab.bsc.es 2023-09-28 14:11:30 +02:00			`"gitlab-bsc-es-token.age".publicKeys = hut;`
Add Gitea service Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es> 2024-04-26 16:52:52 +02:00			`"gitea-runner-token.age".publicKeys = hut;`
Reorganize secrets and ssh keys The agenix tools needs to read the secrets from a standalone file, but we also need the same information for the SSH keys. 2023-09-04 21:36:31 +02:00			`"ovni-token.age".publicKeys = hut;`
			`"nosv-token.age".publicKeys = hut;`
Serve the nix store from hut 2023-09-12 12:19:43 +02:00			`"nix-serve.age".publicKeys = hut;`
Add msmtp to send notifications via email Reviewed-by: Aleix Roca Nonell <aleix.rocanonell@bsc.es> 2024-05-02 17:54:09 +02:00			`"jungle-robot-password.age".publicKeys = hut;`
Reorganize secrets and ssh keys The agenix tools needs to read the secrets from a standalone file, but we also need the same information for the SSH keys. 2023-09-04 21:36:31 +02:00
Add encrypted munge key with agenix 2023-09-08 19:01:57 +02:00			`"ceph-user.age".publicKeys = safe;`
			`"munge-key.age".publicKeys = safe;`
Reorganize secrets and ssh keys The agenix tools needs to read the secrets from a standalone file, but we also need the same information for the SSH keys. 2023-09-04 21:36:31 +02:00			`}`