Compare commits
7 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
| 2f4cb3787b | |||
| 4f9e66ba82 | |||
|
c51c1e8e92 | ||
|
|
a96b8f65c9 | ||
| 29d6bc02e0 | |||
|
|
c0cef1ff1e | ||
|
|
7099c92236 |
1
.gitignore
vendored
1
.gitignore
vendored
@@ -6,4 +6,3 @@ result
|
||||
.direnv/
|
||||
book/
|
||||
fanny-efi-vars.fd
|
||||
nix-store-overlay.img
|
||||
|
||||
75
README.md
75
README.md
@@ -1,20 +1,44 @@
|
||||
# malobeo infrastructure
|
||||
|
||||
this repository contains nixos configurations of the digital malobeo infrastructure. it should be used to setup, test, build and deploy different hosts in a reproducible manner.
|
||||
this repository nxios configurations of the digital malobeo infrastructure. it should be used to setup, test, build and deploy different hosts in a reproducible manner.
|
||||
|
||||
the file structure is based on this [blog post](https://samleathers.com/posts/2022-02-03-my-new-network-and-deploy-rs.html)
|
||||
|
||||
## hosts
|
||||
|
||||
#### durruti
|
||||
- nixos-container running on dedicated hetzner server
|
||||
- login via ```ssh -p 222 malobeo@dynamicdiscord.de```
|
||||
- if rebuild switch fails due to biglock do ```mount -o remount,rw /nix/var/nix/db```
|
||||
- currently is running tasklist in detached tmux session
|
||||
- [x] make module with systemd service out of that
|
||||
|
||||
## creating a new host
|
||||
|
||||
### setting up filesystem
|
||||
currently nixos offers no declarative way of setting up filesystems and partitions. that means this has to be done manually for every new host. [to make it as easy as possible we can use this guide to setup an encrypted zfs filesystem](https://openzfs.github.io/openzfs-docs/Getting%20Started/NixOS/Root%20on%20ZFS.html)
|
||||
|
||||
*we could create a shell script out of that*
|
||||
|
||||
### deploying configuration
|
||||
|
||||
hosts are deployed automatically from master. The [hydra build server](https://hydra.dynamicdiscord.de/jobset/malobeo/infrastructure) will build new commits and on success, hosts will periodically pull those changes.
|
||||
Big changes (like updating flake lock) could be commited to the staging branch first. [Hydra builds staging seperate](https://hydra.dynamicdiscord.de/jobset/malobeo/staging), and on success you can merge into master.
|
||||
#### local deployment
|
||||
``` shell
|
||||
nixos-rebuild switch --use-remote-sudo
|
||||
```
|
||||
|
||||
### deploy fresh host
|
||||
if you want to deploy a completly new host refer to [docs](https://docs.malobeo.org/anleitung/create.html)
|
||||
#### remote deployment
|
||||
|
||||
### testing configuration
|
||||
you need the hostname and ip address of the host:
|
||||
``` shell
|
||||
nixos-rebuild switch --flake .#<hostname> --target-host root@<ip_address> --build-host localhost
|
||||
```
|
||||
|
||||
in this case 'localhost' is used as buildhost which can be usefull if the target host is low systemresources
|
||||
|
||||
refer to https://docs.malobeo.org/anleitung/microvm.html#testing-microvms-locally
|
||||
|
||||
## development
|
||||
|
||||
### requirements
|
||||
we use flake based configurations for our hosts. if you want to build configurations on you own machine you have to enable flakes first by adding the following to your *configuration.nix* or *nix.conf*
|
||||
``` nix
|
||||
@@ -31,13 +55,46 @@ a development shell with the correct environment can be created by running ```ni
|
||||
If you're using direnv you can add flake support by following those steps: [link](https://nixos.wiki/wiki/Flakes#Direnv_integration)
|
||||
|
||||
### build a configuration
|
||||
|
||||
to build a configuration run the following command (replace ```<hostname>``` with the actual hostname):
|
||||
|
||||
``` shell
|
||||
nix build .#nixosConfigurations.<hostname>.config.system.build.toplevel
|
||||
```
|
||||
|
||||
### building raspberry image
|
||||
|
||||
for the raspberry it is possible to build the whole configuration as an sd-card image which then can be flashed directly. more information about building arm on nixos can be found [here](https://nixos.wiki/wiki/NixOS_on_ARM).
|
||||
|
||||
to be able to build the image you need to enable qemu emulation on the machine you are building with. therefore it is necessary to add the following to your configuration.nix:
|
||||
|
||||
``` nix
|
||||
boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
|
||||
```
|
||||
|
||||
then you can build the image with:
|
||||
|
||||
``` shell
|
||||
nix build .#nixosConfigurations.rpi1_base_image.config.system.build.sdImage
|
||||
```
|
||||
|
||||
### run a configuration as vm
|
||||
|
||||
to run a vm we have to build it first using the following command (replace ```<hostname>``` with the actual hostname):
|
||||
|
||||
``` shell
|
||||
nix build .#nixosConfigurations.<hostname>.config.system.build.vm
|
||||
```
|
||||
|
||||
afterwards run the following command to start the vm:
|
||||
|
||||
``` shell
|
||||
./result/bin/run-<hostname>-vm
|
||||
```
|
||||
|
||||
### documentation
|
||||
|
||||
documentation is automatically build from master and can be found here: docs.malobeo.org
|
||||
locally you can run documentation using ```nix run .#docs``` or ```nix run .#docsDev```
|
||||
for documentation we currently just use README.md files.
|
||||
|
||||
the devshell provides the python package ['grip'](https://github.com/joeyespo/grip) which can be used to preview different README.md files in the browser.
|
||||
the usage is simple, just run ```grip``` in the same folder as the README.md you wanna preview. then open your browser at ```http://localhost:6419 ```.
|
||||
|
||||
@@ -1,20 +1,26 @@
|
||||
# malobeo infrastructure
|
||||
|
||||
this repository contains nixos configurations of the digital malobeo infrastructure. it should be used to setup, test, build and deploy different hosts in a reproducible manner.
|
||||
this repository nxios configurations of the digital malobeo infrastructure. it should be used to setup, test, build and deploy different hosts in a reproducible manner.
|
||||
|
||||
the file structure is based on this [blog post](https://samleathers.com/posts/2022-02-03-my-new-network-and-deploy-rs.html)
|
||||
|
||||
### deploying configuration
|
||||
#### local deployment
|
||||
``` shell
|
||||
nixos-rebuild switch --use-remote-sudo
|
||||
```
|
||||
|
||||
hosts are deployed automatically from master. The [hydra build server](https://hydra.dynamicdiscord.de/jobset/malobeo/infrastructure) will build new commits and on success, hosts will periodically pull those changes.
|
||||
Big changes (like updating flake lock) could be commited to the staging branch first. [Hydra builds staging seperate](https://hydra.dynamicdiscord.de/jobset/malobeo/staging), and on success you can merge into master.
|
||||
#### remote deployment
|
||||
you need the hostname and ip address of the host:
|
||||
``` shell
|
||||
nixos-rebuild switch --flake .#<hostname> --target-host root@<ip_address> --build-host localhost
|
||||
```
|
||||
|
||||
### deploy fresh host
|
||||
if you want to deploy a completly new host refer to [docs](https://docs.malobeo.org/anleitung/create.html)
|
||||
in this case 'localhost' is used as buildhost which can be usefull if the target host is low systemresources
|
||||
|
||||
### testing configuration
|
||||
|
||||
refer to https://docs.malobeo.org/anleitung/microvm.html#testing-microvms-locally
|
||||
|
||||
## development
|
||||
|
||||
### requirements
|
||||
we use flake based configurations for our hosts. if you want to build configurations on you own machine you have to enable flakes first by adding the following to your *configuration.nix* or *nix.conf*
|
||||
``` nix
|
||||
@@ -31,13 +37,46 @@ a development shell with the correct environment can be created by running ```ni
|
||||
If you're using direnv you can add flake support by following those steps: [link](https://nixos.wiki/wiki/Flakes#Direnv_integration)
|
||||
|
||||
### build a configuration
|
||||
|
||||
to build a configuration run the following command (replace ```<hostname>``` with the actual hostname):
|
||||
|
||||
``` shell
|
||||
nix build .#nixosConfigurations.<hostname>.config.system.build.toplevel
|
||||
```
|
||||
|
||||
### building raspberry image
|
||||
|
||||
for the raspberry it is possible to build the whole configuration as an sd-card image which then can be flashed directly. more information about building arm on nixos can be found [here](https://nixos.wiki/wiki/NixOS_on_ARM).
|
||||
|
||||
to be able to build the image you need to enable qemu emulation on the machine you are building with. therefore it is necessary to add the following to your configuration.nix:
|
||||
|
||||
``` nix
|
||||
boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
|
||||
```
|
||||
|
||||
then you can build the image with:
|
||||
|
||||
``` shell
|
||||
nix build .#nixosConfigurations.rpi1_base_image.config.system.build.sdImage
|
||||
```
|
||||
|
||||
### run a configuration as vm
|
||||
|
||||
to run a vm we have to build it first using the following command (replace ```<hostname>``` with the actual hostname):
|
||||
|
||||
``` shell
|
||||
nix build .#nixosConfigurations.<hostname>.config.system.build.vm
|
||||
```
|
||||
|
||||
afterwards run the following command to start the vm:
|
||||
|
||||
``` shell
|
||||
./result/bin/run-<hostname>-vm
|
||||
```
|
||||
|
||||
### documentation
|
||||
|
||||
documentation is automatically build from master and can be found here: docs.malobeo.org
|
||||
locally you can run documentation using ```nix run .#docs``` or ```nix run .#docsDev```
|
||||
for documentation we currently just use README.md files.
|
||||
|
||||
the devshell provides the python package ['grip'](https://github.com/joeyespo/grip) which can be used to preview different README.md files in the browser.
|
||||
the usage is simple, just run ```grip``` in the same folder as the README.md you wanna preview. then open your browser at ```http://localhost:6419 ```.
|
||||
|
||||
@@ -1,19 +1,47 @@
|
||||
# Create host with nixos-anywhere
|
||||
We use a nixos-anywhere wrapper script to deploy new hosts.
|
||||
The wrapper script takes care of copying persistent host keys before calling nixos-anywhere.
|
||||
|
||||
To accomplish that boot the host from a nixos image and setup a root password.
|
||||
# Create host with disko-install
|
||||
How to use disko-install is described here: https://github.com/nix-community/disko/blob/master/docs/disko-install.md
|
||||
---
|
||||
Here are the exact steps to get bakunin running:
|
||||
First create machines/hostname/configuration.nix
|
||||
Add hosts nixosConfiguration in machines/configurations.nix
|
||||
Boot nixos installer on the Machine.
|
||||
``` bash
|
||||
sudo su
|
||||
passwd
|
||||
```
|
||||
# establish network connection
|
||||
wpa_passphrase "network" "password" > wpa.conf
|
||||
wpa_supplicant -B -i wlp3s0 -c wpa.conf
|
||||
ping 8.8.8.8
|
||||
# if that works continue
|
||||
|
||||
After that get the hosts ip using `ip a` and start deployment from your own machine:
|
||||
# generate a base hardware config
|
||||
nixos-generate-config --root /tmp/config --no-filesystems
|
||||
|
||||
``` bash
|
||||
# from infrastrucutre repository root dir:
|
||||
nix develop .#
|
||||
remote-install hostname 10.0.42.23
|
||||
# get the infra repo
|
||||
nix-shell -p git
|
||||
git clone https://git.dynamicdiscord.de/kalipso/infrastructure
|
||||
cd infrastructure
|
||||
|
||||
# add the new generated hardware config (and import in hosts configuration.nix)
|
||||
cp /tmp/config/etc/nixos/hardware-configuration.nix machines/bakunin/
|
||||
|
||||
# check which harddrive we want to install the system on
|
||||
lsblk #choose harddrive, in this case /dev/sda
|
||||
|
||||
# run nixos-install on that harddrive
|
||||
sudo nix --extra-experimental-features flakes --extra-experimental-features nix-command run 'github:nix-community/disko/latest#disko-install' -- --flake .#bakunin --disk main /dev/sda
|
||||
|
||||
# this failed with out of memory
|
||||
# running again showed: no disk left on device
|
||||
# it seems the usb stick i used for flashing is way to small
|
||||
# it is only
|
||||
# with a bigger one (more than 8 gig i guess) it should work
|
||||
# instead the disko-install tool i try the old method - first partitioning using disko and then installing the system
|
||||
# for that i needed to adjust ./machines/modules/disko/btrfs-laptop.nix and set the disk to "/dev/sda"
|
||||
|
||||
sudo nix --extra-experimental-features "flakes nix-command" run 'github:nix-community/disko/latest' -- --mode format --flake .#bakunin
|
||||
|
||||
# failed with no space left on device.
|
||||
# problem is lots of data is written to the local /nix/store which is mounted on tmpfs in ram
|
||||
# it seems that a workaround could be modifying the bootable stick to contain a swap partition to extend tmpfs storage
|
||||
```
|
||||
|
||||
# Testing Disko
|
||||
@@ -21,3 +49,18 @@ Testing disko partitioning is working quite well. Just run the following and che
|
||||
```bash
|
||||
nix run -L .\#nixosConfigurations.fanny.config.system.build.vmWithDisko
|
||||
```
|
||||
|
||||
Only problem is that encryption is not working, so it needs to be commented out. For testing host fanny the following parts in ```./machines/modules/disko/fanny.nix``` need to be commented out(for both pools!):
|
||||
```nix
|
||||
datasets = {
|
||||
encrypted = {
|
||||
options = {
|
||||
encryption = "aes-256-gcm"; #THIS ONE
|
||||
keyformat = "passphrase"; #THIS ONE
|
||||
keylocation = "file:///tmp/root.key"; #THIS ONE
|
||||
};
|
||||
# use this to read the key during boot
|
||||
postCreateHook = '' #THIS ONE
|
||||
zfs set keylocation="prompt" "zroot/$name"; #THIS ONE
|
||||
''; #THIS ONE
|
||||
```
|
||||
|
||||
95
flake.lock
generated
95
flake.lock
generated
@@ -109,11 +109,11 @@
|
||||
"spectrum": "spectrum"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1739104176,
|
||||
"narHash": "sha256-bNvtud2PUcbYM0i5Uq1v01Dcgq7RuhVKfjaSKkW2KRI=",
|
||||
"lastModified": 1736905611,
|
||||
"narHash": "sha256-eW6SfZRaOnOybBzhvEzu3iRL8IhwE0ETxUpnkErlqkE=",
|
||||
"owner": "astro",
|
||||
"repo": "microvm.nix",
|
||||
"rev": "d3a9b7504d420a1ffd7c83c1bb8fe57deaf939d2",
|
||||
"rev": "a18d7ba1bb7fd4841191044ca7a7f895ef2adf3b",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -160,11 +160,11 @@
|
||||
},
|
||||
"nixos-hardware": {
|
||||
"locked": {
|
||||
"lastModified": 1738816619,
|
||||
"narHash": "sha256-5yRlg48XmpcX5b5HesdGMOte+YuCy9rzQkJz+imcu6I=",
|
||||
"lastModified": 1736978406,
|
||||
"narHash": "sha256-oMr3PVIQ8XPDI8/x6BHxsWEPBRU98Pam6KGVwUh8MPk=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixos-hardware",
|
||||
"rev": "2eccff41bab80839b1d25b303b53d339fbb07087",
|
||||
"rev": "b678606690027913f3434dea3864e712b862dde5",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -192,11 +192,11 @@
|
||||
},
|
||||
"nixpkgs-unstable": {
|
||||
"locked": {
|
||||
"lastModified": 1739020877,
|
||||
"narHash": "sha256-mIvECo/NNdJJ/bXjNqIh8yeoSjVLAuDuTUzAo7dzs8Y=",
|
||||
"lastModified": 1737062831,
|
||||
"narHash": "sha256-Tbk1MZbtV2s5aG+iM99U8FqwxU/YNArMcWAv6clcsBc=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "a79cfe0ebd24952b580b1cf08cd906354996d547",
|
||||
"rev": "5df43628fdf08d642be8ba5b3625a6c70731c19c",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -208,11 +208,11 @@
|
||||
},
|
||||
"nixpkgs_2": {
|
||||
"locked": {
|
||||
"lastModified": 1739206421,
|
||||
"narHash": "sha256-PwQASeL2cGVmrtQYlrBur0U20Xy07uSWVnFup2PHnDs=",
|
||||
"lastModified": 1736916166,
|
||||
"narHash": "sha256-puPDoVKxkuNmYIGMpMQiK8bEjaACcCksolsG36gdaNQ=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "44534bc021b85c8d78e465021e21f33b856e2540",
|
||||
"rev": "e24b4c09e963677b1beea49d411cd315a024ad3a",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -235,8 +235,7 @@
|
||||
"nixpkgs-unstable": "nixpkgs-unstable",
|
||||
"sops-nix": "sops-nix",
|
||||
"tasklist": "tasklist",
|
||||
"utils": "utils_3",
|
||||
"zineshop": "zineshop"
|
||||
"utils": "utils_3"
|
||||
}
|
||||
},
|
||||
"sops-nix": {
|
||||
@@ -246,11 +245,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1739262228,
|
||||
"narHash": "sha256-7JAGezJ0Dn5qIyA2+T4Dt/xQgAbhCglh6lzCekTVMeU=",
|
||||
"lastModified": 1737107480,
|
||||
"narHash": "sha256-GXUE9+FgxoZU8v0p6ilBJ8NH7k8nKmZjp/7dmMrCv3o=",
|
||||
"owner": "Mic92",
|
||||
"repo": "sops-nix",
|
||||
"rev": "07af005bb7d60c7f118d9d9f5530485da5d1e975",
|
||||
"rev": "4c4fb93f18b9072c6fa1986221f9a3d7bf1fe4b6",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -335,21 +334,6 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"systems_5": {
|
||||
"locked": {
|
||||
"lastModified": 1681028828,
|
||||
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"tasklist": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
@@ -357,11 +341,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1743458889,
|
||||
"narHash": "sha256-eVTtsCPio3Wj/g/gvKTsyjh90vrNsmgjzXK9jMfcboM=",
|
||||
"lastModified": 1737548421,
|
||||
"narHash": "sha256-gmlqJdC+v86vXc2yMhiza1mvsqh3vMfrEsiw+tV5MXg=",
|
||||
"ref": "refs/heads/master",
|
||||
"rev": "b61466549e2687628516aa1f9ba73f251935773a",
|
||||
"revCount": 30,
|
||||
"rev": "c5fff78c83959841ac724980a13597dcfa6dc26d",
|
||||
"revCount": 29,
|
||||
"type": "git",
|
||||
"url": "https://git.dynamicdiscord.de/kalipso/tasklist"
|
||||
},
|
||||
@@ -423,45 +407,6 @@
|
||||
"repo": "flake-utils",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"utils_4": {
|
||||
"inputs": {
|
||||
"systems": "systems_5"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1731533236,
|
||||
"narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"zineshop": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
],
|
||||
"utils": "utils_4"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1744626173,
|
||||
"narHash": "sha256-DSuLVFGvmMUoStIs5ar4CLE8eD2dlFPUmPC7CODauts=",
|
||||
"ref": "refs/heads/master",
|
||||
"rev": "19ce41aca7d92bc8e02f97e7bdbca7ac7ba64090",
|
||||
"revCount": 103,
|
||||
"type": "git",
|
||||
"url": "https://git.dynamicdiscord.de/kalipso/zineshop"
|
||||
},
|
||||
"original": {
|
||||
"type": "git",
|
||||
"url": "https://git.dynamicdiscord.de/kalipso/zineshop"
|
||||
}
|
||||
}
|
||||
},
|
||||
"root": "root",
|
||||
|
||||
@@ -22,11 +22,6 @@
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
|
||||
zineshop = {
|
||||
url = "git+https://git.dynamicdiscord.de/kalipso/zineshop";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
|
||||
ep3-bs = {
|
||||
url = "git+https://git.dynamicdiscord.de/kalipso/ep3-bs.nix";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
@@ -8,12 +8,10 @@ keys:
|
||||
- &admin_atlan age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
|
||||
- &machine_moderatio 3b7027ab1933c4c5e0eb935f8f9b3c058aa6d4c2
|
||||
- &machine_lucia 3474196f3adf27cfb70f8f56bcd52d1ed55033db
|
||||
- &machine_durruti age1tc6aqmcl74du56d04wsz6mzp83n9990krzu4kuam2jqu8fx6kqpq038xuz
|
||||
- &machine_infradocs age1tesz7xnnq9e58n5qwjctty0lw86gzdzd5ke65mxl8znyasx3nalqe4x6yy
|
||||
- &machine_overwatch age1hq75x3dpnfqat9sgtfjf8lep49qvkdgza3xwp7ugft3kd74pdfnqfsmmdn
|
||||
- &machine_durruti age1xu6kxpf8p0r8d6sgyl0m20p5hmw35nserl7rejuzm66eql0ur4mq03u0vp
|
||||
- &machine_vpn age1v6uxwej4nlrpfanr9js7x6059mtvyg4fw50pzt0a2kt3ahk7edlslafeuh
|
||||
- &machine_fanny age136sz3lzhxf74ryruvq34d4tmmxnezkqkgu6zqa3dm582c22fgejqagrqxk
|
||||
- &machine_nextcloud age1g084sl230x94mkd2wq92s03mw0e8mnpjdjfx9uzaxw6psm8neyzqqwpnqe
|
||||
- &machine_fanny age14dpm6vaycd6u34dkndcktpamqgdyj4aqccjnl5533dsza05hxuds0tjfnf
|
||||
- &machine_nextcloud age1w07s4y2uh0xd322ralyyh79545lvxzqncd0s65q9cx4ttlqv5u9s7y78gr
|
||||
#this dummy key is used for testing.
