maurice/snix
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(ops/nevsky): sync remaining whitby secrets to nevsky

Browse source 
Change-Id: I604426d8e9e91417607eed71f0dbcaf93e88c31d
Reviewed-on: https://cl.tvl.fyi/c/depot/+/13074
Tested-by: BuildkiteCI
Reviewed-by: sterni <sternenseemann@systemli.org>
This commit is contained in:
Vincent Ambo 2025-02-02 00:16:14 +03:00 • committed by tazjin
parent 749a01b681
commit 4783d83686
1 changed files with 32 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

32
ops/machines/nevsky/default.nix
View file

@ -98,8 +98,15 @@ in
secretFile = name: depot.ops.secrets."${name}.age"; secretFile = name: depot.ops.secrets."${name}.age";
in in
{ {
clbot.file = secretFile "clbot";
gerrit-autosubmit.file = secretFile "gerrit-autosubmit";
grafana.file = secretFile "grafana";
irccat.file = secretFile "irccat"; irccat.file = secretFile "irccat";
keycloak-db.file = secretFile "keycloak-db";
owothia.file = secretFile "owothia"; owothia.file = secretFile "owothia";
panettone.file = secretFile "panettone";
smtprelay.file = secretFile "smtprelay";
teleirc.file = secretFile "teleirc";
wg-privkey.file = depot.ops.secrets."wg-nevsky.age"; wg-privkey.file = depot.ops.secrets."wg-nevsky.age";
nix-cache-priv = { nix-cache-priv = {
@ -137,6 +144,31 @@ in
mode = "0440"; mode = "0440";
group = "buildkite-agents"; group = "buildkite-agents";
}; };
gerrit-besadii-config = {
file = secretFile "besadii";
owner = "git";
};
gerrit-secrets = {
file = secretFile "gerrit-secrets";
path = "/var/lib/gerrit/etc/secure.config";
owner = "git";
mode = "0400";
};
clbot-ssh = {
file = secretFile "clbot-ssh";
owner = "clbot";
};
depot-replica-key = {
file = secretFile "depot-replica-key";
mode = "0500";
owner = "git";
group = "git";
path = "/var/lib/git/.ssh/id_ed25519";
};
}; };
networking = { networking = {