Rodrigo Arias Mallo
a1135306ed
It uses docker based on alpine and the host nix store, so we can perform builds but isolate them from the system.
19 lines
584 B
Nix
19 lines
584 B
Nix
let
|
|
keys = import ../keys.nix;
|
|
adminsKeys = builtins.attrValues keys.admins;
|
|
hut = [ keys.hosts.hut ] ++ adminsKeys;
|
|
# Only expose ceph keys to safe nodes and admins
|
|
safe = keys.hostGroup.safe ++ adminsKeys;
|
|
in
|
|
{
|
|
"gitea-runner-token.age".publicKeys = hut;
|
|
"gitlab-runner-docker-token.age".publicKeys = hut;
|
|
"gitlab-runner-shell-token.age".publicKeys = hut;
|
|
"gitlab-bsc-docker-token.age".publicKeys = hut;
|
|
"nix-serve.age".publicKeys = hut;
|
|
"jungle-robot-password.age".publicKeys = hut;
|
|
|
|
"ceph-user.age".publicKeys = safe;
|
|
"munge-key.age".publicKeys = safe;
|
|
}
|