|
||||
- &machine_dummy age18jn5mrfs4gqrnv0e2sxsgh3kq4sgxx39hwr8z7mz9kt7wlgaasjqlr88ng
|
||||
creation_rules:
|
||||
@@ -73,6 +71,13 @@ creation_rules:
|
||||
- *admin_kalipso_dsktp
|
||||
age:
|
||||
- *admin_atlan
|
||||
- path_regex: fanny/disk.key
|
||||
key_groups:
|
||||
- pgp:
|
||||
- *admin_kalipso
|
||||
- *admin_kalipso_dsktp
|
||||
age:
|
||||
- *admin_atlan
|
||||
- path_regex: bakunin/disk.key
|
||||
key_groups:
|
||||
- pgp:
|
||||
@@ -95,10 +100,3 @@ creation_rules:
|
||||
- *admin_kalipso_dsktp
|
||||
age:
|
||||
- *admin_atlan
|
||||
- path_regex: .*/secrets/.*
|
||||
key_groups:
|
||||
- pgp:
|
||||
- *admin_kalipso
|
||||
- *admin_kalipso_dsktp
|
||||
age:
|
||||
- *admin_atlan
|
||||
|
||||
@@ -8,11 +8,12 @@ in
|
||||
[ # Include the results of the hardware scan.
|
||||
#./hardware-configuration.nix
|
||||
../modules/xserver.nix
|
||||
../modules/malobeo_user.nix
|
||||
../modules/sshd.nix
|
||||
../modules/minimal_tools.nix
|
||||
../modules/autoupdate.nix
|
||||
inputs.self.nixosModules.malobeo.disko
|
||||
inputs.self.nixosModules.malobeo.initssh
|
||||
inputs.self.nixosModules.malobeo.users
|
||||
];
|
||||
|
||||
malobeo.autoUpdate = {
|
||||
@@ -25,6 +26,7 @@ in
|
||||
|
||||
malobeo.disks = {
|
||||
enable = true;
|
||||
legacy = true;
|
||||
hostId = "a3c3102f";
|
||||
root = {
|
||||
disk0 = "disk/by-id/ata-HITACHI_HTS725016A9A364_110308PCKB04VNHX9XTJ";
|
||||
@@ -32,13 +34,9 @@ in
|
||||
};
|
||||
|
||||
malobeo.initssh = {
|
||||
enable = true;
|
||||
authorizedKeys = sshKeys.admins;
|
||||
ethernetDrivers = ["r8169"];
|
||||
enable = false;
|
||||
};
|
||||
|
||||
malobeo.users.malobeo = true;
|
||||
|
||||
hardware.sane.enable = true; #scanner support
|
||||
|
||||
nix.settings.experimental-features = [ "nix-command" "flakes" ];
|
||||
|
||||
@@ -73,17 +73,6 @@ in
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
services.nginx.virtualHosts."shop.malobeo.org" = {
|
||||
forceSSL = true;
|
||||
enableACME= true;
|
||||
locations."/" = {
|
||||
proxyPass = "http://10.0.0.10";
|
||||
extraConfig = ''
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts."status.malobeo.org" = {
|
||||
forceSSL = true;
|
||||
enableACME= true;
|
||||
|
||||
@@ -5,11 +5,11 @@ in
|
||||
{
|
||||
sops.defaultSopsFile = ./secrets.yaml;
|
||||
sops.secrets.wg_private = {};
|
||||
sops.secrets.shop_auth = {};
|
||||
|
||||
imports =
|
||||
[ # Include the results of the hardware scan.
|
||||
#./hardware-configuration.nix
|
||||
../modules/malobeo_user.nix
|
||||
../modules/sshd.nix
|
||||
../modules/minimal_tools.nix
|
||||
../modules/autoupdate.nix
|
||||
@@ -18,17 +18,8 @@ in
|
||||
inputs.self.nixosModules.malobeo.disko
|
||||
inputs.self.nixosModules.malobeo.microvm
|
||||
inputs.self.nixosModules.malobeo.metrics
|
||||
inputs.self.nixosModules.malobeo.users
|
||||
inputs.self.nixosModules.malobeo.backup
|
||||
];
|
||||
|
||||
virtualisation.vmVariantWithDisko = {
|
||||
virtualisation = {
|
||||
memorySize = 4096;
|
||||
cores = 3;
|
||||
};
|
||||
};
|
||||
|
||||
malobeo.metrics = {
|
||||
enable = true;
|
||||
enablePromtail = true;
|
||||
@@ -44,11 +35,6 @@ in
|
||||
cacheurl = "https://cache.dynamicdiscord.de";
|
||||
};
|
||||
|
||||
malobeo.backup = {
|
||||
enable = true;
|
||||
snapshots = [ "storage/encrypted" "zroot/encrypted/var" ];
|
||||
};
|
||||
|
||||
nix = {
|
||||
settings.experimental-features = [ "nix-command" "flakes" ];
|
||||
#always update microvms
|
||||
@@ -57,11 +43,6 @@ in
|
||||
'';
|
||||
};
|
||||
|
||||
malobeo.users = {
|
||||
malobeo = true;
|
||||
admin = true;
|
||||
backup = true;
|
||||
};
|
||||
|
||||
malobeo.disks = {
|
||||
enable = true;
|
||||
@@ -76,11 +57,6 @@ in
|
||||
};
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"L /var/lib/microvms/data - - - - /data/microvms"
|
||||
"d /data/microvms 0755 root root" #not needed for real host?
|
||||
];
|
||||
|
||||
malobeo.initssh = {
|
||||
enable = true;
|
||||
authorizedKeys = sshKeys.admins;
|
||||
@@ -94,13 +70,7 @@ in
|
||||
};
|
||||
|
||||
services.malobeo.microvm.enableHostBridge = true;
|
||||
services.malobeo.microvm.deployHosts = [
|
||||
"overwatch"
|
||||
"infradocs"
|
||||
"nextcloud"
|
||||
"durruti"
|
||||
"zineshop"
|
||||
];
|
||||
services.malobeo.microvm.deployHosts = [ "overwatch" "infradocs" "nextcloud" "durruti" ];
|
||||
|
||||
networking = {
|
||||
nat = {
|
||||
@@ -151,18 +121,6 @@ in
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
virtualHosts."shop.malobeo.org" = {
|
||||
# created with: nix-shell --packages apacheHttpd --run 'htpasswd -B -c foo.txt malobeo'
|
||||
# then content of foo.txt put into sops
|
||||
basicAuthFile = config.sops.secrets.shop_auth.path;
|
||||
locations."/" = {
|
||||
proxyPass = "http://10.0.0.15:8080";
|
||||
extraConfig = ''
|
||||
proxy_set_header Host $host;
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.tor = {
|
||||
|
||||
31
machines/fanny/disk.key
Normal file
31
machines/fanny/disk.key
Normal file
@@ -0,0 +1,31 @@
|
||||
{
|
||||
"data": "ENC[AES256_GCM,data:1I8fN241VOaW4GaNUe/OVr+1HQKmtYL1GSuIfsE=,iv:aHdgEUj5QhusEavG9mVgtTQ4uqLJD2ozQ/kVVtFakYY=,tag:JJUbt4kgpa4hVD3HjLXGOg==,type:str]",
|
||||
"sops": {
|
||||
"kms": null,
|
||||
"gcp_kms": null,
|
||||
"azure_kv": null,
|
||||
"hc_vault": null,
|
||||
"age": [
|
||||
{
|
||||
"recipient": "age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c",
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEUGpORk5zWXU1OVpqc2hT\nVW5PYlNLT3lKQVpTdCtMT1M3YlZ3Uno5bVJjCkJXR3I2Y3lDT0dJNThCcDN1NXYr\nK3VucjRKU0dac3BtQmV5ZFdrZXkrS1EKLS0tIGRGMGxDM0ZGbzVPTnJQK01GS3VW\nRHpJQWZLU1lrRS9ScXM0L0dyTjhGTGsKJEYq5vKxxYBAgkqUEkBwESur0reNIDPb\nK3rtflNi3dUYYZdLFNFV5rQX5q8aDnM6fO/zYPkzfBn7Ewq3jbBIIg==\n-----END AGE ENCRYPTED FILE-----\n"
|
||||
}
|
||||
],
|
||||
"lastmodified": "2025-01-05T19:35:48Z",
|
||||
"mac": "ENC[AES256_GCM,data:z7elJ0+3r0bWc/H6h4rI36xC7Uj0NS04VssjPDNVZM17LeN4ansSOfcOKPaUMziV/z5Aq8RVLROR+FImzxBZGaZm37frCoN1OP3WjeDnP6AsoY9dY+S/aYmErVEsQEIi8T4RAdQP2c3BUt1oKZ9Nki2pu3IBRabBlFhaTI0bspc=,iv:8Nn8r9ancHwBJOaJSsv8Vj3s+d0UvRmKIeCDNzx1qRg=,tag:BSO2yu70H2wjen3BCGC4Gw==,type:str]",
|
||||
"pgp": [
|
||||
{
|
||||
"created_at": "2025-01-05T19:32:11Z",
|
||||
"enc": "-----BEGIN PGP MESSAGE-----\n\nhQGMA5HdvEwzh/H7AQv+JpNwP+BLJf4+0pSr17TToviCo0yWmcaP1dIUqClBSoDO\nI3ZzqHdImAj4QgExif2zsuzz1+WC+sjvFqEmX5pBKza/e30qCZirkelz9mzc0mhG\nLhTzfhqC6fLbV5f+pDp6N40ommu+LX1pIz6nViCUjqBdnAkCb+tqLU4eQJQqVmlz\n7BToLsvYomPK1nJ6f4rt1nTR9wkBI68AYM/K0SgCJXjwj1LpZ/+3yElkiCqZ9uZB\n1jrDKX+QPySlZ7OERL70UT7Eh8DTUNzFnozvliBnyxe00wwiiucCgrC94TmaKCmh\ni/FOdS6Izm3QwcWB0eMCX6GQBvlUWpjSz5xF4+YODJe9tGNz/sNxpk6B8xG5NuG2\n61nohMHoml6X3Z9dOwu/Svl+eS8SV/r278W/F9miE8YeayyLlPxHF3DXjd6WeDhZ\n20NExQUJYIRf6w/XQPQZ+E39NkIHxz8v+P29ncmSsRPWS6d2MK0Yj+UW0vT0u1vJ\n+lAs24xYofbu5tmBbnK10lgBrZMXDJM2nQbKMKSkVVjzbzmOe5jzMBxuWLX+ykeI\npaj32wQDWvfBqLPH1Kwvy5nqHvy375jPZ7RTzT7W0d4jKQf7xapbi4CEepHHfxCF\nD0HIEi8RUlXJ\n=KVUJ\n-----END PGP MESSAGE-----",
|
||||
"fp": "c4639370c41133a738f643a591ddbc4c3387f1fb"
|
||||
},
|
||||
{
|
||||
"created_at": "2025-01-05T19:32:11Z",
|
||||
"enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMA98TrrsQEbXUARAAqowFMavIniFheNvt03EH1iEn64xNmExotYcDt2L0bR39\nXQdLvg7cJ/Jh7EuZ44mHTs21mpbYIlygMs6kimqQ8iO30vGTEcn5bt/eUEoGHciM\nYVHktWNR81ZgjvKCcmTUK3ld+DMKmg2BABr4auUOYLu4ToSnFb1fv+fvZG0D3iQs\nm6LJuafH+4utM16Vnkp9+ziY/ieMPYfbOFuSFq0UWxGK9P+koSYVGnYhH55Lksyf\nBb/esEGCY671/Jl/qHw8so4TELeRsW/v/xAcNqbE1Msdeas7WJy/B6WqXQgK/Y+J\nPsyZ2XHKhPRitN77/eDJXVBi0mKBTE/RCzDzMYxKA7IQm28v8+u+wpdCajewnyF4\ns2HACaYs/TWRpIUzqxRlznc0nMpk8xUaeVb0N7nrtSDEBF8ETOGOcPk1AmdKMR4M\nsy0vu+K2oJ9L7e/o1ntpejKHN7t2Lzq+CvszBYKmyw/KgxeqY0hx4cJTUDsdgLjI\nMTrs6bySVXDyRaw3rHo7OvA+5c8dLfnWJd1R78nZTx89CYCvjJeMo7PNvN6C9HxK\nJoCOCnZo6a3j4NqJvXD5GNqGSP6m1lqBRWYQUIhWaOfz8aTY1Z3EXX0/4tv5C+A/\nknhc694ujtmBXio4XgDIrSz3jr9G8+ZLvig88xV12HTJfsatypQdHVIZj08EeR/S\nWAG872Q/DVD/aDmhaOlq/o/QBoEyrnJdkRHT9NX8iBboQ81wezfJxWUWlWyHaXVq\n5YBLFQvQAZLz3h05EBkMOiS2dHUa8OnNImj8txnCePAlcUdv7LIVxHA=\n=9APA\n-----END PGP MESSAGE-----",
|
||||
"fp": "aef8d6c7e4761fc297cda833df13aebb1011b5d4"
|
||||
}
|
||||
],
|
||||
"unencrypted_suffix": "_unencrypted",
|
||||
"version": "3.9.2"
|
||||
}
|
||||
}
|
||||
@@ -1,70 +1,68 @@
|
||||
wg_private: ENC[AES256_GCM,data:kFuLzZz9lmtUccQUIYiXvJRf7WBg5iCq1xxCiI76J3TaIBELqgbEmUtPR4g=,iv:0S0uzX4OVxQCKDOl1zB6nDo8152oE7ymBWdVkPkKlro=,tag:gg1n1BsnjNPikMBNB60F5Q==,type:str]
|
||||
shop_cleartext: ENC[AES256_GCM,data:sifpX/R6JCcNKgwN2M4Dbflgnfs5CqB8ez5fULPohuFS6k36BLemWzEk,iv:1lRYausj7V/53sfSO9UnJ2OC/Si94JXgIo81Ld74BE8=,tag:5osQU/67bvFeUGA90BSiIA==,type:str]
|
||||
shop_auth: ENC[AES256_GCM,data:0NDIRjmGwlSFls12sCb5OlgyGTCHpPQIjycEJGhYlZsWKhEYXV2u3g1RHMkF8Ny913jarjf0BgwSq5pBD9rgPL9t8X8=,iv:3jgCv/Gg93Mhdm4eYzwF9QrK14QL2bcC4wwSajCA88o=,tag:h8dhMK46hABv9gYW4johkA==,type:str]
|
||||
sops:
|
||||
kms: []
|
||||
gcp_kms: []
|
||||
azure_kv: []
|
||||
hc_vault: []
|
||||
age:
|
||||
- recipient: age136sz3lzhxf74ryruvq34d4tmmxnezkqkgu6zqa3dm582c22fgejqagrqxk
|
||||
- recipient: age14dpm6vaycd6u34dkndcktpamqgdyj4aqccjnl5533dsza05hxuds0tjfnf
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2ZFBYMHMzTFRMLzhCbnBE
|
||||
MXkreklWSUVOckl5OTJ0VzlWS2tIOFBRRVVJCk90OXJoMHQza0hTSGt5VUphNjY1
|
||||
MkFrTHQwTHJNSGZjT2JOYXJLWExwQTQKLS0tIHlTeVgvRlU0MXA3cUl2OE9tYUls
|
||||
TStjbTBkMTNOcHBja0JRYUdvSWJUN00KtOPBH8xZy/GD9Ua3H6jisoluCR+UzaeE
|
||||
pAWM9Y6Gn6f7jv2BPKVTaWsyrafsYP7cDabQe2ancAuuKvkng/jrEw==
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCTmdrV1IyM2hldloxM3Zh
|
||||
cGVIZmtCZ0FLTEQxcFBLaVh0VXUwNWVGR1hBCnJ6SHpzckh5VVduM0Z2dkh2WHdy
|
||||
WGxRV0JFZTdqcWgzUFlSZkowZElJd2MKLS0tIGxYL0orSVdmZzJBSEIvRUNDUVlK
|
||||
RWFLOWp4TVJBM3llS0lmQlBUQ2ZQNkUKEz/dXR0tkVeyC9Oxai5gZEAhRImdL1FL
|
||||
2LdVRiCt3MqR9wtfw1/pR7166Bx8nLIN42uWh2YU5j0/0rXNq+I6Qg==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhc282T2VVamFGcG1Ub3hp
|
||||
S1VwKzVsWW1sRXczZnRNdkxDWE5Sd0hhVUJRCkovNGZ1ZlN0c1VyMXV0WThJMGFi
|
||||
QVM3WW5Eam81dWpGaFd3bm80TmtQSlUKLS0tIFFSUy9SYWdKeE5KWk0yZld5dDYy
|
||||
QVZyNWVOMTh3ejBha21Qb2xCRkFERGMKH9nMQUoS5bGcLUx2T1dOmKd9jshttTrP
|
||||
SKFx7MXcjFRLKS2Ij12V8ftjL3Uod6be5zoMibkxK19KmXY/514Jww==
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoQW5OU2FiNStkazFRRHBK
|
||||
U2kzNkpWRDVQTDBkTFFNWnREcjh6NlhmRnhZCkxMYlZhcUlGUnN3QWFzbVkyYlpX
|
||||
eWZaOUxsUCtZYmx0U29ZckFaMjNLTFEKLS0tIExxV0REL3MwUTZpMkgxYlZMc0JS
|
||||
cTNEYTBGT3VRaDI1eUhucnd5d2JhTWMKNZlkUjxX2QTFoiCWPzz62jz4kK8d5rW/
|
||||
MJ1w69Qve7lsUAg74YlFF7i/yYSZZkHoRMs92lRmq3lHlbK6aaUMTw==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2025-04-14T10:34:55Z"
|
||||
mac: ENC[AES256_GCM,data:vcDXtTi0bpqhHnL6XanJo+6a8f5LAE628HazDVaNO34Ll3eRyhi95eYGXQDDkVk2WUn9NJ5oCMPltnU82bpLtskzTfQDuXHaPZJq5gtOuMH/bAKrY0dfShrdyx71LkA4AFlcI1P5hchpbyY1FK3iqe4D0miBv+Q8lCMgQMVrfxI=,iv:1lMzH899K0CnEtm16nyq8FL/aCkSYJVoj7HSKCyUnPg=,tag:mEbkmFNg5VZtSKqq80NrCw==,type:str]
|
||||
lastmodified: "2025-01-14T12:41:07Z"
|
||||
mac: ENC[AES256_GCM,data:RJ4Fa8MmX8u8S3zrD/SaywTC3d2IfHQPBDy3C9u4GuXJ/ruEChAB1kN8rqMPvkmET8UUgHIEp7RpbzMtg/FOmKYKYTTx5t//3/VozvAEZurhG/4mnN3r6uaZ0R9+wSjym8IyOKsJ7p4XrfE5tRdzNyU4EqfkEiyf+jO751uSnYI=,iv:eiTdmbcrpUvyDPFmGawxJs/ehmD7KqulaoB+nfpC6ko=,tag:+TKr53cFS3wbLXNgcbZfJQ==,type:str]
|
||||
pgp:
|
||||
- created_at: "2025-02-11T18:32:49Z"
|
||||
- created_at: "2025-01-14T12:32:13Z"
|
||||
enc: |-
|
||||
-----BEGIN PGP MESSAGE-----
|
||||
|
||||
hQGMA5HdvEwzh/H7AQwAmorRyo7mguHQxATRRuKstaXertmyz2AhKFr1Kr880vBJ
|
||||
ODjEKmkH77wIpOnZjOYrx7j2JWosoJ1KgsUUh4VlAPM3O6cXVwqDucu1d8O/HzK3
|
||||
RPuPfTKDr/lKl7QyQCx5lQuxE1/qn88D/g/fMQYu3NAVJa7acpTdSsfyo9nZ3QMb
|
||||
ly6YEyGDc/IhBy5igc7bIWy1o+XATmyUxA+jZVMLiBKhetogMC507Eq71tUCMEht
|
||||
CItRoFFPeoCzC8JPjpQNQmXoe5WDv3hzWpUBRJgjScYz3JuEfakbsAnzrPc41Mga
|
||||
yPhSPYPBtHlEt+DntW9i/CFLEJ+I0V+uz3gnNtNdHTIIe2AZbGympjZldZThldb3
|
||||
Tupo7ep6VQgi+hG37wLmQdvSVWR8lVJDMvOmV9xZqdFYfQdBr2gewTT6Y2QCc8GZ
|
||||
HBtJASlpIbydd/rtLtaTwtdOz64g+F5Vw/6T3ciyExt6RCoPALqZCoyzQnvnQm7e
|
||||
JPPauAs8BH8ejoDlJYjK0lgBBMSJTZ2xlGYh4wG8zmGtGok2wvXYy+DeqlXuCIy6
|
||||
7Xu4BLTL9eOZZo0sPR+RQfYbII0zMIc2fPBtU2c2z89YOTI44FI0BVbTlhLIIXXz
|
||||
NJMDln08MWwr
|
||||
=hhKC
|
||||
hQGMA5HdvEwzh/H7AQv/YM4JBfaFngZt0SmMP3fBCodQXWnWMjy5VYoTOKKaOfG8
|
||||
5GRTf+o1stsru3EKImh5PTqniRO6UH+/DOKBY8zHsy9lXojGka3uPJRKv7JUD5YO
|
||||
8NjlHwwg+jcQN/qtrWc+1D69zR1aO/6yxfgujL3r/fJ4reqtSNfkVYVy2lEcw2ZN
|
||||
zhlN+fBxZCyHyUTKLcXrG7Fg8BRudjwBnIsBTLAVFkWg0bnlq38vicGpF5CHsRjA
|
||||
cTPq2D9ev888WKHcjFcXYqxeKkXkqBuOOMlCHQyJCv8HHfA/GY+pBQfiVmvSt77O
|
||||
/MA8hVYl8G4tRFsbUdZzqtPbAsLy30w1e9dpsD2M6tD55V2RNUCrznB2lo0uXZ24
|
||||
9MUnad+NQdntbe5B2OBUF/MNKZ9/tC+B9pBm7Tx3rxSELytGuQF11x4EyLwn+Ict
|
||||
iBBV5P3RiulxLW6MbDs+7JPILfcMfg6e8q+GY1dnIPZrs8Qf5W60FxbOYYiMvJ9k
|
||||
UtnZAixVdlpkAsQz/t630lgBX9DLYjEVgaxC+zqtRjfHkoyvGIac6cgHDX/fBs7p
|
||||
Woud0RbwffhOhaIF47Z2W4UPfn5Mtcu63fQpjCM9urk9asaRPeNDTeEYVjqSZD6N
|
||||
J+o9dahBHvIF
|
||||
=GKm4
|
||||
-----END PGP MESSAGE-----
|
||||
fp: c4639370c41133a738f643a591ddbc4c3387f1fb
|
||||
- created_at: "2025-02-11T18:32:49Z"
|
||||
- created_at: "2025-01-14T12:32:13Z"
|
||||
enc: |-
|
||||
-----BEGIN PGP MESSAGE-----
|
||||
|
||||
hQIMA98TrrsQEbXUAQ//cBdyq4JxOhU9t7Z9iWAp2DRObgv7HMbhIXh1351wuzA7
|
||||
Fe0Kqcoo/ekCkIPrLZOC5z4CMjXwOCPSncMMm5vK5ibixTlX9446+Hv7AQ1vq2Nt
|
||||
2daL8ZzpCeCJmi07Vyp72/NJOZYa6YY/gFiiRw044lNLFS//b0sYkipne5COjvca
|
||||
I7BxWCpGwLLWZ7LNKhg6i0at+0AqEdBDiwSE7jfeY6IL9tPOIqmBxYIWMbiAkPMd
|
||||
/nK8PVPrt41NkJkuxfjXcYowJRcJmAYHGiRUQaAkUZyRQxmolbLwwJ+/CVYxv5Kk
|
||||
hN5QvT82z5I8gK5LXrt3ZGEcC9dADkRSQr/qcWQT+CEnsGZi8b0unwUZZruDVb7d
|
||||
eIwICaXu62gH/mlJN1z/J5jEciwQtC9Eh932x5qY3sdtd6Gm7/EHTf9NJ9Zg3gTk
|
||||
nfytwpfUmtJO/bI5RvYSUkXkU6CLY6bqRW12+YrsAP+vDITYcLVEJGt7jrXDFto2
|
||||
Z9rlywZsQiZhLrzi1UImCTthcceI6Hd7l3TOYV84gMxdahBo3FLKnoZRK2I7ukGq
|
||||
Wi0KjajcsJ6LBUCCpMg/tW+TT8/+66QY9BDzcv/hBdRc4lCKNeKDwwGFPSFZCcib
|
||||
uyT8UB6iUYVMiNSHRqdGGcH0NwH45Oe2g9nF/lrJ0vYw1toN3WSpEc5v/Nch8DbS
|
||||
WAE3DazXQgd4UQ19q+5cC+L5POWcAjgWpZlRwBXBRdeOKFDF9maCPL6MpfMm6XG1
|
||||
/JNfzhipjL5OXgJgK7iUFJlH9AuD18g/by7yID0bTsg2fkfLglwjfm8=
|
||||
=Sdch
|
||||
hQIMA98TrrsQEbXUARAAmD4PfLpRVUXTo5yyS9LSs5vmEvnCmNc0ad4Oiv7YAxhs
|
||||
W7SCKHq2zOfGIeZZHP0wjRnJELwMCVLy4dVo/slDHCiy8T4MZXaYR04ZaJJ+OHrF
|
||||
e5xxAA6FjipufvxgRZvLhDj+g+RaX2TuxdL9gFSVS81rvEpSRDnydt2O/6G4SGBR
|
||||
GO5b176eMerrqOqRLL5Ou4b6oitagvRwZzOXQ+YonKZz3STlyXRMgWxeFTDK9T/q
|
||||
yYOwPVAOU1jhYzUjHNAYCp3CH4ERScrO7AwomAWH+Fe48WRbg2ebdqRnuv/Vl4PM
|
||||
wc5DQcCIIIIENMGIYOzUo1KrfQlevzXF/mbgAgo/uVuRl3Y3lCRAcZBQOtUCF5Ap
|
||||
FhsO87EMXlZWj3bv08f21t3hQztfuaHIqFpCbSIGgmiE9cAY0cOtCYpJfCYdV7iT
|
||||
cOElJgYRbAsAbFC9wTQWEvwIxrgnCIrkCg1bzP5KNLG1K+ae5J7qN77qeTQw2/ul
|
||||
QDDUUNnzjes562t+/xFLQa/bust1Y8pAYn1s1LEBol1hLX4Igonlkw303UPjZOI2
|
||||
MyH5hOh0hNUReuOpHpre/pYquE8Dd27XKAHfJsSd3ZLJG5+1Msw23lIsptgovNrB
|
||||
5VRvPj8WPojiDHqN27kt/IuayN3TeoJFjmAjkoFjlyKTcs+b6cDkxUw3LcP+6NjS
|
||||
WAHQI0pWTa5zD8UPow4DHxteP4jW/6ddBfJ1Vz1scqKMXYvxFkRqZvn3uAJOtcuw
|
||||
CgQ4CXE43n4G7g5gvWl6ZFW8tdXR7Sw+USnHR/9oS9fV0rHcxxDFEfE=
|
||||
=9FN4
|
||||
-----END PGP MESSAGE-----
|
||||
fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.9.4
|
||||
version: 3.9.2
|
||||
|
||||
@@ -1,31 +0,0 @@
|
||||
{
|
||||
"data": "ENC[AES256_GCM,data:H0oMKUXc6C28tHMwSgsppcdfYKEknPIIWGq3Mwk=,iv:lExcGcA4bvwKtqeeG4KS87mWlPBtCSSpOunJMZcQG+Y=,tag:F6Pke7woX/odRT7SMJwVbw==,type:str]",
|
||||
"sops": {
|
||||
"kms": null,
|
||||
"gcp_kms": null,
|
||||
"azure_kv": null,
|
||||
"hc_vault": null,
|
||||
"age": [
|
||||
{
|
||||
"recipient": "age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c",
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsdlQwRFZLZUtGamszckt6\nNmFoZmk3U1JpM3V6MkNZc2Iwd0VlTDJpekNvCkMzVm1qNEYyNEZmQ1o0TG1LRmpP\ncUhiWlB5ZTdjZnBHQUxVblA2V2s4WVEKLS0tIDhiUUdla09WRmR6RWZnbE5XRDAv\nWVV0WW9wMWsrcjdsdkF3NHgxMVFmRDQKeUAVQU/M1DGfAmee6CFvyTr8RkRBWjYk\nK9ceXyJSojHktwr/Xllm1mMm6H2lPbzba/JAyt99YVTD8xO056vu/g==\n-----END AGE ENCRYPTED FILE-----\n"
|
||||
}
|
||||
],
|
||||
"lastmodified": "2025-02-22T18:09:45Z",
|
||||
"mac": "ENC[AES256_GCM,data:5IGtFkE5sGjXJXlXkPdN4e15gxh6QB/z1X5A0149koG3fvOPnoLPEU+DGx1qj9Z/8vilJat1hk7qIBalMPMCn2/T1PIV45Hpvih/kNoszkFMQ9r0EsZMgXgSJClHSg1JaiCiC3LvjsIWHDoESwVx3fqos1ClOLtrzKwptCEUp2Q=,iv:15QS1AwpuUr+EMw5YQe8ogb1Y58nQh4WcFjtzuWtcUQ=,tag:vL9cZRdsPCqaTw42pzRfOw==,type:str]",
|
||||
"pgp": [
|
||||
{
|
||||
"created_at": "2025-02-22T18:08:13Z",
|
||||
"enc": "-----BEGIN PGP MESSAGE-----\n\nhQGMA5HdvEwzh/H7AQv/WtqMo4CAW5VEqo4vEL7Lj9Z/OY1h0zPF/bdkc9u6x7IP\ngqH60j9iF3n4ae717c4eKf59iN4+4tDk51qb1XdBOw1scn6rTai6KCnqNhiGeZF9\ndKsCZG5LxdbGkEFFw0Q+6W+gV6MiGlD4SBiKpjAsGVGcn42wygfTzpFRRA2Pmlev\nAGSUs5TDmi1IqQsvzYBMBM9+6sdsKhpRalXGS0gFz+wYGPFlK4E1rd6CBKRYEWtw\nm4kRe0nA2Sk4XhVZ39nPtR9rxrhB+d+Qq7AHIqD75SoY8vI+o3UyJ5Cee5MAmMcd\nn0EG24OeThF2p4lZw0iuUgtefqkc21/MoojYP6tfS7s0vGcq9iFjZ8PgUv3IKfrZ\n9EwresYfvhKbocZj2ywPK7iavFCYmqpTzbloGkO0AVfmHpWZRpxneOaGruCwFmGg\nF3qBVTcBSBDF972KDvm/TbKV5NQmRAZuXTrTBh6vgmVcaLN8LTLP3xRQlY28Ng2P\nY5l/5sZ1CGvhfv+G/24n0lgBF7I8pMTfsUEttzPONEY3pRaYyprYxdDlutHI2Kzp\nl0oPBs19rCSn79avQr5fE0mIvqJCoB5HVPkUDjNTaMNSJAywjQEWNITh2GszRTku\nBDvnzA2VnVww\n=aFlN\n-----END PGP MESSAGE-----",
|
||||
"fp": "c4639370c41133a738f643a591ddbc4c3387f1fb"
|
||||
},
|
||||
{
|
||||
"created_at": "2025-02-22T18:08:13Z",
|
||||
"enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMA98TrrsQEbXUAQ//bap7Q1HvJJ2KjVMhklTaQ2LG+TITzh0jvaRSXlXG+u5a\n//iWLTov8CH6s6e5I/T7FtslIcBVmyUX9vL9tCgVNMHy0RVG9mmykS0z5/9GY1tY\nEDcOOINQwrmuhWFHvc+9hzKEbLH7heR3ljMw9ouzBgFjEUdhFKJCIW9xrY3a45ue\nwBfaVj0tPNFMq/f/Zu5dDvw6gmYp9ziSMh3GwLNnMBmQDgdSjZJWQr+oa7KKSOM4\nu8ogeqP5Yyf7vDj1he+9TJpG8fdE68boYban9t9rfnyf0cRW7oHkpkwPtKvn9U4c\n4Tbl1RUqfHsTpHX+rxP8w/zgaLbrc0hJO1zxXeeQTOlS/0S1+i5n3pINFwzNXNBE\nIHgIpqOKabfpDFsL/DMIdNQZyr/iD4gHjzSeQPdyd0/4dbFMKPsVzA3JomE9z8NW\nRXz9Htb4Z4fybcPDOLxPkyM0qsEtdfb11U5l7IKuq+2ED5zOFxl+qhZrFz7vY1R7\nyaIM70HUeVCT7p0KZmWgtzjhafI8kTS2Qd7VjIF4Y721rB2opqaOKaCWjp4eeYI2\nE/TGivgRl57KgSF8Y8ucoC6ndsxwgJ4dYt3fos09Rbv1qFrlJftyD7m2kOXnPx5N\n5/2R4h3tiYQqGm727bjTjmGUtxToum3rY4sO0y38Woc+4BK3h/gj3AMir8DI7MfS\nWAE+yxIZH8y+c93zkZy34mEHafc6zPFD3QWuzbXzMGP+EMn710zaWmrVV1X3oLKW\n8lFB5sEX+BJaDgISOG7vgypNA+HtWZnRcB1CnzxboADE+HVAU3d+Bpg=\n=rfB5\n-----END PGP MESSAGE-----",
|
||||
"fp": "aef8d6c7e4761fc297cda833df13aebb1011b5d4"
|
||||
}
|
||||
],
|
||||
"unencrypted_suffix": "_unencrypted",
|
||||
"version": "3.9.2"
|
||||
}
|
||||
}
|
||||
@@ -1,31 +0,0 @@
|
||||
{
|
||||
"data": "ENC[AES256_GCM,data:dsb1hdpeoH1Rc4Cz10cZMlAKL//GRUKQbTXvGuRcVqMtRVkmiVZonogj1FdpIFOY8m3zIuJKLpQp9i/RuWanRaThyOA4Mqo82N0MTkco0mwLfRhxqA2EbRv1dPgytVQvdNgSrnZI1FXtsQumPgO4KvifwaCG+Wu050NhPDC2Xt8i1U1TyMTkTigk2CKYaYgo+D9xSsA9ymjFUQgvnTn10t3di7cUJi3rBoEiZeOK/EAg1Y3h53AZ4p9SyG1kBflTvtE1NbIZNBYAiFkJNbIhT+Dw67Qv2Uso6oxL/I64IDOljMQz2874wZqpAL1w7W671KdlGtq0murjQ5Sg+g8RYseA1NVmTY7BCaGagNQuU6Ab0BSSdzIuDkH14BL1zGgprCqP0CE8WeWdUzCx5qud9emF24d+VvRKIiawTArSBe34VMnRq05OTKdmtwGZom7kbhD20c1/pwhytiJpzSE08iKy9cYGPGfirNJaxhT7z9XqSoECUg2XPI7Deh75PqoxM8pATLtOtOLp2cYSr2vSrqADMXzmR2M9ixEj,iv:RQH+e6ZADH2XMPqBeuHhMhHiksQg2iR4NUnYhD3pj7w=,tag:wJByTCrYf4cKxJaD2eTCMQ==,type:str]",
|
||||
"sops": {
|
||||
"kms": null,
|
||||
"gcp_kms": null,
|
||||
"azure_kv": null,
|
||||
"hc_vault": null,
|
||||
"age": [
|
||||
{
|
||||
"recipient": "age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c",
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzOS9jMmZoNWxrRTl6aVFu\nSW9oTTVkV3NiSGpDTDJNT3dmUWNmSURCYkZ3CnZJNFNEVTNWNEpvcS9NRjFTdExy\na0NNeTByblA3T0JFRXJacHlFTmRPcEEKLS0tIDJCa05LZHo2Rk9xek5Ec1hDODNQ\nOEs1Sk5YbTNHZGFtcmpqaDFKdzRpUVEKiUhTrGp4rXW3hHd8HueZ5v31CXpMACFT\nTq2OaVXUW7yTLFO2E405hQH2ZLS7KzkXeHmA4MZfbsq0ZkriXp956A==\n-----END AGE ENCRYPTED FILE-----\n"
|
||||
}
|
||||
],
|
||||
"lastmodified": "2025-02-25T16:42:28Z",
|
||||
"mac": "ENC[AES256_GCM,data:iJS4wLJwJZRUozNBUBxL8wYOneGI1Et3r9+DtIs3JrQLEKV16n2SeRP0jRFyCO7VNkxyjnjXJwe0/GVbxtQbVCuDFaCWVpj4xNiEH3wMeuydU96E2QgHaWJGvhyj5e/5o3GO85DeF2ueFCa9DQKtTIWH1xPfqJwtZC2PGH5Uqyo=,iv:/TpULYHxSgFfMQyv715jLVY37AhSY/qh1Zn00UN8oOw=,tag:XrOn8ZpgWFYtSjatXn8sxA==,type:str]",
|
||||
"pgp": [
|
||||
{
|
||||
"created_at": "2025-02-22T18:08:12Z",
|
||||
"enc": "-----BEGIN PGP MESSAGE-----\n\nhQGMA5HdvEwzh/H7AQv/dMSVIuM4gsG06tcN0NvWQgZUO6E8u2M3k3kUU/xk9bem\nSJFtHluWx26V6F08PP5AoDQ1R5Z1RhP7w3JDjVyscb0WuUzDFVTbJLpuPJIX+MOe\nhz8OqLatn24+fK4eMnQFbTELYRPEKicMmoJrFaTXdUOLkynWtxijzRlCif8J1u3e\nqj2fSfPd4SI9ERiGo5MBtHA9A6nwQvboMdnlGvvlAxFF26QL0xqu8jUdllfJ5IT0\n7y3vbGixV/M29MKzt+cJk7Wnb2y5UaZdelsDmxmm4FrIxHaQrAb/kIMiwf6zVCwh\nZFvNwcAPirduvxpcjOV99mJQ3v02mWo/p4Ey3PCwRb1tQYRxiMf7IJ/eAspmiI/9\nwK/2c6ehtBVXlw738JjA+WP36u+5S7CrvzNk6RLd0y76aNvGB6ZCT4rGm1B2DfR5\nguP+RJGcMFzhv55hQNCNUHZ2jvhLvDvSaCjlOaJZBC62gCygtlDqaLtagIO6RwKR\nJdatJCEjio5yD7x1d7PY0lgBVlbkXk8K3e5CN4RdLyoZStShW3uC6dCUGG1OJzPE\n0mfW5y683CcpMATeucHROtTxxrmp+BT5CyP9eBA/CrmTAJVMaWYM/Tb3+nE4Feal\nKlamR+tLaZdj\n=9/53\n-----END PGP MESSAGE-----",
|
||||
"fp": "c4639370c41133a738f643a591ddbc4c3387f1fb"
|
||||
},
|
||||
{
|
||||
"created_at": "2025-02-22T18:08:12Z",
|
||||
"enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMA98TrrsQEbXUAQ/9FH3RHkKEo88HEAXYPfJ3tjctUrn6Y1muzgyilfa9R7OC\nBNdSyXP8qU9FaIEEO9cwXKY6hB30l/b42RwL2HS5MWlNZTXZO9XCjV4VpmkIy88y\nkVhxdb2QbGQSBqmfyc9GOvI2LN3jIAE5fy5GuDREKRJPfVJu6x7IbC4j3tT+3Szq\nzOTF+ZfuUlM7FDzt4vAvP2LeOZxYKCg1va6ne7rtXsry9cIotP7fTqm0xPLZ/K+2\n/+HhC2585GdUXratqod1VfUPGyvdyhrn6WV+BAvUA8O8LYO5ZIkgz16vp60XNZEA\nCkjy/kiSlMorHiy7/ZtWHwWPNQbGxVJ/u6XurgzreDT4H5FvfyzvdKTz7IGYNYfZ\nvwMtQDEd3ToP6QUyNGfpZ5eRGb3I+8xNOd3z3XIXYGFYAOPHriGXMA8Y1g21f+c8\nz0QxXXDNXlTt6qdpumfgF/d/UCFJZeuP2t+mVnnp/gkK6yKZlUHD8L8XjkgumxB+\nvFFKOpPbrO+H+L375xZp9OJTINF5QTFkrmT/jPoexCkx9koxNhM0vIKEFE7+gFsW\n5GKQqz0n1HQgbFfdm2Jk7WQqY8r0weGedalYzkfDPlbS0AdCB9Llk/vwu5Tf+hcX\nIMbph8ZwKLzld9MzEplhHwBZ/Gz0Upp1IYj5Ifr50EnlHjBJ+Z8xXWKshJ/6UerS\nWAEiuOmlWRFGWRM5EdrXwh0/dj+ZyXG7unsv+jpNXjOE8eznaH4Kd9/PEmxazbFX\nJ1gtX6JFy+HXID2DJmXng6NxCzPWpo6prAH9IbMebNVQMzbl03Dtyec=\n=WoeJ\n-----END PGP MESSAGE-----",
|
||||
"fp": "aef8d6c7e4761fc297cda833df13aebb1011b5d4"
|
||||
}
|
||||
],
|
||||
"unencrypted_suffix": "_unencrypted",
|
||||
"version": "3.9.2"
|
||||
}
|
||||
}
|
||||
@@ -1 +0,0 @@
|
||||
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOFRuQZweX3r9QQmAFo6oYY9zvrf9V3EIJOl6kFMgyLm kalipso@fanny-initrd
|
||||
@@ -1,31 +0,0 @@
|
||||
{
|
||||
"data": "ENC[AES256_GCM,data:16SwZ4RZ89+TvwPVgEg+96PmNd63Oai1GnrRipLkxQmzfeAkQvs78emYUEVT/ouAnRFQRNagbhjA4nmfTTq1xGz1u8bacjk1ny1ckd2FmkEOQ7Ry181h8UE61rZP3c8yra2WCgOcsL22oUxUMhg6iswJqEKLImi3cmJ+hASPTc6L3vlZLcP3Vx6FEbDMGrVtfpHEliSicB/rkAOnjVHmxHmVRjx1AI7jfAjCoBGnLwI9X2XREGay9H8Kt36HIhlXA9dK+xkl6WdtkllHIHe3OYHqwd730g+1htMAWtHmyI/DPLLJG48pzITnKv3cQ3aaziUWJGa89WGnBuzxP8ZOagpnC1/wQi1WTR7d/4JYoslz06fCt1ouGT4ttDFh/YqbV0hcXqkASbUnnixicBaYeVrwvSkYvlbwToZ6L+Jc+eqQRrTKXxs5pIZ4qkvImDp85v3U1bDxXT+qhpK9hasmgBqgM9GYjgw8Um/imr9HqDp9ztRsij87mRW/l47vUhxRjrAWpv+J0OlptUIpRiLv,iv:7x+dTHtSbcc47X/ZGz/bcnOxkGDDBu33ZgNrOD1FwDA=,tag:B6s1Jt1KFCitya9oAKvp9w==,type:str]",
|
||||
"sops": {
|
||||
"kms": null,
|
||||
"gcp_kms": null,
|
||||
"azure_kv": null,
|
||||
"hc_vault": null,
|
||||
"age": [
|
||||
{
|
||||
"recipient": "age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c",
|
||||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIYlgxeXQzNmtEZXZXNytp\nTnRTRi9nRHJ2bEdPVGhPMzdMY1lPOUpGckFFCkJkL3BVSWlIZ1dBVUliemFWNXl4\ndU9DamhTRUp0aGVwamhWUUZJd3dUREkKLS0tIFNkaGNzc1R5aGxxZWV2QytaRFIw\ndC81MDR5SUlESnNQRlhuR3doTWhYL28KMIMs9mPwVuFr5cEvO6goqf3zQALSO5BB\nrY0C8TfkHLvV57999U9kfyLO7Sm0R/RGS4IinQSCRQWEeR+qLxnEWQ==\n-----END AGE ENCRYPTED FILE-----\n"
|
||||
}
|
||||
],
|
||||
"lastmodified": "2025-02-25T16:43:40Z",
|
||||
"mac": "ENC[AES256_GCM,data:dZJc0aqSD7dhe4Egih3z8QHIbwYDCGYU0DaOczkqHd/yMdcVNrNrcIR6yshArqCLl9jj5Zw3fIO75X09mvuvUCyszbjQyzSmTACp7K3skHuDRJ/yh5vaw6XNeJ3w26Dimfd0WfL1XC519DW532icrDiy2lCZ1qdcYwpqQUBKM/Q=,iv:4vx48jXxKLDOKfK6yYJWW28UaKl+EyqjeRAzV0WayEk=,tag:oO4cAVAv7N5aDAmK5V84mw==,type:str]",
|
||||
"pgp": [
|
||||
{
|
||||
"created_at": "2025-02-22T18:08:12Z",
|
||||
"enc": "-----BEGIN PGP MESSAGE-----\n\nhQGMA5HdvEwzh/H7AQv+P8Y3rBJAAI2orY71hRSpCAJo/x4CUColQZf9xK4ZgYQ3\neW/15avJVso26mYiZJsTPaEczJ89igYKDrf8Ewi8NNNTmse/BO+BG8KX13QOSWKb\ngiRXMl6zpQwH/cmCXvUrDczjcUaG3vMpcWClfd3lfjEStVEzNB+OKCuRLxhKGYPn\n3HZ3Ypa97ei8uHMKbnloGigUouVKVCCLIqyrJCybQ2+UkOMzcMJpO96RMooWQOUJ\nU+0rLS2s3r8UnwQjEcedEITlmiTlZkTrUnUylcc22v3yVJh3UExCcoVWShqPUE2j\nJv667rq1EblbIzn/8vyMXxOoSYmrLJ+hgh6OXio5bbMUwd/7m6Zz2jEeTXbJi20/\nEl2V0Lu4pTWXhXxh+Y0MIdh2tHMGGWmHBk650e0M/JbnchxK5+9GblWkfzMV8scX\nPpDScHH+cqNPIsvtq/aYGSv5o2u5JfndEuW16cWU99mgYvX7rwwbRbI1zWVX5o9o\nQ6dqJGZEbtE0QilOKxiI0lYBTrDySzaWLTAngd3myVMvFBQ/K6VL7mXwJvDYgOcJ\nxHIExrd191e5eLr5MGQAzXaVietENN27aEDPw5WV9bmXoAKp/4muJnfOB/wBSjCw\nlutnbF0yLg==\n=MqvI\n-----END PGP MESSAGE-----",
|
||||
"fp": "c4639370c41133a738f643a591ddbc4c3387f1fb"
|
||||
},
|
||||
{
|
||||
"created_at": "2025-02-22T18:08:12Z",
|
||||
"enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMA98TrrsQEbXUAQ//UvOmGlNKLrRg5fXmc/paHF7YVFCGuBa0epuiVsVkS6NX\nQoa57oBJS0y22/dh/fb8Nu7/bMpa9XpPwfgzqhi7+5V/y51lvAIKmrYqNTnGdKB1\na9aiX0yxK0d5Yh0RK+9/2Q+369152mZXx+9Oj3SM8396bcfvTFX4jbhGdnKPqalW\nB1OO8HfYFAu4yl11uVD5cHSdhvXKJOa/GZPkb3TK2kicUdNX3HnZJ3PPGrkOy2EU\nuwFOIVIdNp2MUDFW+V2Nso/NiGcR96uKk5ZhGJaYrXjDDMNHyoLWc0d8wEg3n1Vw\nXOSNLmkSFY39ExKRWu8sijSyZIYN+Ul4t4WdO1Puop01xGTfAkYVQOLC+H4unu3q\ngboyNZCSuZXgG02B8ph/tLlAQ78d70YAf0nxkvzQB6TTNfQ4nyp8QnUJDkwaAnvl\nxDqDDhJBjlfIpqNLT23caKqgt1hSLv3Gcb486D8ZC+6nNuefCsxop82FaUMvL1uf\nWPMcAxMyv4REO8l9V5CDn1+6i+iPyN/Mo+hpwco+sYNZMlSs9PcNKILWZg1gv6q1\nU04IyEPym9VkI1jFte4dsljlp3C2R+l1Ikv5OB6dNpnnMVnTgkDwE0vqvsSTIwbS\nYvFoWBAsRlHMFLLfA6QjRyZpWemHBjrpaqBbIJEkZQnKM1IWdIg6cGOx+mFo1MzS\nVgEePpJj/PECZpH9PQPlv/FrkHa7zC/Fi0BOPposmuQgOUTq3sA5TLYNqPOH2Yn9\nHeQCGXpIeM08Pa3BOQRWDYM2vZPZpf3cBB7VK9zmcGEdE3NZxoBG\n=p1XC\n-----END PGP MESSAGE-----",
|
||||
"fp": "aef8d6c7e4761fc297cda833df13aebb1011b5d4"
|
||||
}
|
||||
],
|
||||
"unencrypted_suffix": "_unencrypted",
|
||||
"version": "3.9.2"
|
||||
}
|
||||
}
|
||||
@@ -1 +0,0 @@
|
||||
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHqp2/YiiIhai7wyScGZJ20gtrzY+lp4N/8unyRs4qhc root@fanny
|
||||
@@ -67,14 +67,6 @@
|
||||
};
|
||||
};
|
||||
|
||||
zineshop = {
|
||||
type = "microvm";
|
||||
network = {
|
||||
address = "10.0.0.15";
|
||||
mac = "D0:E5:CA:F0:D7:F1";
|
||||
};
|
||||
};
|
||||
|
||||
testvm = {
|
||||
type = "host";
|
||||
};
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{ config, pkgs, inputs, ... }:
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
@@ -9,7 +9,6 @@
|
||||
../modules/sshd.nix
|
||||
../modules/minimal_tools.nix
|
||||
../modules/autoupdate.nix
|
||||
inputs.self.nixosModules.malobeo.printing
|
||||
];
|
||||
|
||||
malobeo.autoUpdate = {
|
||||
@@ -51,8 +50,6 @@
|
||||
};
|
||||
|
||||
services.printing.enable = true;
|
||||
services.malobeo.printing.enable = true;
|
||||
|
||||
services.printing.drivers = [
|
||||
(pkgs.writeTextDir "share/cups/model/brother5350.ppd" (builtins.readFile ../modules/BR5350_2_GPL.ppd))
|
||||
pkgs.gutenprint
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@@ -20,6 +20,11 @@ in
|
||||
default = true;
|
||||
description = "Allows encryption to be disabled for testing";
|
||||
};
|
||||
legacy = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = false;
|
||||
description = "Enable legacy boot (bios)";
|
||||
};
|
||||
devNodes = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "/dev/disk/by-id/";
|
||||
@@ -81,203 +86,220 @@ in
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
networking.hostId = cfg.hostId;
|
||||
disko.devices = {
|
||||
disk = lib.mkMerge [
|
||||
{
|
||||
ssd0 = lib.mkIf (cfg.root.disk0 != "") {
|
||||
type = "disk";
|
||||
device = "/dev/${cfg.root.disk0}";
|
||||
content = {
|
||||
type = "gpt";
|
||||
partitions = {
|
||||
ESP = {
|
||||
size = "1024M";
|
||||
type = "EF00";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "vfat";
|
||||
mountpoint = "/boot";
|
||||
mountOptions = [ "umask=0077" ];
|
||||
config = lib.mkMerge [
|
||||
(lib.mkIf (cfg.enable && !cfg.legacy) {
|
||||
boot = {
|
||||
loader.systemd-boot.enable = true;
|
||||
loader.efi.canTouchEfiVariables = true;
|
||||
supportedFilesystems = [ "vfat" "zfs" ];
|
||||
};
|
||||
fileSystems."/boot".neededForBoot = true;
|
||||
})
|
||||
(lib.mkIf (cfg.enable && cfg.legacy) {
|
||||
boot.loader.grub = {
|
||||
enable = lib.mkForce true;
|
||||
device = "/dev/${cfg.root.disk0}-part1";
|
||||
efiSupport = false;
|
||||
enableCryptodisk = cfg.encryption;
|
||||
zfsSupport = true;
|
||||
};
|
||||
})
|
||||
(lib.mkIf cfg.enable {
|
||||
networking.hostId = cfg.hostId;
|
||||
disko.devices = {
|
||||
disk = lib.mkMerge [
|
||||
{
|
||||
ssd0 = lib.mkIf (cfg.root.disk0 != "") {
|
||||
type = "disk";
|
||||
device = "/dev/${cfg.root.disk0}";
|
||||
content = {
|
||||
type = "gpt";
|
||||
partitions = {
|
||||
ESP = lib.mkIf (!cfg.legacy) {
|
||||
size = "1024M";
|
||||
type = "EF00";
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "vfat";
|
||||
mountpoint = "/boot";
|
||||
mountOptions = [ "umask=0077" ];
|
||||
};
|
||||
};
|
||||
};
|
||||
encryptedSwap = lib.mkIf cfg.encryption {
|
||||
size = cfg.root.swap;
|
||||
content = {
|
||||
type = "swap";
|
||||
randomEncryption = true;
|
||||
boot = lib.mkIf cfg.legacy {
|
||||
size = "1024M";
|
||||
type = "EF02";
|
||||
};
|
||||
};
|
||||
zfs = {
|
||||
size = "100%";
|
||||
content = {
|
||||
type = "zfs";
|
||||
pool = "zroot";
|
||||
encryptedSwap = {
|
||||
size = cfg.root.swap;
|
||||
content = {
|
||||
type = "swap";
|
||||
randomEncryption = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
ssd1 = lib.mkIf (cfg.root.disk1 != "") {
|
||||
type = "disk";
|
||||
device = "/dev/${cfg.root.disk1}";
|
||||
content = {
|
||||
type = "gpt";
|
||||
partitions = {
|
||||
zfs = {
|
||||
size = "100%";
|
||||
content = {
|
||||
type = "zfs";
|
||||
pool = "zroot";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
(lib.mkIf cfg.storage.enable (
|
||||
lib.mkMerge (
|
||||
map (diskname: {
|
||||
"${diskname}" = {
|
||||
type = "disk";
|
||||
device = "/dev/${diskname}";
|
||||
content = {
|
||||
type = "gpt";
|
||||
partitions = {
|
||||
zfs = {
|
||||
size = "100%";
|
||||
content = {
|
||||
type = "zfs";
|
||||
pool = "storage";
|
||||
};
|
||||
zfs = {
|
||||
size = "100%";
|
||||
content = {
|
||||
type = "zfs";
|
||||
pool = "zroot";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}) cfg.storage.disks
|
||||
)
|
||||
))
|
||||
];
|
||||
};
|
||||
ssd1 = lib.mkIf (cfg.root.disk1 != "") {
|
||||
type = "disk";
|
||||
device = "/dev/${cfg.root.disk1}";
|
||||
content = {
|
||||
type = "gpt";
|
||||
partitions = {
|
||||
zfs = {
|
||||
size = "100%";
|
||||
content = {
|
||||
type = "zfs";
|
||||
pool = "zroot";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
(lib.mkIf cfg.storage.enable (
|
||||
lib.mkMerge (
|
||||
map (diskname: {
|
||||
"${diskname}" = {
|
||||
type = "disk";
|
||||
device = "/dev/${diskname}";
|
||||
content = {
|
||||
type = "gpt";
|
||||
partitions = {
|
||||
zfs = {
|
||||
size = "100%";
|
||||
content = {
|
||||
type = "zfs";
|
||||
pool = "storage";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}) cfg.storage.disks
|
||||
)
|
||||
))
|
||||
];
|
||||
|
||||
zpool = {
|
||||
zroot = {
|
||||
type = "zpool";
|
||||
mode = lib.mkIf cfg.root.mirror "mirror";
|
||||
# Workaround: cannot import 'zroot': I/O error in disko tests
|
||||
options.cachefile = "none";
|
||||
rootFsOptions = {
|
||||
mountpoint = "none";
|
||||
xattr = "sa"; # für microvm virtiofs mount
|
||||
acltype = "posixacl"; # für microvm virtiofs mount
|
||||
compression = "zstd";
|
||||
"com.sun:auto-snapshot" = "false";
|
||||
zpool = {
|
||||
zroot = {
|
||||
type = "zpool";
|
||||
mode = lib.mkIf cfg.root.mirror "mirror";
|
||||
# Workaround: cannot import 'zroot': I/O error in disko tests
|
||||
options.cachefile = "none";
|
||||
rootFsOptions = {
|
||||
mountpoint = "none";
|
||||
xattr = "sa"; # für microvm virtiofs mount
|
||||
acltype = "posixacl"; # für microvm virtiofs mount
|
||||
compression = "zstd";
|
||||
"com.sun:auto-snapshot" = "false";
|
||||
};
|
||||
|
||||
datasets = {
|
||||
encrypted = {
|
||||
type = "zfs_fs";
|
||||
options = {
|
||||
mountpoint = "none";
|
||||
encryption = lib.mkIf cfg.encryption "aes-256-gcm";
|
||||
keyformat = lib.mkIf cfg.encryption "passphrase";
|
||||
keylocation = lib.mkIf cfg.encryption "file:///tmp/secret.key";
|
||||
};
|
||||
# use this to read the key during boot
|
||||
postCreateHook = lib.mkIf cfg.encryption ''
|
||||
zfs set keylocation="prompt" zroot/encrypted;
|
||||
'';
|
||||
};
|
||||
"encrypted/root" = {
|
||||
type = "zfs_fs";
|
||||
mountpoint = "/";
|
||||
options.mountpoint = "legacy";
|
||||
};
|
||||
"encrypted/var" = {
|
||||
type = "zfs_fs";
|
||||
mountpoint = "/var";
|
||||
options.mountpoint = "legacy";
|
||||
};
|
||||
"encrypted/etc" = {
|
||||
type = "zfs_fs";
|
||||
mountpoint = "/etc";
|
||||
options.mountpoint = "legacy";
|
||||
};
|
||||
"encrypted/home" = {
|
||||
type = "zfs_fs";
|
||||
mountpoint = "/home";
|
||||
options.mountpoint = "legacy";
|
||||
};
|
||||
"encrypted/nix" = {
|
||||
type = "zfs_fs";
|
||||
mountpoint = "/nix";
|
||||
options.mountpoint = "legacy";
|
||||
};
|
||||
reserved = {
|
||||
# for cow delete if pool is full
|
||||
options = {
|
||||
canmount = "off";
|
||||
mountpoint = "none";
|
||||
reservation = "${cfg.root.reservation}";
|
||||
};
|
||||
type = "zfs_fs";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
datasets = {
|
||||
encrypted = {
|
||||
type = "zfs_fs";
|
||||
options = {
|
||||
mountpoint = "none";
|
||||
encryption = lib.mkIf cfg.encryption "aes-256-gcm";
|
||||
keyformat = lib.mkIf cfg.encryption "passphrase";
|
||||
keylocation = lib.mkIf cfg.encryption "file:///tmp/secret.key";
|
||||
storage = lib.mkIf cfg.storage.enable {
|
||||
type = "zpool";
|
||||
mode = lib.mkIf (cfg.storage.mirror) "mirror";
|
||||
rootFsOptions = {
|
||||
mountpoint = "none";
|
||||
xattr = "sa"; # für microvm virtiofs mount
|
||||
acltype = "posixacl"; # für microvm virtiofs mount
|
||||
};
|
||||
datasets = {
|
||||
encrypted = {
|
||||
type = "zfs_fs";
|
||||
options = {
|
||||
mountpoint = "none";
|
||||
encryption = lib.mkIf cfg.encryption "aes-256-gcm";
|
||||
keyformat = lib.mkIf cfg.encryption "passphrase";
|
||||
keylocation = lib.mkIf cfg.encryption "file:///tmp/secret.key";
|
||||
};
|
||||
# use this to read the key during boot
|
||||
postCreateHook = lib.mkIf cfg.encryption ''
|
||||
zfs set keylocation="file:///root/secret.key" storage/encrypted;
|
||||
'';
|
||||
};
|
||||
# use this to read the key during boot
|
||||
postCreateHook = lib.mkIf cfg.encryption ''
|
||||
zfs set keylocation="prompt" zroot/encrypted;
|
||||
'';
|
||||
};
|
||||
"encrypted/root" = {
|
||||
type = "zfs_fs";
|
||||
mountpoint = "/";
|
||||
options.mountpoint = "legacy";
|
||||
};
|
||||
"encrypted/var" = {
|
||||
type = "zfs_fs";
|
||||
mountpoint = "/var";
|
||||
options.mountpoint = "legacy";
|
||||
};
|
||||
"encrypted/etc" = {
|
||||
type = "zfs_fs";
|
||||
mountpoint = "/etc";
|
||||
options.mountpoint = "legacy";
|
||||
};
|
||||
"encrypted/home" = {
|
||||
type = "zfs_fs";
|
||||
mountpoint = "/home";
|
||||
options.mountpoint = "legacy";
|
||||
};
|
||||
"encrypted/nix" = {
|
||||
type = "zfs_fs";
|
||||
mountpoint = "/nix";
|
||||
options.mountpoint = "legacy";
|
||||
};
|
||||
reserved = {
|
||||
# for cow delete if pool is full
|
||||
options = {
|
||||
canmount = "off";
|
||||
mountpoint = "none";
|
||||
reservation = "${cfg.root.reservation}";
|
||||
"encrypted/data" = {
|
||||
type = "zfs_fs";
|
||||
mountpoint = "/data";
|
||||
};
|
||||
type = "zfs_fs";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
storage = lib.mkIf cfg.storage.enable {
|
||||
type = "zpool";
|
||||
mode = lib.mkIf (cfg.storage.mirror) "mirror";
|
||||
rootFsOptions = {
|
||||
mountpoint = "none";
|
||||
xattr = "sa"; # für microvm virtiofs mount
|
||||
acltype = "posixacl"; # für microvm virtiofs mount
|
||||
};
|
||||
datasets = {
|
||||
encrypted = {
|
||||
type = "zfs_fs";
|
||||
options = {
|
||||
mountpoint = "none";
|
||||
encryption = lib.mkIf cfg.encryption "aes-256-gcm";
|
||||
keyformat = lib.mkIf cfg.encryption "passphrase";
|
||||
keylocation = lib.mkIf cfg.encryption "file:///tmp/secret.key";
|
||||
reserved = {
|
||||
# for cow delete if pool is full
|
||||
options = {
|
||||
canmount = "off";
|
||||
mountpoint = "none";
|
||||
reservation = "${cfg.storage.reservation}";
|
||||
};
|
||||
type = "zfs_fs";
|
||||
};
|
||||
# use this to read the key during boot
|
||||
postCreateHook = lib.mkIf cfg.encryption ''
|
||||
zfs set keylocation="prompt" storage/encrypted;
|
||||
'';
|
||||
};
|
||||
"encrypted/data" = {
|
||||
type = "zfs_fs";
|
||||
mountpoint = "/data";
|
||||
options.mountpoint = "legacy";
|
||||
};
|
||||
"encrypted/data/microvms" = {
|
||||
type = "zfs_fs";
|
||||
mountpoint = "/data/microvms";
|
||||
options.mountpoint = "legacy";
|
||||
};
|
||||
reserved = {
|
||||
# for cow delete if pool is full
|
||||
options = {
|
||||
canmount = "off";
|
||||
mountpoint = "none";
|
||||
reservation = "${cfg.storage.reservation}";
|
||||
};
|
||||
type = "zfs_fs";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
boot.zfs.devNodes = lib.mkDefault cfg.devNodes;
|
||||
boot.zfs.devNodes = lib.mkDefault cfg.devNodes;
|
||||
boot.zfs.extraPools = lib.mkIf cfg.storage.enable [ "storage" ];
|
||||
|
||||
fileSystems."/".neededForBoot = true;
|
||||
fileSystems."/etc".neededForBoot = true;
|
||||
fileSystems."/boot".neededForBoot = true;
|
||||
fileSystems."/var".neededForBoot = true;
|
||||
fileSystems."/home".neededForBoot = true;
|
||||
fileSystems."/nix".neededForBoot = true;
|
||||
};
|
||||
fileSystems."/".neededForBoot = true;
|
||||
fileSystems."/etc".neededForBoot = true;
|
||||
fileSystems."/var".neededForBoot = true;
|
||||
fileSystems."/home".neededForBoot = true;
|
||||
fileSystems."/nix".neededForBoot = true;
|
||||
})
|
||||
];
|
||||
}
|
||||
|
||||
@@ -70,13 +70,6 @@ rec {
|
||||
proto = "virtiofs";
|
||||
socket = "var.socket";
|
||||
}
|
||||
{
|
||||
source = "/var/lib/microvms/data/${hostName}";
|
||||
mountPoint = "/data";
|
||||
tag = "data";
|
||||
proto = "virtiofs";
|
||||
socket = "microdata.socket";
|
||||
}
|
||||
];
|
||||
|
||||
interfaces = [
|
||||
@@ -105,134 +98,135 @@ rec {
|
||||
inputsMod = inputs // { malobeo = self; };
|
||||
|
||||
|
||||
vmMicroVMOverwrites = hostname: options: {
|
||||
microvm = rec {
|
||||
mem = pkgs.lib.mkForce 4096;
|
||||
hypervisor = pkgs.lib.mkForce "qemu";
|
||||
socket = pkgs.lib.mkForce null;
|
||||
vmMicroVMOverwrites = hostname: options: {
|
||||
microvm = rec {
|
||||
mem = pkgs.lib.mkForce 4096;
|
||||
hypervisor = pkgs.lib.mkForce "qemu";
|
||||
socket = pkgs.lib.mkForce null;
|
||||
|
||||
|
||||
#needed for hosts that deploy imperative microvms (for example fanny)
|
||||
writableStoreOverlay = pkgs.lib.mkIf options.writableStore "/nix/.rw-store";
|
||||
volumes = pkgs.lib.mkIf options.writableStore [ {
|
||||
image = "nix-store-overlay.img";
|
||||
mountPoint = writableStoreOverlay;
|
||||
size = 2048;
|
||||
} ];
|
||||
#needed for hosts that deploy imperative microvms (for example fanny)
|
||||
writableStoreOverlay = pkgs.lib.mkIf options.writableStore "/nix/.rw-store";
|
||||
volumes = pkgs.lib.mkIf options.writableStore [ {
|
||||
image = "nix-store-overlay.img";
|
||||
mountPoint = writableStoreOverlay;
|
||||
size = 2048;
|
||||
} ];
|
||||
|
||||
shares = pkgs.lib.mkForce (pkgs.lib.optionals (!options.writableStore) [
|
||||
{
|
||||
tag = "ro-store";
|
||||
source = "/nix/store";
|
||||
mountPoint = "/nix/.ro-store";
|
||||
}
|
||||
] ++ pkgs.lib.optionals (options.varPath != "") [
|
||||
{
|
||||
source = "${options.varPath}";
|
||||
securityModel = "mapped";
|
||||
mountPoint = "/var";
|
||||
tag = "var";
|
||||
}
|
||||
]);
|
||||
shares = pkgs.lib.mkForce (pkgs.lib.optionals (!options.writableStore) [
|
||||
{
|
||||
tag = "ro-store";
|
||||
source = "/nix/store";
|
||||
mountPoint = "/nix/.ro-store";
|
||||
}
|
||||
] ++ pkgs.lib.optionals (options.varPath != "") [
|
||||
{
|
||||
source = "${options.varPath}";
|
||||
securityModel = "mapped";
|
||||
mountPoint = "/var";
|
||||
tag = "var";
|
||||
}
|
||||
]);
|
||||
|
||||
interfaces = pkgs.lib.mkIf (!options.withNetworking) (pkgs.lib.mkForce [{
|
||||
type = "user";
|
||||
id = "eth0";
|
||||
mac = "02:23:de:ad:be:ef";
|
||||
}]);
|
||||
interfaces = pkgs.lib.mkIf (!options.withNetworking) (pkgs.lib.mkForce [{
|
||||
type = "user";
|
||||
id = "eth0";
|
||||
mac = "02:23:de:ad:be:ef";
|
||||
}]);
|
||||
|
||||
#if networking is disabled forward port 80 to still have access to webservices
|
||||
forwardPorts = pkgs.lib.mkIf (!options.withNetworking && options.fwdPort != 0) (pkgs.lib.mkForce [
|
||||
{ from = "host"; host.port = options.fwdPort; guest.port = 80; }
|
||||
]);
|
||||
#if networking is disabled forward port 80 to still have access to webservices
|
||||
forwardPorts = pkgs.lib.mkIf (!options.withNetworking && options.fwdPort != 0) (pkgs.lib.mkForce [
|
||||
{ from = "host"; host.port = options.fwdPort; guest.port = 80; }
|
||||
]);
|
||||
|
||||
};
|
||||
|
||||
fileSystems = {
|
||||
"/".fsType = pkgs.lib.mkForce "tmpfs";
|
||||
|
||||
# prometheus uses a memory mapped file which doesnt seem supported by 9p shares
|
||||
# therefore we mount a tmpfs inside the datadir
|
||||
"/var/lib/prometheus2/data" = pkgs.lib.mkIf (hostname == "overwatch" && options.varPath != "") (pkgs.lib.mkForce {
|
||||
fsType = pkgs.lib.mkForce "tmpfs";
|
||||
});
|
||||
};
|
||||
|
||||
boot.isContainer = pkgs.lib.mkForce false;
|
||||
services.timesyncd.enable = false;
|
||||
users.users.root.password = "";
|
||||
services.getty.helpLine = ''
|
||||
Log in as "root" with an empty password.
|
||||
Use "reboot" to shut qemu down.
|
||||
'';
|
||||
};
|
||||
|
||||
vmDiskoOverwrites = {
|
||||
boot.initrd = {
|
||||
secrets = pkgs.lib.mkForce {};
|
||||
network.ssh.enable = pkgs.lib.mkForce false;
|
||||
};
|
||||
|
||||
malobeo.disks.enable = pkgs.lib.mkForce false;
|
||||
networking.hostId = "a3c3101f";
|
||||
};
|
||||
|
||||
vmSopsOverwrites = host: {
|
||||
sops.defaultSopsFile = pkgs.lib.mkForce ../${host}/dummy.yaml;
|
||||
|
||||
environment.etc = {
|
||||
devHostKey = {
|
||||
source = ../secrets/devkey_ed25519;
|
||||
mode = "0600";
|
||||
};
|
||||
|
||||
fileSystems = {
|
||||
"/".fsType = pkgs.lib.mkForce "tmpfs";
|
||||
|
||||
# prometheus uses a memory mapped file which doesnt seem supported by 9p shares
|
||||
# therefore we mount a tmpfs inside the datadir
|
||||
"/var/lib/prometheus2/data" = pkgs.lib.mkIf (hostname == "overwatch" && options.varPath != "") (pkgs.lib.mkForce {
|
||||
fsType = pkgs.lib.mkForce "tmpfs";
|
||||
});
|
||||
};
|
||||
|
||||
boot.isContainer = pkgs.lib.mkForce false;
|
||||
services.timesyncd.enable = false;
|
||||
users.users.root.password = "";
|
||||
services.getty.helpLine = ''
|
||||
Log in as "root" with an empty password.
|
||||
Use "reboot" to shut qemu down.
|
||||
'';
|
||||
};
|
||||
|
||||
services.openssh.hostKeys = [{
|
||||
path = "/etc/devHostKey";
|
||||
type = "ed25519";
|
||||
}];
|
||||
};
|
||||
vmDiskoOverwrites = {
|
||||
boot.initrd = {
|
||||
secrets = pkgs.lib.mkForce {};
|
||||
network.ssh.enable = pkgs.lib.mkForce false;
|
||||
};
|
||||
|
||||
vmNestedMicroVMOverwrites = host: sopsDummy: {
|
||||
malobeo.disks.enable = pkgs.lib.mkForce false;
|
||||
networking.hostId = "a3c3101f";
|
||||
};
|
||||
|
||||
microvm.vms = pkgs.lib.mkForce (
|
||||
let
|
||||
# Map the values to each hostname to then generate an Attrset using listToAttrs
|
||||
mapperFunc = name: { inherit name; value = {
|
||||
specialArgs.inputs = inputsMod;
|
||||
specialArgs.self = self;
|
||||
config = {
|
||||
imports = (makeMicroVM "${name}"
|
||||
"${hosts.malobeo.hosts.${name}.network.address}"
|
||||
"${hosts.malobeo.hosts.${name}.network.mac}" [
|
||||
../${name}/configuration.nix
|
||||
(vmMicroVMOverwrites name {
|
||||
withNetworking = true;
|
||||
varPath = "";
|
||||
writableStore = false; })
|
||||
(if sopsDummy then (vmSopsOverwrites name) else {})
|
||||
]);
|
||||
vmSopsOverwrites = host: {
|
||||
sops.defaultSopsFile = pkgs.lib.mkForce ../${host}/dummy.yaml;
|
||||
|
||||
environment.etc = {
|
||||
devHostKey = {
|
||||
source = ../secrets/devkey_ed25519;
|
||||
mode = "0600";
|
||||
};
|
||||
}; };
|
||||
in
|
||||
builtins.listToAttrs (map mapperFunc self.nixosConfigurations.${host}.config.services.malobeo.microvm.deployHosts));
|
||||
};
|
||||
};
|
||||
|
||||
buildVM = host: networking: sopsDummy: disableDisko: varPath: writableStore: fwdPort: (self.nixosConfigurations.${host}.extendModules {
|
||||
modules = [
|
||||
(vmMicroVMOverwrites host {
|
||||
withNetworking = networking;
|
||||
varPath = "${varPath}";
|
||||
writableStore = writableStore;
|
||||
fwdPort = fwdPort; })
|
||||
(if sopsDummy then (vmSopsOverwrites host) else {})
|
||||
(if disableDisko then vmDiskoOverwrites else {})
|
||||
] ++ pkgs.lib.optionals (hosts.malobeo.hosts.${host}.type != "microvm") [
|
||||
inputs.microvm.nixosModules.microvm
|
||||
] ++ pkgs.lib.optionals (self.nixosConfigurations.${host}.config ? services.malobeo.microvm.deployHosts) [
|
||||
(vmNestedMicroVMOverwrites host sopsDummy)
|
||||
];
|
||||
});
|
||||
services.openssh.hostKeys = [{
|
||||
path = "/etc/devHostKey";
|
||||
type = "ed25519";
|
||||
}];
|
||||
};
|
||||
|
||||
vmNestedMicroVMOverwrites = host: sopsDummy: {
|
||||
|
||||
services.malobeo.microvm.deployHosts = pkgs.lib.mkForce [];
|
||||
microvm.vms =
|
||||
let
|
||||
# Map the values to each hostname to then generate an Attrset using listToAttrs
|
||||
mapperFunc = name: { inherit name; value = {
|
||||
specialArgs.inputs = inputsMod;
|
||||
specialArgs.self = self;
|
||||
config = {
|
||||
imports = (makeMicroVM "${name}"
|
||||
"${hosts.malobeo.hosts.${name}.network.address}"
|
||||
"${hosts.malobeo.hosts.${name}.network.mac}" [
|
||||
../${name}/configuration.nix
|
||||
(vmMicroVMOverwrites name {
|
||||
withNetworking = true;
|
||||
varPath = "";
|
||||
writableStore = false; })
|
||||
(if sopsDummy then (vmSopsOverwrites name) else {})
|
||||
]);
|
||||
};
|
||||
}; };
|
||||
in
|
||||
builtins.listToAttrs (map mapperFunc self.nixosConfigurations.${host}.config.services.malobeo.microvm.deployHosts);
|
||||
};
|
||||
|
||||
buildVM = host: networking: sopsDummy: disableDisko: varPath: writableStore: fwdPort: (self.nixosConfigurations.${host}.extendModules {
|
||||
modules = [
|
||||
(vmMicroVMOverwrites host {
|
||||
withNetworking = networking;
|
||||
varPath = "${varPath}";
|
||||
writableStore = writableStore;
|
||||
fwdPort = fwdPort; })
|
||||
(if sopsDummy then (vmSopsOverwrites host) else {})
|
||||
(if disableDisko then vmDiskoOverwrites else {})
|
||||
] ++ pkgs.lib.optionals (hosts.malobeo.hosts.${host}.type != "microvm") [
|
||||
inputs.microvm.nixosModules.microvm
|
||||
] ++ pkgs.lib.optionals (self.nixosConfigurations.${host}.config ? services.malobeo.microvm.deployHosts) [
|
||||
(vmNestedMicroVMOverwrites host sopsDummy)
|
||||
];
|
||||
});
|
||||
|
||||
buildHost = hosts: (builtins.mapAttrs (host: settings: nixosSystem {
|
||||
system = if (settings.type == "rpi") then "aarch64-linux" else "x86_64-linux";
|
||||
|
||||
@@ -1,102 +0,0 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
with lib;
|
||||
let
|
||||
cfg = config.malobeo.backup;
|
||||
hostToCommand = (hostname: datasetNames:
|
||||
(map (dataset: {
|
||||
name = "${hostname}_${dataset.sourceDataset}";
|
||||
value = {
|
||||
inherit hostname;
|
||||
inherit (dataset) sourceDataset targetDataset;
|
||||
};
|
||||
} ) datasetNames));
|
||||
peers = import ./peers.nix;
|
||||
|
||||
enableSnapshots = cfg.snapshots != null;
|
||||
enableBackups = cfg.hosts != null;
|
||||
in
|
||||
{
|
||||
options.malobeo.backup = {
|
||||
enable = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = "Enable sanoid/syncoid based backup functionality";
|
||||
};
|
||||
|
||||
snapshots = mkOption {
|
||||
type = types.nullOr (types.listOf types.str);
|
||||
default = null;
|
||||
description = "Automatic snapshots will be created for the given datasets";
|
||||
};
|
||||
|
||||
hosts = mkOption {
|
||||
default = null;
|
||||
type = types.nullOr (types.attrsOf (types.listOf (types.submodule {
|
||||
options = {
|
||||
sourceDataset = mkOption {
|
||||
type = types.str;
|
||||
description = "The source that needs to be backed up";
|
||||
};
|
||||
targetDataset = mkOption {
|
||||
type = types.str;
|
||||
description = "The target dataset where the backup should be stored";
|
||||
};
|
||||
};
|
||||
})));
|
||||
description = ''
|
||||
Hostname with list of datasets to backup. This option should be defined on hosts that will store backups.
|
||||
|
||||
It is necessary to add the machines that get backed up to known hosts.
|
||||
This can be done for example systemwide using
|
||||
programs.ssh.knownHosts."10.100.0.101" = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHqp2/YiiIhai7wyScGZJ20gtrzY+lp4N/8unyRs4qhc";
|
||||
Or set it for the syncoid user directly.
|
||||
'';
|
||||
};
|
||||
|
||||
sshKey = mkOption {
|
||||
default = null;
|
||||
type = types.nullOr types.str;
|
||||
description = "Set path to ssh key used for pull backups. Otherwise default key is used";
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf (cfg.enable) {
|
||||
services.sanoid = mkIf (enableSnapshots) {
|
||||
enable = true;
|
||||
|
||||
templates."default" = {
|
||||
hourly = 24;
|
||||
daily = 30; #keep 30 daily snapshots
|
||||
monthly = 6; #keep 6 monthly backups
|
||||
yearly = 0;
|
||||
|
||||
autosnap = true; #take snapshots automatically
|
||||
autoprune = true; #delete old snapshots
|
||||
};
|
||||
|
||||
datasets = builtins.listToAttrs (map (name: { inherit name; value = {
|
||||
useTemplate = [ "default" ];
|
||||
recursive = true;
|
||||
}; }) cfg.snapshots);
|
||||
};
|
||||
|
||||
services.syncoid = mkIf (enableBackups) {
|
||||
enable = true;
|
||||
sshKey = cfg.sshKey;
|
||||
|
||||
commonArgs = [
|
||||
"--no-sync-snap"
|
||||
];
|
||||
|
||||
interval = "*-*-* 04:15:00";
|
||||
|
||||
commands = builtins.mapAttrs (name: value: {
|
||||
source = "backup@${peers.${value.hostname}.address}:${value.sourceDataset}";
|
||||
target = "${value.targetDataset}";
|
||||
sendOptions = "w";
|
||||
recvOptions = "\"\"";
|
||||
recursive = true;
|
||||
})(builtins.listToAttrs (builtins.concatLists (builtins.attrValues (builtins.mapAttrs hostToCommand cfg.hosts))));
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -26,13 +26,8 @@ in
|
||||
|
||||
config = lib.mkIf (cfg.enable && config.malobeo.disks.encryption) {
|
||||
boot = {
|
||||
loader.systemd-boot.enable = true;
|
||||
loader.efi.canTouchEfiVariables = true;
|
||||
supportedFilesystems = [ "vfat" "zfs" ];
|
||||
zfs = {
|
||||
forceImportAll = true;
|
||||
requestEncryptionCredentials = true;
|
||||
|
||||
};
|
||||
initrd = {
|
||||
availableKernelModules = cfg.ethernetDrivers;
|
||||
|
||||
@@ -102,22 +102,6 @@ in
|
||||
/run/current-system/sw/bin/microvm -Ru ${name}
|
||||
'';
|
||||
};
|
||||
|
||||
"microvm-init-dirs@${name}" = {
|
||||
description = "Initialize microvm directories";
|
||||
after = [ "zfs-mount.service" ];
|
||||
wantedBy = [ "microvm@${name}.service" ];
|
||||
unitConfig.ConditionPathExists = "!/var/lib/microvms/${name}/.is_initialized";
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
};
|
||||
script = ''
|
||||
mkdir -p /var/lib/microvms/${name}/var
|
||||
mkdir -p /var/lib/microvms/${name}/etc
|
||||
mkdir -p /var/lib/microvms/data/${name}
|
||||
touch /var/lib/microvms/${name}/.is_initialized
|
||||
'';
|
||||
};
|
||||
}) {} (cfg.deployHosts);
|
||||
|
||||
systemd.timers = builtins.foldl' (timers: name: timers // {
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
"vpn" = {
|
||||
role = "server";
|
||||
publicIp = "5.9.153.217";
|
||||
address = "10.100.0.1";
|
||||
address = [ "10.100.0.1/24" ];
|
||||
allowedIPs = [ "10.100.0.0/24" ];
|
||||
listenPort = 51821;
|
||||
publicKey = "hF9H10Y8Ar7zvZXFoNM8LSoaYFgPCXv30c54SSEucX4=";
|
||||
@@ -11,43 +11,36 @@
|
||||
|
||||
"celine" = {
|
||||
role = "client";
|
||||
address = "10.100.0.2";
|
||||
address = [ "10.100.0.2/24" ];
|
||||
allowedIPs = [ "10.100.0.2/32" ];
|
||||
publicKey = "Jgx82tSOmZJS4sm1o8Eci9ahaQdQir2PLq9dBqsWZw4=";
|
||||
};
|
||||
|
||||
"desktop" = {
|
||||
role = "client";
|
||||
address = "10.100.0.3";
|
||||
address = [ "10.100.0.3/24" ];
|
||||
allowedIPs = [ "10.100.0.3/32" ];
|
||||
publicKey = "FtY2lcdWcw+nvtydOOUDyaeh/xkaqHA8y9GXzqU0Am0=";
|
||||
};
|
||||
|
||||
"atlan-pc" = {
|
||||
role = "client";
|
||||
address = "10.100.0.5";
|
||||
address = [ "10.100.0.5/24" ];
|
||||
allowedIPs = [ "10.100.0.5/32" ];
|
||||
publicKey = "TrJ4UAF//zXdaLwZudI78L+rTC36zEDodTDOWNS4Y1Y=";
|
||||
};
|
||||
|
||||
"hetzner" = {
|
||||
role = "client";
|
||||
address = "10.100.0.6";
|
||||
address = [ "10.100.0.6/24" ];
|
||||
allowedIPs = [ "10.100.0.6/32" ];
|
||||
publicKey = "csRzgwtnzmSLeLkSwTwEOrdKq55UOxZacR5D3GopCTQ=";
|
||||
};
|
||||
|
||||
"fanny" = {
|
||||
role = "client";
|
||||
address = "10.100.0.101";
|
||||
address = [ "10.100.0.101/24" ];
|
||||
allowedIPs = [ "10.100.0.101/32" ];
|
||||
publicKey = "3U59F6T1s/1LaZBIa6wB0qsVuO6pRR9jfYZJIH2piAU=";
|
||||
};
|
||||
|
||||
"backup0" = {
|
||||
role = "client";
|
||||
address = "10.100.0.20";
|
||||
allowedIPs = [ "10.100.0.20/32" ];
|
||||
publicKey = "Pp55Jg//jREzHdbbIqTXc9N7rnLZIFw904qh6NLrACE=";
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,51 +0,0 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
with lib;
|
||||
let
|
||||
cfg = config.services.malobeo.printing;
|
||||
driverFile = pkgs.writeTextDir "share/cups/model/konicaminoltac258.ppd" (builtins.readFile ../KOC658UX.ppd);
|
||||
|
||||
defaultPpdOptions = {
|
||||
PageSize = "A4";
|
||||
SelectColor = "Grayscale";
|
||||
Finisher = "FS534";
|
||||
SaddleUnit = "SD511";
|
||||
Model = "C258";
|
||||
InputSlot = "Tray1";
|
||||
};
|
||||
|
||||
in
|
||||
{
|
||||
options.services.malobeo.printing = {
|
||||
enable = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = "Setup malobeo printers";
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf (cfg.enable) {
|
||||
services.printing.enable = true;
|
||||
services.printing.drivers = [
|
||||
driverFile
|
||||
];
|
||||
|
||||
hardware.printers.ensurePrinters = [ {
|
||||
name = "KonicaDefault";
|
||||
model = "konicaminoltac258.ppd";
|
||||
location = "Zine Workshop";
|
||||
deviceUri = "ipp://192.168.1.42/ipp";
|
||||
ppdOptions = defaultPpdOptions;
|
||||
}
|
||||
{
|
||||
name = "KonicaBooklet";
|
||||
model = "konicaminoltac258.ppd";
|
||||
location = "Zine Workshop";
|
||||
deviceUri = "ipp://192.168.1.42/ipp";
|
||||
ppdOptions = defaultPpdOptions // {
|
||||
Fold = "Stitch";
|
||||
Staple = "None";
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
}
|
||||
@@ -1,101 +0,0 @@
|
||||
{config, lib, pkgs, inputs, ...}:
|
||||
let
|
||||
cfg = config.malobeo.users;
|
||||
sshKeys = import ( inputs.self + /machines/ssh_keys.nix);
|
||||
inherit (config.networking) hostName;
|
||||
in
|
||||
{
|
||||
options.malobeo.users = {
|
||||
malobeo = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = true;
|
||||
description = "enable malobeo user, defaults to on, ";
|
||||
};
|
||||
admin = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = true;
|
||||
description = "enable admin user, defaults to on to prevent lockouts, passwordless sudo access";
|
||||
};
|
||||
backup = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = false;
|
||||
description = "enable backup user, ";
|
||||
};
|
||||
};
|
||||
config = lib.mkMerge [
|
||||
(lib.mkIf cfg.malobeo {
|
||||
users.users.malobeo = {
|
||||
isNormalUser = true;
|
||||
description = "malobeo user, password and ssh access, no root";
|
||||
extraGroups = [ "pipewire" "pulse-access" "scanner" "lp" ];
|
||||
openssh.authorizedKeys.keys = sshKeys.admins;
|
||||
hashedPassword = "$y$j9T$39oJwpbFDeETiyi9TjZ/2.$olUdnIIABp5TQSOzoysuEsomn2XPyzwVlM91ZsEkIz1";
|
||||
};
|
||||
environment.systemPackages = with pkgs; [];
|
||||
})
|
||||
(lib.mkIf cfg.admin {
|
||||
users.users.admin = {
|
||||
isNormalUser = true;
|
||||
description = "admin user, passwordless sudo access, only ssh";
|
||||
hashedPassword = null;
|
||||
openssh.authorizedKeys.keys = sshKeys.admins;
|
||||
extraGroups = [ "networkmanager" ];
|
||||
};
|
||||
environment.systemPackages = with pkgs; [];
|
||||
nix.settings.trusted-users = [ "admin" ];
|
||||
security.sudo.extraRules = [
|
||||
{
|
||||
users = [ "admin" ];
|
||||
commands = [
|
||||
{
|
||||
command = "ALL";
|
||||
options = [ "NOPASSWD" ];
|
||||
}
|
||||
];
|
||||
}
|
||||
];
|
||||
})
|
||||
(lib.mkIf cfg.backup {
|
||||
users.users.backup = {
|
||||
isNormalUser = true;
|
||||
hashedPassword = null;
|
||||
openssh.authorizedKeys.keys = sshKeys.backup;
|
||||
description = "backup user for pull style backups, can only use zfs commands";
|
||||
};
|
||||
environment.systemPackages = with pkgs; [];
|
||||
security.sudo.extraRules = [
|
||||
{
|
||||
users = [ "backup" ];
|
||||
commands = [
|
||||
{
|
||||
command = "/run/current-system/sw/bin/zfs";
|
||||
options = [ "NOPASSWD" ];
|
||||
}
|
||||
{
|
||||
command = "/run/current-system/sw/bin/zpool";
|
||||
options = [ "NOPASSWD" ];
|
||||
}
|
||||
];
|
||||
}
|
||||
];
|
||||
})
|
||||
{
|
||||
users.mutableUsers = false;
|
||||
services.openssh.hostKeys = [
|
||||
{
|
||||
path = "/etc/ssh/${hostName}";
|
||||
type = "ssh-ed25519";
|
||||
}
|
||||
];
|
||||
sops.age.sshKeyPaths = [ "/etc/ssh/${hostName}" ];
|
||||
environment.systemPackages = with pkgs; [
|
||||
nix-output-monitor
|
||||
vim
|
||||
htop
|
||||
wget
|
||||
git
|
||||
pciutils
|
||||
];
|
||||
}
|
||||
];
|
||||
}
|
||||
@@ -70,7 +70,7 @@ in
|
||||
interfaces = {
|
||||
malovpn = {
|
||||
mtu = 1340; #seems to be necessary to proxypass nginx traffic through vpn
|
||||
address = [ "${myPeer.address}/24" ];
|
||||
address = myPeer.address;
|
||||
autostart = cfg.autostart;
|
||||
listenPort = mkIf (myPeer.role == "server") myPeer.listenPort;
|
||||
|
||||
|
||||
@@ -37,7 +37,6 @@ with lib;
|
||||
hostName = "cloud.malobeo.org";
|
||||
config.adminpassFile = config.sops.secrets.nextcloudAdminPass.path;
|
||||
#https = true; #disable for testing
|
||||
datadir = "/data/services/nextcloud/";
|
||||
database.createLocally = true;
|
||||
config.dbtype = "pgsql";
|
||||
configureRedis = true;
|
||||
@@ -47,7 +46,7 @@ with lib;
|
||||
};
|
||||
extraAppsEnable = true;
|
||||
extraApps = {
|
||||
inherit (config.services.nextcloud.package.packages.apps) contacts calendar deck polls registration;
|
||||
inherit (config.services.nextcloud.package.packages.apps) contacts calendar deck polls;
|
||||
collectives = pkgs.fetchNextcloudApp {
|
||||
sha256 = "sha256-cj/8FhzxOACJaUEu0eG9r7iAQmnOG62yFHeyUICalFY=";
|
||||
url = "https://github.com/nextcloud/collectives/releases/download/v2.15.2/collectives-2.15.2.tar.gz";
|
||||
@@ -56,13 +55,6 @@ with lib;
|
||||
};
|
||||
settings = {
|
||||
trusted_domains = ["10.0.0.13"];
|
||||
trusted_proxies = [ "10.0.0.1" ];
|
||||
"maintenance_window_start" = "1";
|
||||
"default_phone_region" = "DE";
|
||||
};
|
||||
phpOptions = {
|
||||
"realpath_cache_size" = "0";
|
||||
"opcache.interned_strings_buffer" = "23";
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
@@ -8,60 +8,60 @@ sops:
|
||||
- recipient: age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPT3ZxNEpRVktDWG9BR0Rv
|
||||
ZUZQTkJwQ0pSblNvTkFOT3BBdjVaSzJhVzBvCnVWc2xRUjBnRFFXSDgxczRMSFMy
|
||||
WFdaMGo4eE13b0RkZkphN2MvOUZtRmcKLS0tIDFHZU9tNjBNa0sveUYzN2dmYnM1
|
||||
aDd0UlpMR3RNd3BDMmhqNmxhTFRoUlkK6Pni+cswKIU94WkP/fg5fzSmx/fhXjjl
|
||||
mRG2o4ALCqcOxAxHBrKJppUCLjUgKG53wPF/jlIzkvbwHwnqVMfYsQ==
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqSk9GWktrZ3FsRHpOcTJp
|
||||
Y3VWMytTRlhxVXJma1puT1lMRTN2NHBNV2xrCi8xYTFWeVN6RWl0Um9mZXpoKzFh
|
||||
SjVFcGJRNlhkVUZQYXpEb0EwYzUvUjQKLS0tIGEvdGdMRGxvcndxMllZTWZqKzg1
|
||||
aWlJOTdYV1JMM0dIWEFDSHRuQWdlcVUKsdwGZ3SkJEf4ALDhHUlSQJNKrFyWd7fW
|
||||
WTGk66NJ2yD8ko/6OyB9J9U0WPbFLgr972H+klBq/IDmOx0hClbYNA==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1g084sl230x94mkd2wq92s03mw0e8mnpjdjfx9uzaxw6psm8neyzqqwpnqe
|
||||
- recipient: age1w07s4y2uh0xd322ralyyh79545lvxzqncd0s65q9cx4ttlqv5u9s7y78gr
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRK2o2K2tPTFcvbXRkZ0lq
|
||||
bS9ZOUc3dG1JeERZYVNsc3k3RjcxQ0RsdkRJCkx1VFhBQXRDOElqakJ0eTd3NEJX
|
||||
b0JxOUtSOGJWeXlqdE5DdC9qNHA2N1UKLS0tIEFiQ3ZQM0NOaXRhUHBjVFhRMFk4
|
||||
VjBFeldXS1p0Zk1uSk02aHpJd3BPOHcKvCmnK/KttB4RgnID/fj2KOdjvNnV3EWU
|
||||
B9mW4yxbEqhoxtu+GFD3eR/8SvMPEsHl9xorT/ZygMG7hAzedSukWw==
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoNzdib3Ztd0g0MlVqYVF6
|
||||
cUtjZzEyY2FJYVRoT1p5RlJwYVQwUXVOUkNVCkp4V3hMYlJsaVN4RjlwQXNWS1Jt
|
||||
aitzWVdOcUdrNHorenZGZU1iWFZzVjgKLS0tIGNGcTU5OUJLM3VzQk1uODFwS1hO
|
||||
WG16Y25tMDkreGFnSFRKN1AybyttYWcKcLHJScp2Ozh0jIdi7Hb/tSjaCGorqXaC
|
||||
9DIrQPHbPP1RIc6Ak8Kn30/BHEWV3VaiBCT3vfS9pNJQNjB4T+901g==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2024-11-26T20:00:50Z"
|
||||
mac: ENC[AES256_GCM,data:qoY9SfpoU+8HfvD5v/1S6BOkbnZUmHIbtwr0tTSuPETjnFNgr1VVw9mnRatJKPYYFb9/rMZQWIqTY+iUIEkcTVyVXhd6ki5CHW+uxCeBIyMzq33rtEa/btkEUoii4iPieamBCIY21W0znE+edxfR04yRJtLxMICEbuW4Hjf6bwk=,iv:nG42fRgjpuIjPMYnn/6egEdzYolcUBsspaZ8zMv4888=,tag:C6apGoAvVLsWdLWSCwrx6w==,type:str]
|
||||
pgp:
|
||||
- created_at: "2025-03-05T08:24:30Z"
|
||||
- created_at: "2025-01-21T21:04:08Z"
|
||||
enc: |-
|
||||
-----BEGIN PGP MESSAGE-----
|
||||
|
||||
hQGMA5HdvEwzh/H7AQv+Lr4ISzvM/IEkckNhOOYAeZ0XCJ3JviSwT5wh3nd5u7ZJ
|
||||
tXdLgLwGvFs0gXBf/R2kAoyEMyFziP3dqehvrjwTipuj/5lLdw73X9kddGkGOeQK
|
||||
EDq2+cW3ufuukpyRq+o4lJjMmbwQuqvhqeVOxohQ677e1Xy8q6DorfwOgEgHegK1
|
||||
t1H/DlVHritv54mPjr9hx0fZ5Auow17wteKD71KD/Y4s9JNB0DghcHAGiwYZzL7U
|
||||
aFBY0itZyeJwH7rmFJDTQ+N+595t8dguTS/V1J0SKrIynMXVgTo6dpX10lSRubYe
|
||||
9TQRMO3bmnsdPlmVJ7SlCkcc8blpHSgeQYdaZgPjDmbs+cuAkUMBnR/aEFXIX5IC
|
||||
lohDRX5Vd7dUfVl5CiPNbG8hnvcp2lg7CUBV46fVQ5ZJ73jW1+1Bk3hxGdLklLlF
|
||||
N3hLzBBUpF8U0mvGMXJYX2gQKivRurIoLHZgmjQTjhA1uBfhTI3ktyLABz04dt7I
|
||||
OQYOlpsAZ/qnxbt+37LD0lgBz5XoHDuGNS2nnVQnuvtzt69GDP8mR1QXnhZedTrM
|
||||
kDxxTXV7tMIbqw55tr+qVVG4H8QGy1xat3LSTIxoMmz0MmkyjQhApPN2ipwjyNof
|
||||
X0Aw9hmAZV52
|
||||
=A/yB
|
||||
hQGMA5HdvEwzh/H7AQv/ejIylIgs3yeVcZriQTA8d/xyXTdFw6On422lTCDk3d0W
|
||||
GOdV44vAzUzNX5tziQtLjectLUrKh9Qb9WaP4VnTCGI0XJ/dEtYRCkYMx8MjjbLl
|
||||
8GqFi3Hw958Uykp9wt0iiP6BQ42Fo77EPxVcn21eHKZY0zg/vaeRXXeXSzkjzANs
|
||||
NN/KFS06uFRJhmp+0z6hDRrHnpb0wd5JGjHOp96jK9LmpwfZZZlVpAHp04hOhlPV
|
||||
cMmdjg9IRSubvbraTbDrgwB0h3JKdqovFDnAP/KvT+rw5xnVUVMq/3tUNq4MbfZb
|
||||
CvQrXsjQJQbEhY+eAJZVRO07kX0+zMvIin4ss7Xt++qlo4/OvFvuGbnUhJE+hrBb
|
||||
nkyGhbDrjpsfa3djCEZ0UxMAWtPeIQ7T8QMkGY+UKeJKxfOGSchARnfCtGD/rtsj
|
||||
wuhqGya7g7WP78WzwASzlPwB5jpdQ29/zLWXR60lNCYu0UYSVYmlspZnKEB0FkLO
|
||||
TNUrwXXMrM0XwMVaG/sF0lgBEPE6CTuE85evCHFyu6zhEAa7YimKAPIowcwYLSJ2
|
||||
46KfttJAYnRnb68Kk9N5xcFyvhKyTx/6eMdxkgr2LMoSTBDUgZfG3rDQC+ZbFE3m
|
||||
bUOvx3Ho80EC
|
||||
=oQd6
|
||||
-----END PGP MESSAGE-----
|
||||
fp: c4639370c41133a738f643a591ddbc4c3387f1fb
|
||||
- created_at: "2025-03-05T08:24:30Z"
|
||||
- created_at: "2025-01-21T21:04:08Z"
|
||||
enc: |-
|
||||
-----BEGIN PGP MESSAGE-----
|
||||
|
||||
hQIMA98TrrsQEbXUAQ//UtocoQPpMZL71RyjSnJFZq1NT4H5KxbcvQb4LtPBbanK
|
||||
/gPja40wOWXy/3plCHuZYQ/mR69k9URgwD6/0RSSmCCuVp/+FPbK3UbMYyTOtYBr
|
||||
wKnq9eRP8URK6LINJMcNHzfQtgvTcBclJSY1kLfUVjl2RV2NqXVa6+B1sHJdse8A
|
||||
5NyJ/VNRRrNDtNnmIaIHPFUBySVKLqiXeex4gFNy02IcwwSiFZnBt/ReaFjZQTGE
|
||||
TKfyohQF4V4/e35wvhbqWSFYZmWHCwW94gnwTwnlEO/H/NvbNUNDSYL6WwrIFF7+
|
||||
h/tP7nWbBxNqSByHGQuJnKSysndwUuSMuH+uj+uYdJDn1L1VEoErfAZcRSsDAz1Z
|
||||
BVkEaPJM6ZmRM48up5eHQtPG2rklmoFw/O/bPd9QUWJ/ZRu2gcY8aLGczHygaq6W
|
||||
gvZTCPrke7XZTd9S3mAcdlJ2iAYuKY4AmGqfmXbd7mRZXP3DQkRaA/IwCCNJVmhX
|
||||
um5MbCa17I9Uwh58NBmDuejLcmJDWL5jLmN6S86t3k3jKxwaX56SRwAD92klMdQq
|
||||
8UX2dkUkwnnI+YjfOEeLGDAT655TsejpE97JKjI/m39Pwnn+MrDEfNDHhfjX+9QC
|
||||
5k+fiP7yWc7hG3A7jt5vEadazPgDeqy0q7jbmTPtmdieqBs71P3j19l3VKAU8ZnS
|
||||
WAGz21MFYjhESmU7fqhTyVE9Dsd4GqyB+ZSa8hHj2ISaOi0QQ9JXjjtQhkDGlsB4
|
||||
/PrjZhyqd62wHS075YV1B9YqOhC1nAkC+s9mj9CrWIeH2JMOSK9EUyI=
|
||||
=5u7o
|
||||
hQIMA98TrrsQEbXUAQ//eu7YkPL7dU4AYWCZI7THsiJ51SOMahOXp/qC5yL18aZY
|
||||
r4SpyNhFezGIJfMuhwBSZZBI/MNW6M+zMwIJ2wkioxUDnDvfVi10/cV6p85U75Jn
|
||||
59e1afN+eekG2DCI6sWPmLy8jmYh4CQRdEurtfzquDOARZ4IHZjotP5AWI8OPHlM
|
||||
FdK2jGXFVevQY0m619CNm78D2NEdlGe1QtLVSazWQ8MsDLfMnHTYFUy3EoSihzat
|
||||
QkcR//8whzlLT/NcqKlnBDNBU7FvPov+ZdUmIw1mx2wp5f2sGp4m737Yhoey2aFL
|
||||
qLXHDc91nVRcw95FBDNYlSH8a2AzT4sm4vFR5EkC6vrfz+v1pdg1Fc3dc++hPgE0
|
||||
MYWn6f4v8lDhPhw2kpmAP4Oz4uPdmPgdfXKiIzr7qf3O5lIC6ZIIwoqhj2f0odj6
|
||||
7anDUN5C3B5ruFU3UNJEBLrZelbmg4zf2hAtzfoi0L9paIZX5SCLP3PDbvdRbADc
|
||||
oyC3Gw/DeddQ9ZeP+wYiwJ/614zRBmZRzQr9RFowf0gJBSS7TaWPCONfUJ/3eekX
|
||||
or8JpLTD5PMQNoS0L4S41Cj+yOg/AlmHF/9yvj1GVTKT9rBj3Snki9NOmY2ZUQo3
|
||||
BDdnsftA3w4q4iu06ojQkrjn/FJjmNzb83XR2WxrHFUAaY//nISyY/9uTsEhwFbS
|
||||
WAFlKfmyVc7nLBI12i0yWLLy/tcVF3c8gtGfNmyoe/RIr+6EQmzUi0v+X49Tnzpj
|
||||
8JAnE+4Jzm2ijqF4Ats5KoXqFiLUenJZQHJ3IFoI36n+hM4P/ICeZ4k=
|
||||
=s9pl
|
||||
-----END PGP MESSAGE-----
|
||||
fp: aef8d6c7e4761fc297cda833df13aebb1011b5d4
|
||||
unencrypted_suffix: _unencrypted
|
||||
|
||||
@@ -107,12 +107,6 @@ with lib;
|
||||
targets = [ "10.0.0.13:9002" ];
|
||||
}];
|
||||
}
|
||||
{
|
||||
job_name = "zineshop";
|
||||
static_configs = [{
|
||||
targets = [ "10.0.0.15:9002" ];
|
||||
}];
|
||||
}
|
||||
{
|
||||
job_name = "fanny";
|
||||
static_configs = [{
|
||||
|
||||
28
machines/secrets/keys/hosts/durruti.asc
Normal file
28
machines/secrets/keys/hosts/durruti.asc
Normal file
@@ -0,0 +1,28 @@
|
||||
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
||||
|
||||
xsFNBAAAAAABEADh28tGiUsmPPbsQYKSi9WiI4UCPO4qd7hEoER34Ku5w+kpy1MI
|
||||
ymJHNlZODjrjvznRidyYt+1vpED941LawzsujBV7pSfIBY0cQWYTbF/euuQFJYxN
|
||||
sBLG4kek5IhdnIsav2f7fMv6Rhfkau7p20AYkWUkpoUxBJTxixIkxrO90ODSzMMe
|
||||
tLI9MnqPcMASy6dbAGKXSABaYi9bwggIgyYHNaXThEuEAWPMPMMj8Wlo0H0X/B9O
|
||||
UEOHSA4N3TBKJXuDhsKgUo6ADLAA5op+YG+JtAdvdjW0XxtDamLkkrEx/fsYWsn2
|
||||
LjiX7z6cCQjYy+GG6LV82cavyF9sBAs8kEl4AVXVYsaB0g99rpY91EYLAD2Ddh4d
|
||||
lHPwPVQ52Ht3QeEPAsqeXRh+gZOp/xx6EJXXaH7aorXoWlbUFcCnTTEFAM0HibZg
|
||||
ChZEX+pl9RxdPeIwU4kd9LxNygDwp4YhdJzbcpHkp7RrkHJHgmAxUEVCxZfw/P2c
|
||||
GDIBHQSS4FZ5PIhh+aejYCo4BrisGuAjwlaH26BRNraM8EImaLwLuQZ1TOWm97tI
|
||||
BEI0JFscrTi2RSPgDCg1Cu78ocbcpqC3cRclXzRohvp83NpWnAQFCAdNaTttQsio
|
||||
lQTXxmJlaeo/0vHAN+Llukchh6sFzzNP3v4B8vLvdXkE3s5XYxJungblTwARAQAB
|
||||
zSlyb290IChJbXBvcnRlZCBmcm9tIFNTSCkgPHJvb3RAbG9jYWxob3N0PsLBYgQT
|
||||
AQgAFgUCAAAAAAkQWRHe9aQhhWcCGw8CGQEAALRQEABVEYsIn5zGV84caxE/LXN7
|
||||
7nDsUEyo3lCetStM7JT7uDdMl5t33pUAIbm4gv6/BrvVZ6pBtPfTrVrTKKDornKJ
|
||||
VU/tKims+CbnuPUIbOmuXcPbQIa/IF4WVop8XJTzMOSW636/eH1D2VTLI8Jmw35s
|
||||
qDmqx72hISUBGCszTJkThp8xUFMW5NcJc6zGB9I4vdac6Sf6yuZqmdfDm0MzcvmA
|
||||
tDASc6ZLeffPkJxUA+x2WouAYkfdV1CdVS6ob6owrSza/T+wQ3DgzO5AVZ31HXTa
|
||||
gDkVIBgdZYR2H8IaaTetb4m2+SgdXr7s9WCOR2i8DiSKpnUAJKoVIOl6pBd13jCu
|
||||
PHQzkKq6kqn4bRYCZil3fKDB90mVDIyixJJCt//VA5y9Tgggp9o7a+l35I9hCJ2F
|
||||
6AYtpfXkTbI9wqmk33TJX2litqqPZkhEERv25UDvnZ7Mm0my9QXJZ1Fp1nRLIKZg
|
||||
VABDS/wIB1QHtOldDLMeRD7Fnrnjgnyuk4/HmCem0wFDPHDo/ppa2QtCUk1xxywu
|
||||
fa7hs/oDVUMsofpDm6Ls4IgFXbSD9GUTDdB+UvZi5vITaZ1f1QLcrShhSUHkLIpc
|
||||
65Fj79r9cdHKdUhnM2+pTuVM6Az3huMkZ+abgjSHWSni2njowRUd2P7pG+ZhaUk3
|
||||
Rj7jxxXh1KQ7X8Rbbce8Mg==
|
||||
=sb6Z
|
||||
-----END PGP PUBLIC KEY BLOCK-----
|
||||
28
machines/secrets/keys/hosts/lucia.asc
Normal file
28
machines/secrets/keys/hosts/lucia.asc
Normal file
@@ -0,0 +1,28 @@
|
||||
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
||||
|
||||
xsFNBAAAAAABEAChmMEXC6TjRtYAHk6CsrnP0LFd1vOuH4+QSalj9fCaCpYVEStP
|
||||
u9EtW2DK8kSBdo8DAngzsMFt9PoSLcPcB00s9R6EACVuOn8nTVkyYtO/8hWJVexI
|
||||
G3SB/u2a+MYC2QEtw3Exzleexx3EkZywAzGWzJXpajMbGsfvssXl96xb7jxrxdNv
|
||||
Msx9t2RJGADSG6Vx1+A5UmFwITkGpn6wjvQXLvkim4ZHRzX588vgz/IdJ6yqOeeV
|
||||
v0VyVNTPfXkDO2urxRgZ5TG9wE5v9OKFofooR5T1rB/khW2jMoqavLWeRVCqVpmp
|
||||
MQ8VMkJzEoP7RX7vAAgCbVrTe55sMmXa9gtXo50wz6lHYHnepff6FuquS7szH7Ja
|
||||
lRnvx6CR1FwWIGhef/kxmNQKr2Mt3V7riFmv0bkR8ttI5uyGposeWfY1T6iJfxic
|
||||
duIYXrV11T6fWOEUh80aRz+8E46LFv4sGZjTOvHWrnetKNweuOC9/yaSDkEr35sM
|
||||
xVffS0wNGclhxl860qBCbhG/X7YYZs5sFHsRnsb7rvTCP8LtGhrjybE/b4WuGRCU
|
||||
rEftVOBe4NSwlsdmRVl5Cyk/ZkJncrUwlaH6laCjBfldQcdxAHzdzPZQhOmBaLkF
|
||||
1l0EpteSbEsi3CS2rkkriSsZ+nZwaccTa6+B6twrRmGvcBrZXlsugsdDSQARAQAB
|
||||
zSlyb290IChJbXBvcnRlZCBmcm9tIFNTSCkgPHJvb3RAbG9jYWxob3N0PsLBYgQT
|
||||
AQgAFgUCAAAAAAkQvNUtHtVQM9sCGw8CGQEAAGIaEAAoWuyjinNk8ovTAH+TjKWK
|
||||
UD4WXwt5OJ8l3FJPpecZbhTaBrRdlLzY1tlKzwd8c69QVOoqk83Rv4Fep9b8EFQ5
|
||||
U2bTtXLm/wINSetjf6vlLYxEPNKVzGtk8ejw32NPnJVsGeXNazlcJaR2jRW4kMcj
|
||||
A2b8aeUKxnLaoZYiCLZGvyvuB7oj/nIX7iuaIDHKR9oVyQOekeYlg9R92wKCZDiF
|
||||
1USoknPO2cSYFZpDM6tmIjkOoEgnwEZqzwI7q5dXz/mqp86XeMJWFkyTRhPT6Hiu
|
||||
iS/5wDsFJi7wgl4Jr6bBWFaHeBVSTJIwkoahxpM/qVYAYINgLO9erxMkmX5lRzxs
|
||||
NC3LsqQ+L5Isx96AXaZWf+IOYgN8nB3bsQqvlqbvMIUE3wkxg7oeNzDzvgxQM/Tf
|
||||
AC6zYHiGrs7WS6+ojx2flJnWA7mrOllimv5pTTUBtA7gh1JN9aUzzBjvF0LlzN1O
|
||||
DLyxu1PsIazI1eklUm0ljyOoqBnOrDZoC4Kz70pguDGDvipCAJWjG9SjXDwXGAA0
|
||||
sUhnebh2HPZYj73xDIrbgkg+79n6U5UuewUFwDQfE8VFDp62s1s9haCRUKU6uwiL
|
||||
i31OKOkDcYSyx/3/VvaT3lT247VERDw/5yVYrrhQwxS4WSabX8gz6qfKB4bi/HVs
|
||||
lX2duwzSRzuytZCKKG+fdA==
|
||||
=VTby
|
||||
-----END PGP PUBLIC KEY BLOCK-----
|
||||
28
machines/secrets/keys/hosts/moderatio.asc
Normal file
28
machines/secrets/keys/hosts/moderatio.asc
Normal file
@@ -0,0 +1,28 @@
|
||||
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
||||
|
||||
xsFNBAAAAAABEACm+W5sGSC25OtlwQdOBCSfX2DnPuk5abjxY5HMIv3MnySouXpW
|
||||
L3VoE6Irur9lZwfKrXaUweJPJHVo/Sfknh9GSBCW6yFFcGZ5nNx/QNdbfjOSaUw2
|
||||
0BkW1CYRVcLIKSHpepbTDHBxgKaCYsmupptFQ0Nzx19PPMV/WBqrkSlEpDJyq9y6
|
||||
cTaGulRKWBVDytMFmibhGlqpfEI8bzrxaeGTqiRTZJqL3zDDi2afDt1kJeCXKd32
|
||||
XOywDZgB5CinY3qsR45ftC6mZ5fV+ex3M/Uc4YJiVgwg6GlSdiYW9Mqf4koqpLCq
|
||||
Xq3ztEo9FjFen7KmAcLstFmzY3fAXGIJzb0CfvVrM32wsdC6NRDINdMBmrOeKXT7
|
||||
g45n0LOdCFr4AOKyABqMudbKrgF9txHt549oaQ0wHCy1nStji1OpbhdpCKDFKPnl
|
||||
ojG1Nur9DPRFmQ01I3KIjvCrf8J+CgI5YVwOr+m5Zw3i/b0qd+9R/8oAmzhhuyt7
|
||||
kckSVTCjNzsDgjjOa8FVQJremTdkQuWOlx0HxC3aQdSoPxOfpeUhybfttNpvUuta
|
||||
5EbsiS/PJfzMOtZDG++naKO/xGJDiaYDhW1ZeGI2fOFUm4RYHqCFES32XF4ygpGq
|
||||
wz2bZNKKSf4lxoD1+SBqOyd1eN3u8GmX8OgUB3TpgEuQb/XL31zDKCZ7pwARAQAB
|
||||
zSlyb290IChJbXBvcnRlZCBmcm9tIFNTSCkgPHJvb3RAbG9jYWxob3N0PsLBYgQT
|
||||
AQgAFgUCAAAAAAkQj5s8BYqm1MICGw8CGQEAACMDEAAFko8JYC1zGt5rFKokXGbs
|
||||
K331UHReN02QpdL8fhMt0Rqoh1FKt8Sr8lzCLPNOnlgxSG5lXmA3dFfWAnFrNw5T
|
||||
1u1oU0sB+CiekyWXJxTASur1g3DtLv6qA19Uw4i9bu57LK5E0ycoI3RnR+YbDri0
|
||||
psPNP01x7NBO42O71rnBypGbCPXnLOAaKq+ISCN+XCZBkmjKhcWJlg5DJfUGCEdr
|
||||
DCKi/1j5mgs8H3sUrc5Y4gLz3BWuypAGWhQr/KDAcmCm/u0ZfzVyrxw50eMuzeF7
|
||||
GfePPI70nXjUlywuFUFg7EWlCT6sRtZf+o4jkXcwGpZLx2/rdZ9J2I4VmYakBVpA
|
||||
2OQwi47YAFe1wz+nsF3fImuGQdHu0x0sFLbuJaSJCOVYhMcZhskRygqqI+wEvDF1
|
||||
i7SYzi5Xt7rJrSaqGhAzlg1Cc8wzMhoCE/IU5Hd55OtbvRwZ2JKH+UAl/L9Qizqy
|
||||
AM7nSrUjA5p4H09PMuKGmCEcZDKpH2huAeqmtGQ626edE2WNduE2jCdAIcN263PX
|
||||
1+TIe4IRLhtmTKqfJgbzrt0cSIAsuvI8s78ehsP2eNANdkQjzBAaEiOo75G/g+sd
|
||||
tWl8gxOhrPKkb07KqcPEfXq4QYk7kV+pWuA2yMiTX5A+oy8gVFBxUp+zbjYeRuW8
|
||||
cpHyvbDvdnQ5LGNC/v0rdA==
|
||||
=Rmch
|
||||
-----END PGP PUBLIC KEY BLOCK-----
|
||||
@@ -5,8 +5,4 @@
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINQg6a2EGmq+i9lfwU+SRMQ8MGN3is3VS6janzl9qOHo quaseb67@hzdr.de"
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICKaEcGaSKU0xC5qCwzj2oCLLG4PYjWHZ7/CXHw4urVk atlan@nixos"
|
||||
];
|
||||
backup = [
|
||||
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDIGryhnXdmbGObONG88K+c9zeduMrwtoLHwzMDZg3UXB+Cnq2FXWOrlLZxA+95VUgHpyGZiykJmzeWrKhldDlDeGGd8QCCLeuliiOgXADTYjWaVfhd+6arPZrK2VtqqsguvH40gW1xfoGAOmAT4WFnxWxIaEip0V2u6NOoKTiH9I3bz2Qe4lfJvPXig+XwCXcukXd6XUkDFYDpiw8XNV3X7pqTus5d2RYR97bAhIYZZQ6h50ZpTY8N0lFh4RY5yfx8BhxJW3tfoi9uZvVuPx7dGPsZsSniENFPMNz3UwHGitTJMr4088cJrAGgd5lyFuLouiHiM2JMGA0wx9wWTbWJEwTLaTVQK9gSJf857ndV2zCh9vKlfko4w9bQgqxKg4U/mY8dXX1E7D51nD2ci8Ed+ZG+NEneFLyZhLsD82GkBY+YovA+4xm/pcx+hBhlyqGNxI8v+Jh+JhEyD/ZLgJfq3ZMbGIGsTiDwZ2flLLxImHHEoDoT6PHU6hDhPDJu560="
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJKl5FWPskhlnzJs1+mMYrVTMNnRG92uFKUgGlteTPhL"
|
||||
];
|
||||
}
|
||||
|
||||
@@ -24,7 +24,7 @@ in
|
||||
|
||||
malobeo.disks = {
|
||||
enable = true;
|
||||
encryption = false;
|
||||
encryption = true;
|
||||
hostId = "83abc8cb";
|
||||
devNodes = "/dev/disk/by-path/";
|
||||
root = {
|
||||
|
||||
@@ -66,15 +66,6 @@ with lib;
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
virtualHosts."shop.malobeo.org" = {
|
||||
locations."/" = {
|
||||
proxyPass = "http://10.100.0.101";
|
||||
extraConfig = ''
|
||||
proxy_set_header Host $host;
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
system.stateVersion = "22.11"; # Did you read the comment?
|
||||
|
||||
@@ -1,34 +0,0 @@
|
||||
{ self, config, lib, pkgs, inputs, ... }:
|
||||
|
||||
with lib;
|
||||
|
||||
{
|
||||
networking = {
|
||||
hostName = mkDefault "zineshop";
|
||||
useDHCP = false;
|
||||
};
|
||||
|
||||
imports = [
|
||||
inputs.malobeo.nixosModules.malobeo.metrics
|
||||
inputs.malobeo.nixosModules.malobeo.printing
|
||||
inputs.zineshop.nixosModules.zineshop
|
||||
../modules/malobeo_user.nix
|
||||
../modules/sshd.nix
|
||||
];
|
||||
|
||||
malobeo.metrics = {
|
||||
enable = true;
|
||||
enablePromtail = true;
|
||||
logNginx = true;
|
||||
lokiHost = "10.0.0.14";
|
||||
};
|
||||
|
||||
services.printing.enable = true;
|
||||
services.malobeo.printing.enable = true;
|
||||
|
||||
services.zineshop.enable = true;
|
||||
networking.firewall.allowedTCPPorts = [ 8080 ];
|
||||
|
||||
system.stateVersion = "22.11"; # Did you read the comment?
|
||||
}
|
||||
|
||||
@@ -39,7 +39,6 @@ in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems
|
||||
pkgs.age
|
||||
pkgs.python310Packages.grip
|
||||
pkgs.mdbook
|
||||
pkgs.ssh-to-age
|
||||
microvmpkg.microvm
|
||||
];
|
||||
|
||||
@@ -50,7 +49,6 @@ in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems
|
||||
legacyPackages = {
|
||||
scripts.remote-install = pkgs.writeShellScriptBin "remote-install" (builtins.readFile ./scripts/remote-install-encrypt.sh);
|
||||
scripts.boot-unlock = pkgs.writeShellScriptBin "boot-unlock" (builtins.readFile ./scripts/unlock-boot.sh);
|
||||
scripts.add-host-keys = pkgs.writeShellScriptBin "add-host-keys" (builtins.readFile ./scripts/add_new_host_keys.sh);
|
||||
scripts.run-vm = self.packages.${system}.run-vm;
|
||||
};
|
||||
|
||||
@@ -115,9 +113,6 @@ in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems
|
||||
initssh.imports = [ ./machines/modules/malobeo/initssh.nix ];
|
||||
metrics.imports = [ ./machines/modules/malobeo/metrics.nix ];
|
||||
disko.imports = [ ./machines/modules/disko ];
|
||||
users.imports = [ ./machines/modules/malobeo/users.nix ];
|
||||
backup.imports = [ ./machines/modules/malobeo/backup.nix ];
|
||||
printing.imports = [ ./machines/modules/malobeo/printing.nix ];
|
||||
};
|
||||
|
||||
hydraJobs = nixpkgs.lib.mapAttrs (_: nixpkgs.lib.hydraJob) (
|
||||
|
||||
@@ -1,51 +0,0 @@
|
||||
set -o errexit
|
||||
#set -o pipefail
|
||||
|
||||
if [ ! -e flake.nix ]
|
||||
then
|
||||
echo "flake.nix not found. Searching down."
|
||||
while [ ! -e flake.nix ]
|
||||
do
|
||||
if [ $PWD = "/" ]
|
||||
then
|
||||
echo "Found root. Aborting."
|
||||
exit 1
|
||||
else
|
||||
cd ..
|
||||
fi
|
||||
done
|
||||
fi
|
||||
|
||||
read -p "Enter new host name: " hostname
|
||||
|
||||
if [ "$hostname" = "" ]; then exit 0
|
||||
fi
|
||||
|
||||
pwpath="machines/$hostname/secrets"
|
||||
hostkey="ssh_host_ed25519_key"
|
||||
initrdkey="initrd_ed25519_key"
|
||||
|
||||
mkdir -p "$pwpath"
|
||||
cd "$pwpath"
|
||||
|
||||
# Generate SSH keys
|
||||
ssh-keygen -f $hostkey -t ed25519 -N "" -C "root@$host"
|
||||
ssh-keygen -f $initrdkey -t ed25519 -N "" -C "root@$host-initrd"
|
||||
|
||||
#encrypt the private keys
|
||||
sops -e -i ./$hostkey
|
||||
sops -e -i ./$initrdkey
|
||||
|
||||
#generate encryption key
|
||||
tr -dc 'A-Za-z0-9' < /dev/urandom | head -c 20 > disk.key
|
||||
sops -e -i ./disk.key
|
||||
|
||||
# Info
|
||||
echo
|
||||
echo "Hier ist der age public key für sops etc:"
|
||||
echo "$(ssh-to-age -i ./"$hostkey".pub)"
|
||||
echo
|
||||
echo "Hier ist eine reproduzierbare mac-addresse:"
|
||||
echo "$hostname"|md5sum|sed 's/^\(..\)\(..\)\(..\)\(..\)\(..\).*$/02:\1:\2:\3:\4:\5/'
|
||||
|
||||
exit 0
|
||||
@@ -25,9 +25,6 @@ fi
|
||||
|
||||
hostname=$1
|
||||
ipaddress=$2
|
||||
pwpath="machines/$hostname/secrets"
|
||||
hostkey="ssh_host_ed25519_key"
|
||||
initrdkey="initrd_ed25519_key"
|
||||
|
||||
# Create a temporary directory
|
||||
temp=$(mktemp -d)
|
||||
@@ -40,13 +37,14 @@ trap cleanup EXIT
|
||||
|
||||
# Create the directory where sshd expects to find the host keys
|
||||
install -d -m755 "$temp/etc/ssh/"
|
||||
install -d -m755 "$temp/root/"
|
||||
|
||||
diskKey=$(sops -d $pwpath/disk.key)
|
||||
diskKey=$(sops -d machines/$hostname/disk.key)
|
||||
echo "$diskKey" > /tmp/secret.key
|
||||
echo "$diskKey" > $temp/root/secret.key
|
||||
|
||||
sops -d "$pwpath/$hostkey" > "$temp/etc/ssh/$hostname"
|
||||
|
||||
sops -d "$pwpath/$initrdkey" > "$temp/etc/ssh/initrd"
|
||||
ssh-keygen -f $temp/etc/ssh/"$hostname" -t ed25519 -N ""
|
||||
ssh-keygen -f $temp/etc/ssh/initrd -t ed25519 -N ""
|
||||
|
||||
# # Set the correct permissions so sshd will accept the key
|
||||
chmod 600 "$temp/etc/ssh/$hostname"
|
||||
@@ -62,4 +60,4 @@ if [ $# = 3 ]
|
||||
else
|
||||
nix run github:numtide/nixos-anywhere -- --extra-files "$temp" \
|
||||
--disk-encryption-keys /tmp/secret.key /tmp/secret.key --flake .#$hostname root@$ipaddress
|
||||
fi
|
||||
fi
|
||||
@@ -2,7 +2,7 @@ set -o errexit
|
||||
set -o pipefail
|
||||
|
||||
sshoptions="-o StrictHostKeyChecking=no -o ServerAliveInterval=1 -o ServerAliveCountMax=1 -p 222 -T"
|
||||
hostname=$1
|
||||
HOSTNAME=$1
|
||||
|
||||
if [ ! -e flake.nix ]
|
||||
then
|
||||
@@ -19,19 +19,17 @@ if [ ! -e flake.nix ]
|
||||
done
|
||||
fi
|
||||
|
||||
diskkey=$(sops -d machines/$hostname/secrets/disk.key)
|
||||
|
||||
echo
|
||||
if [ $# = 1 ]
|
||||
then
|
||||
echo "$diskkey" | ssh $sshoptions root@$hostname-initrd "systemd-tty-ask-password-agent" #root
|
||||
echo "$diskkey" | ssh $sshoptions root@$hostname-initrd "systemd-tty-ask-password-agent" #data
|
||||
diskkey=$(sops -d machines/$HOSTNAME/disk.key)
|
||||
echo "$diskkey" | ssh $sshoptions root@$HOSTNAME-initrd "systemd-tty-ask-password-agent" #root
|
||||
|
||||
elif [ $# = 2 ]
|
||||
then
|
||||
ip=$2
|
||||
echo "$diskkey" | ssh $sshoptions root@$ip "systemd-tty-ask-password-agent" #root
|
||||
echo "$diskkey" | ssh $sshoptions root@$ip "systemd-tty-ask-password-agent" #data
|
||||
diskkey=$(sops -d machines/$HOSTNAME/disk.key)
|
||||
IP=$2
|
||||
echo "$diskkey" | ssh $sshoptions root@$IP "systemd-tty-ask-password-agent" #root
|
||||
|
||||
else
|
||||
echo
|
||||
@@ -39,4 +37,4 @@ else
|
||||
echo "Usage: $0 <hostname> [ip]"
|
||||
echo "If an IP is not provided, the hostname will be used as the IP address."
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
Reference in New Issue
Block a user